"Mozilla/5.0 zgrab/0.x" in Your Access Log: The ZGrab Scanner
Published
The default user agent of ZGrab 2.0, the open-source application-layer scanner from the ZMap project, which anyone can run — research teams mapping the internet and attackers hunting for vulnerable apps alike.
What it looks like
Mozilla/5.0 zgrab/0.x
The User-Agent header as an access log records it — in nginx's and Apache's combined format, the last quoted field.
On our own server, the 30 days to 1 November 2026
476
requests · about 16 a day
335
source addresses
| Most requested paths | Requests |
|---|---|
| / | 212 |
| /developmentserver/metadatauploader | 62 |
| /actuator/health | 23 |
| /autodiscover/autodiscover.json | 17 |
| /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application | 16 |
| /owa/auth/logon.aspx | 15 |
| /owa/auth/x.js | 12 |
| /version | 11 |
LogTriage's production API server (Hetzner, Germany): port 22 open to the internet, key-only since 6 October 2026 (password and keyboard-interactive authentication off); nginx in front of the API on ports 80 and 443. Requests nobody asked for (API traffic and our own monitoring left out); paths as requested, query strings dropped and identifiers redacted; counted weekly from the nginx access log. Linked paths are scanner probes explained on their own pages. More in the monthly attack report, and you can check the addresses in your own log against free blocklists.
Sources on who sends it
The operator's or the researchers' own pages; what this page says about the sender comes from them.
What it is
Mozilla/5.0 zgrab/0.x is the default user agent of ZGrab 2.0, an open-source scanner from the ZMap project. Its README describes it as “a fast, modular application-layer network scanner designed for completing large Internet-wide surveys”: ZMap finds the hosts that answer on a port, and ZGrab performs the full application-layer handshake — HTTP, TLS, SSH, SMTP, databases and some thirty protocols in all. The string is the default of the HTTP module’s user-agent flag in ZGrab’s source, so a request that carries it was sent by someone who did not bother to change it.
On our own server, zgrab requests came from over three hundred addresses in the last 30 days, a request or two each (counts above). Most asked for /. The rest were targeted: SAP’s /developmentserver/metadatauploader, Spring Boot’s /actuator/health and Outlook Web App’s /owa/auth/logon.aspx.
Who sends it
Anyone who runs ZGrab. Internet scanning companies and research projects use it for surveys, and people searching for vulnerable servers use it for the same reason: it is fast and free. The header names the tool, never the operator, and the spread over hundreds of addresses on our server points to many separate scans rather than one.
Is it a threat?
It depends on the path. A zgrab request for / is a survey reading what your server answers. A zgrab request for an SAP NetWeaver upload endpoint or a Spring Boot actuator is someone checking for a specific vulnerable application (MITRE ATT&CK T1595.002, vulnerability scanning). Neither is an attack in itself; a 200 response to the targeted ones would tell the scanner it found something.
How to handle it
- Read zgrab lines by their paths: home-page requests are noise, targeted paths show what scanners hope you run.
- Check the status codes of the targeted requests; anything other than 404 or 403 means the endpoint exists and needs patching or restricting.
- Refuse the default user agent if you want less noise, knowing that a determined scanner changes it.
List what zgrab asked for and how your server answered:
grep 'zgrab/' /var/log/nginx/access.log | awk '{print $9, $7}' | sort | uniq -c | sort -rn | head -20Refuse the default header (server block):
if ($http_user_agent ~* "zgrab/") {
return 403;
}The free log analyzer groups scanners by source in an access log and flags any probe that got a 200 back.
Probes it sends
- GET /developmentserver/metadatauploader: SAP NetWeaver Upload Probes An automated check for the SAP NetWeaver Visual Composer Metadata Uploader endpoint, the unauthenticated upload point behind CVE-2025-31324.
- GET /actuator Requests in Your Logs: Spring Boot Actuator Probing An automated scan for Spring Boot Actuator management endpoints, which expose configuration, environment properties and full JVM heap dumps whenever they are reachable without authentication.
Other user agents in the same logs
- CensysInspect in Your Access Log: Censys Internet-Wide Scanning Censys's scanner, which connects to every IPv4 address every day to record what each internet-facing service answers, and which identifies itself honestly and publishes the networks it scans from.
- l9explore and l9scan in Your Access Log: LeakIX Scanning for Leaks LeakIX's open-source scanners, which probe internet-facing servers for exposed files, misconfigurations and vulnerable services and index what they find on the LeakIX search engine.
Detect it
MITRE ATT&CK: T1595.002
Frequently Asked Questions
- What is zgrab?
- ZGrab 2.0 is an open-source application-layer scanner from the ZMap project. Its README calls it a fast, modular application-layer network scanner designed for completing large Internet-wide surveys; it speaks HTTP, TLS, SSH, SMTP, databases and many other protocols, and is usually paired with ZMap, which finds the hosts that answer on a port.
- Why does the user agent say zgrab/0.x?
- Mozilla/5.0 zgrab/0.x is the default value of the HTTP module's user-agent flag in ZGrab 2.0's source code. Whoever runs the scan can set a different header, so this exact string means someone ran ZGrab without changing it; the 0.x is a fixed part of the default, not a version number.
- Who is behind zgrab requests?
- Anyone. Because ZGrab is free software, the header says which tool sent the request but not who ran it. Research projects and internet scanning companies use ZGrab, and so do people looking for vulnerable servers. On our server the same header came from over three hundred addresses in 30 days, one or two requests each.
- Should I block zgrab?
- Blocking the default user agent is harmless, since no browser sends it, and it removes a slice of scanning noise. It is not protection: a scanner that wants in changes the header in one flag. Judge zgrab requests by the paths they ask for, and fix what answers, such as SAP or Spring Boot endpoints that should not be public.
See which scanners are hitting your server
Drop an nginx or Apache access log into the free browser analyzer: scanners and probes are grouped by source with the evidence lines, any probe that got a 200 back is flagged, and known user agents and probes link back here. Nothing is uploaded.
Investigating something right now? LogTriage checks every address in the file against threat intelligence and writes the incident report: 10 analyses a month free. The incident pack adds the in-depth AI analysis and files up to 100 MB: 25 analyses for $19, one payment, no subscription. Pricing