"Software Security Research/1.0" User Agent: Ruhr University Bochum
Published
Research scans by the Chair for Software Security at Ruhr University Bochum, which measure how the internet's web servers are configured and identify themselves with a link to a page that explains the project and how to be excluded.
What it looks like
Software Security Research/1.0 (+https://goose.softsec.ruhr-uni-bochum.de) Software Security Research/1.0 (+https://finn.softsec.ruhr-uni-bochum.de) Software Security Research/1.0 (+https://winston.softsec.ruhr-uni-bochum.de)
The User-Agent header as an access log records it — in nginx's and Apache's combined format, the last quoted field.
On our own server, the 30 days to 1 November 2026
3,769
requests · about 126 a day
3
source addresses
| Most requested paths | Requests |
|---|---|
| / | 3,496 |
| /en | 44 |
| /en/ | 39 |
| /de/ | 14 |
| /de | 12 |
| /fr/ | 7 |
| /login | 5 |
| /ar | 5 |
LogTriage's production API server (Hetzner, Germany): port 22 open to the internet, key-only since 6 October 2026 (password and keyboard-interactive authentication off); nginx in front of the API on ports 80 and 443. Requests nobody asked for (API traffic and our own monitoring left out); paths as requested, query strings dropped and identifiers redacted; counted weekly from the nginx access log. Linked paths are scanner probes explained on their own pages. More in the monthly attack report, and you can check the addresses in your own log against free blocklists.
Sources on who sends it
The operator's or the researchers' own pages; what this page says about the sender comes from them.
What it is
Software Security Research/1.0 is the user agent of measurement scans by the Chair for Software Security at Ruhr University Bochum. The project’s information page says the researchers run “a variety of different experiments and scans from our network to evaluate and assess the global characteristics of the Internet and its security and privacy posture”. It lists two current measurements: IPv4 liveness scans of selected ranges, limited to ports 80 and 443, and HTTP(S) scans of selected addresses and domains, limited to selected paths. Each header ends with the link of the measurement host that sent it, in the form (+https://<host>).
On our own server, the project sent several thousand requests in the last 30 days from just three addresses (counts above). Nearly all of them were for /. The other paths it requested most were language versions of the home page, such as /en, /de/, /fr/ and /ar, and /login. These are the pages of a website, not secret files, which fits a survey of how servers answer rather than a hunt for something to steal.
Who sends it
University researchers. The page says it is operated by researchers of the Chair for Software Security at the Faculty of Computer Science, that the requests from its network are benign, that they “store collected data for research purposes only” and “only store aggregated and anonymous statistics whenever possible”. It lists the measurement hosts with their addresses (finn, goose and winston under softsec.ruhr-uni-bochum.de) and the IPv4 and IPv6 subnets the measurements come from, and gives [email protected] as the contact for anyone affected, offering to exclude them through the project’s blocklist. Those subnets let you confirm that a request with this header really came from the university: the header itself can be copied by anyone.
Is it a threat?
No. It is academic measurement (MITRE ATT&CK T1595 describes the technique, active scanning, not the intent), announced in the header and documented by the institution. The only cost is volume: thousands of requests a month to one server are noticeable in a small log, and they inflate traffic statistics.
How to handle it
- Check that the requests come from the subnets the project lists; one with this header from anywhere else is not theirs.
- Leave them, or email [email protected] to be excluded, which stops the scans at the source.
- Keep the requests out of your analytics and alerting: they are research traffic, not visitors and not attacks.
- If you would rather refuse them at the web server, match the domain in the header, which covers every measurement host.
Count the requests per measurement host:
grep -o 'https://[a-z-]*\.softsec\.ruhr-uni-bochum\.de' /var/log/nginx/access.log | sort | uniq -cRefuse them in nginx (server block):
if ($http_user_agent ~* "softsec\.ruhr-uni-bochum\.de") {
return 403;
}The web probe reference covers the requests in the same log that are after something.
Other user agents in the same logs
- CensysInspect in Your Access Log: Censys Internet-Wide Scanning Censys's scanner, which connects to every IPv4 address every day to record what each internet-facing service answers, and which identifies itself honestly and publishes the networks it scans from.
- "Hello from Palo Alto Networks" User Agent: Cortex Xpanse Scans Palo Alto Networks' Cortex Xpanse scanner, which continuously scans the internet to map its customers' internet-facing attack surface, names itself in the User-Agent header and links its own scanning page.
Detect it
MITRE ATT&CK: T1595
Frequently Asked Questions
- Who sends the "Software Security Research/1.0" user agent?
- Researchers at the Chair for Software Security of Ruhr University Bochum's Faculty of Computer Science. Their page says they run experiments and scans to evaluate the global characteristics of the internet and its security and privacy posture, and the link in each header points to the measurement host under softsec.ruhr-uni-bochum.de that sent the request, where the project is explained.
- How do I get my server excluded from the Ruhr University Bochum scans?
- Email [email protected] with the details, as their page asks; they say they are happy to provide more information about the research and to exclude you from their experiments through their blocklist. You can also refuse the user agent or the subnets their page lists, but asking takes you off their list at the source.
- Why are there several different hostnames in these user agents?
- The project measures from several hosts, and its page lists finn, goose and winston under softsec.ruhr-uni-bochum.de, each with its address. Every request names the host that sent it in the header, after the same Software Security Research/1.0 prefix, so a rule matching the domain covers all of them.
- Is it normal for a research scanner to send thousands of requests?
- It depends on the experiment. This one sent several thousand requests to our server in 30 days from only three addresses, nearly all of them for the home page and the rest mostly for language versions of it such as /en and /de/, which looks like repeated measurement of how the server answers rather than a search for secret files. If the volume bothers you, ask to be excluded.
See which scanners are hitting your server
Drop an nginx or Apache access log into the free browser analyzer: scanners and probes are grouped by source with the evidence lines, any probe that got a 200 back is flagged, and known user agents and probes link back here. Nothing is uploaded.
Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing