securityscanner.org

Seeing this scanner in your logs?

One line: the requests identified themselves, there were at most 25 of them plus some DNS lookups and port checks, and they only happened because the domain's owner asked for it. Opt out below and it stops.

What it is

securityscanner.org is a free monthly outside security check for US business websites, run by one person, Adam Ridley of Human Compute LLC. A site is only scanned after its owner proves they control it: by clicking a confirmation link sent to an address at that domain, or by adding a DNS TXT record or a .well-known file to the domain. There is no unsolicited scanning. Every scan is logged against that proof, with timestamps, and the proof is checked again before every run.

How to recognise it

User-Agent
Mozilla/5.0 (compatible; SecurityScannerBot/1.0; +https://securityscanner.org/about-our-scans; abuse@securityscanner.org) on every HTTP request, exactly this string. The Mozilla/5.0 prefix is there so bot filters treat it like a browser; the name, this address and the abuse mailbox identify it.
Source IP
not yet published The scanner runs from one fixed, named IP address in Amazon Web Services, US East (N. Virginia), with reverse DNS at scanner.securityscanner.org. The address is published here before the first scan of anyone else's domain. Until it appears here, no third-party domain has been scanned. Any request claiming to be this scanner from a different address is not this scanner.
Rate
At most 25 HTTP requests per scan at the confirmed-email level, redirects included, with a 10 second timeout each. The verified-domain crawl makes one request per page, never more than 10 a second and never more than two connections at once. One scan per domain per month, plus one when the owner first signs up and one when the domain is verified.

What it sends

  • Plain GET requests to the home page and a short list of well-known paths that should not be public (for example /.git/HEAD, /.env, /wp-config.php.bak, /backup.zip), plus /robots.txt and /.well-known/security.txt. At most 64 KB of any probe file is read, and the contents are never stored: the scanner notes only whether the path answered with the real thing.
  • TLS handshakes to read the certificate and to test whether TLS 1.0 and 1.1 are still accepted.
  • DNS lookups for A, CNAME, MX, TXT, CAA and DS records, including the SPF, DMARC and a handful of common DKIM selector names.
  • A TCP connection attempt, 2 seconds, to 17 common ports on the site's address, to see which answer. Nothing is sent on the connection and no banners are read. Skipped or noted when the address belongs to a CDN.
  • At the owner-verified level: a crawl of the pages the site links to, with passive rules run on each response. Still GET requests, still nothing submitted.

At both free levels it never sends exploit payloads, injection strings, credentials, form submissions or anything designed to change state on the target. It does not log in, does not enumerate users and does not follow links off the domain. An active scan, which does send attack-like requests, is coming later as a separate opt-in per domain, with the scanner's own warning that it may create, modify or delete data shown before it can be turned on. It is not running for anyone.

Opt out

Any of these stops the scans for a domain:

  • Email abuse@securityscanner.org with the domain. It is paused within one working day and the reply includes the proof the owner gave and the scan log.
  • The owner clicks unsubscribe in any report. That stops the scans as well as the email.
  • Remove the TXT record at _securityscanner.<domain> or the /.well-known/securityscanner file, or set its value to securityscanner-verify=deny. A deny value stops scanning at every level and is checked before every run.
  • Block the User-Agent, or the source IP once it is published above, at your firewall or web server. The scanner does not retry from anywhere else, and a blocked scan is reported to the owner as "the host blocked the scan", not as a security problem.

Hosting providers: if you would rather the scanner never touched any domain on your network, send the IP ranges or ASN to the abuse address and they are excluded.

Report abuse

abuse@securityscanner.org. Include the domain, the time and the User-Agent or source IP from your logs. Every report gets a reply with the authorisation evidence for that domain (the email domain that confirmed, or the verification record, with timestamps), and the domain is paused while it is looked at. The consent record and a minimal scan log are kept for 13 months so a complaint about last month's scan can still be matched. Security issues in the scanner itself: security@securityscanner.org, also listed in /.well-known/security.txt.

For scripts and AI agents

The machine-readable result of every scan follows a published JSON Schema at /spec/v1.json, explained at /spec/.

Who runs it

Adam Ridley, Human Compute LLC, Winston-Salem, North Carolina, United States. About the project.