User agents in your access log: who is knocking

Every request carries a User-Agent header, and on an internet-facing server most of the unfamiliar ones belong to scanners: research projects and attack-surface services that map the whole internet, open-source tools such as ZGrab and masscan, botnets that announce themselves (libredtail-http), and plenty of clients that claim to be Googlebot without being it. These pages say who sends each one — from the operator's own documentation where there is one — what it asks for, and whether to block it.

The counts are real: LogTriage's production API server (Hetzner, Germany): port 22 open to the internet, key-only since 6 October 2026 (password and keyboard-interactive authentication off); nginx in front of the API on ports 80 and 443. In the 30 days to 1 November 2026 the user agents below sent 28,400 of the 58,974 requests nobody asked for. The header is chosen by the sender, so it tells you what a client claims to be; for Googlebot, the address tells you whether the claim is true.

User agents explained

• Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)

  The Googlebot user agent copied by a client that is not Google's crawler — on our server nearly every request that claimed to be Googlebot, and mostly after files that hold secrets — which only the request's source address can tell apart from the real thing.

  medium

• Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de)

  Research scans by the Chair for Software Security at Ruhr University Bochum, which measure how the internet's web servers are configured and identify themselves with a link to a page that explains the project and how to be excluded.

  informational

• libredtail-http

  The user agent of the RedTail cryptomining malware's attacks over HTTP, which try known PHP exploits against every server they reach and, where one works, install the RedTail miner.

  high

• WebSiphon/next-0.1

  A user agent with no public documentation behind it which, on our server, went through hundreds of different paths, the most requested of them .env files and a coding assistant's configuration file, the kind of files that hold credentials.

  medium

• l9explore/1.2.2

  LeakIX's open-source scanners, which probe internet-facing servers for exposed files, misconfigurations and vulnerable services and index what they find on the LeakIX search engine.

  medium

• Mozilla/5.0 zgrab/0.x

  The default user agent of ZGrab 2.0, the open-source application-layer scanner from the ZMap project, which anyone can run — research teams mapping the internet and attackers hunting for vulnerable apps alike.

  low

• Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)

  Censys's scanner, which connects to every IPv4 address every day to record what each internet-facing service answers, and which identifies itself honestly and publishes the networks it scans from.

  informational

• Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity

  Palo Alto Networks' Cortex Xpanse scanner, which continuously scans the internet to map its customers' internet-facing attack surface, names itself in the User-Agent header and links its own scanning page.

  informational

Every catalogued user agent, the 30 days to 1 November 2026

Requests and source addresses on our server; the most requested path of each. "Googlebot" counts only requests from outside Google's published crawler ranges.

Access-log coverage: 30 days. Counts refresh weekly. Scanner probes themselves — the paths — are explained in the web probe reference.