Our scanner

If you found VulnTicketScanner in your logs, someone who proved they control that site asked us to check it. Here is what it does, where it comes from, and how to reach us.

How to recognise it

Every request carries this User-Agent:

VulnTicketScanner/1.0 (+https://vulnticket.com/scanner; [email protected])

We’ll publish our scanner’s addresses here before its first scan.

Whose sites it scans

Only sites whose owner has proven control, and we check that again before every scan. A file in /.well-known/ proves that exact host and allows the full check. A DNS record proves the name and allows DNS lookups only: nothing is sent to the site itself. Our customers also declare they own the site or are authorised to test it. Every scan is logged: who asked, the target, the proof, the start and end time, and the address we scanned from.

What it tests

• The HTTPS certificate, the redirect from http to https, and HSTS.
• Security headers and cookie flags on the home page.
• A short fixed list of files that shouldn’t be public, such as /.git/HEAD, /.env and database dumps. We keep proof that a file is there, and never the secrets in it.
• Software versions the site states about itself, compared with published CVEs. We don’t try to exploit them.
• SPF, DMARC and CAA records.

Its limits

• GET requests only. It sends no forms, no logins and no payloads, and writes nothing.
• At most 50 requests per scan, at least 500 ms apart, for at most 120 seconds.
• Only that host, on ports 443 and 80. It doesn’t scan ports and doesn’t follow links to other hosts.
• We can stop all scanning at once.

If it reached your site and you didn’t ask

Write to [email protected] with your domain and the time you saw it. We’ll look up who asked and what proof they gave, and write back.