# AI Crawl Control — the trap no longer marks a TLS fingerprint on its own

> A client that follows the trap is marked by its IP and by its TLS fingerprint within its own network only, and IP allow rules and verified crawlers are never marked.

A client that followed the [trap](https://developers.openwaf.dev/ai-crawl-control/trap-and-tarpit/#trap) used to be marked for 24 hours by its IP and by its TLS fingerprint. A TLS fingerprint identifies a TLS library, not a client, so one scraper could get every client with the same library, such as every `curl` of a Linux distribution, treated as a trap follower on that site.

Now a [trap follower is marked](https://developers.openwaf.dev/ai-crawl-control/trap-and-tarpit/#marks) by its exact IP and by its TLS fingerprint only within its network (`/24` for IPv4, `/64` for IPv6). The fingerprint is marked on its own only when it follows the trap from at least 3 different networks within 24 hours and isn't one of the fingerprints the edge sees most often in your site's normal traffic. Marks still expire after 24 hours.

[IP `allow` rules](https://developers.openwaf.dev/ai-crawl-control/trap-and-tarpit/#exempt), zone or global, now exempt a client from the trap: it is never marked, and an earlier mark doesn't apply to it. Verified crawlers were already exempt.