Security scanners 17

Censys · Security scanners

Censys' internet-wide scanner, which probes public IP addresses to build the host/service data behind Censys Search. Censys publishes a fixed set of scanner subnets and ASNs for opt-out purposes.

Cloudflare · Security scanners

Cloudflare's custom-hostname ownership checker. Cloudflare documents that requests carrying this user agent are triggered when a customer chooses to validate a custom hostname with an HTTP ownership token, which requires fetching the token from the hostname being claimed.

Cloudflare · Security scanners

The crawler behind Cloudflare Security Insights, which reviews a zone for security problems and surfaces them in the Cloudflare dashboard. Its user agent is a Chrome string with a Cloudflare self-identification appended; Cloudflare's crawler reference documents it but does not tie the traffic to any published address list, so no CIDR recipe is attached.

Cloudflare · Security scanners

Cloudflare's SSL/TLS Recommender crawler, which fetches a customer origin over both HTTP and HTTPS to determine whether the site can be served fully over HTTPS and to recommend TLS settings.

Palo Alto Networks · Security scanners

Palo Alto Networks' attack-surface-management scanner. It continuously scans the global internet from a published set of ranges to map its customers' internet-facing assets and discover emerging threats, and its requests carry a plain-English user agent naming the company and an opt-out contact address.

Detectify · Security scanners

Detectify's external attack-surface and vulnerability scanner, which probes customer-configured assets from a documented set of AWS-hosted source IPs. The operator publishes both the source IPs and the scanner's user-agent strings.

EdgeWatch · Security scanners

Internet-wide scanner for EdgeWatch's attack-surface and threat-intelligence platform. It makes connection attempts to public IPv4 and IPv6 addresses daily and completes protocol handshakes to fingerprint the services it finds; EdgeWatch documents the subnet its scanners use and an e-mail opt-out.

Halo Security · Security scanners

The scanning engine of Halo Security's attack-surface-management platform, which probes web applications a customer has added as a target to find vulnerabilities and inventory their external assets. Halo Security documents that it appends the string vuln_scan_by_trustedsite_com_halo_security to the User-Agent header so site owners can tell its traffic apart, and publishes the network ranges its scanners and web-preview "webshot" service originate from. It scans only customer-configured targets rather than crawling the open web, so Halo Security documents no robots.txt handling for it.

Driftnet · Security scanners

Driftnet's internet-measurement scanner, run from the internet-measurement.com domain, which probes publicly exposed services to give network owners an external view of their infrastructure. The operator states this traffic never attempts to log in to systems and publishes its scanner IP ranges.

JusProg e.V. · Security scanners

Web crawler operated by JusProg e.V., a German non-profit youth-protection association, that fetches and rates web pages to build the age-classification database used by its parental-control filtering software.

LeakIX · Security scanners

LeakIX's internet-wide recon scanner (l9explore), which probes exposed services to populate the LeakIX misconfiguration/vulnerability search engine. Its probe fleet publishes a live, per-host list of source IPs at scan.leakix.net whose hostnames resolve under scan.leakix.org, and its scanning tool sets an identifiable user-agent.

IBM Deutschland Research & Development GmbH · Security scanners

The web crawler of the Content Security Division of IBM Germany Research & Development, which crawls pages and classifies their content into more than 65 categories to build the URL-filter database shipped in IBM's content filtering products and OEM SDK. The crawler page explains that the name predates IBM — it comes from ONLY Solutions GmbH, which built the crawler in the late 1990s — and that the token was deliberately never renamed so that existing robots.txt entries keep working. The operator documents its user agent, its address ranges and a hostname to check them against.

Qualys · Security scanners

Qualys' SSL Labs server test, which runs visitor-initiated and monthly (SSL Pulse) TLS-configuration assessments of public HTTPS sites. Qualys documents the assessments as slow and non-intrusive and publishes the scanner's source IP ranges in its support knowledge base.

Crissy Field GmbH (Repo Lookout) · Security scanners

Repo Lookout is a non-commercial internet-wide security scanner that looks for source-code repositories accidentally exposed to the public web and reports them to the domain's technical contact. The operator documents the scanner's user-agent prefix and offers two opt-outs: an email request, or denying every request whose user agent starts with RepoLookoutBot.

UBT (EU) Ltd · Security scanners

UBT's web crawler, which powers a classification service that categorises public websites by their content. It re-crawls a given site roughly once every three days. UBT publishes no IP list, and instead documents reverse-DNS verification against the ubtsupport.com domain.

Stripe · Security scanners

Stripe's automated web crawler. Collects data from Stripe users' websites so Stripe can provide its services and comply with financial regulations. Distinct from Stripe's webhook delivery traffic.

Sur.ly · Security scanners

Sur.ly's crawler. The operator runs a spam-fighting link-safety service and uses this bot to fetch third-party sites and build a short security profile for each one, querying metadata and favicons and taking a screenshot of the homepage. The operator states it never harvests e-mail addresses or content unrelated to security.