`Cloudflare Custom Hostname Verification`

Cloudflare says the user agent Cloudflare Custom Hostname Verification is used when you validate a custom hostname with an HTTP ownership token. The page does not say whether robots.txt controls this token. This check matches the whole token, including the spaces, so a group named Cloudflare does not match, and it still reports the RFC 9309 decision.

robots.txt token: Cloudflare Custom Hostname Verification
Operator: Cloudflare
Kind: owner_requested
robots.txt: not_stated. The cited page does not say whether robots.txt controls this token.
HTTP user-agent: Cloudflare Custom Hostname Verification The page prints Cloudflare Custom Hostname Verification as the whole user agent, including the spaces. It does not print a separate robots.txt User-agent line. A group named Cloudflare does not match this token.
IP list: None on the cited page. The page does not publish an IP list. Botcard does not copy addresses.
Source: Cloudflare crawlers. Retrieved 2026-10-18, page says updated 2026-08-06.

JSON

curl -s https://whosthatbot.com/v1/crawlers/cloudflare-custom-hostname

Check this token

tools/call with name check_robots is the same check at POST /mcp. The pasted file disallows Cloudflare Custom Hostname Verification on /docs and allows *. The call does not fetch a host.

curl -s https://whosthatbot.com/mcp -H 'content-type: application/json' -H 'accept: application/json, text/event-stream' -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"check_robots","arguments":{"robots_txt":"User-agent: Cloudflare Custom Hostname Verification\nDisallow: /\n\nUser-agent: *\nAllow: /\n","path":"/docs","ids":["cloudflare-custom-hostname"]}}}'

That call returns fetched_target false. This row is disallow via group Cloudflare Custom Hostname Verification, rule Disallow: /.