Skip to content
Noroxi

Noroxi scanner identities

When a Noroxi tool sends a request to a site, it identifies itself in the User-Agent header. The strings below are taken directly from the constants in the scanner code; you can find the traffic in your logs by them, allow it or block it.

Identities and what they do

  • Page reading

    Passive · works without an account

    User-Agent

    Mozilla/5.0 (compatible; NoroxiTools/1.0; +https://noroxi.com/tools)
    • The security headers tool reads the home page response and its HTML (CSP, CORS, SRI and mixed-content checks). For the CORS check the request also carries the header Origin: https://cors-probe.noroxi.com.
    • Technology fingerprinting (attack surface discovery, the domain inventory in an account) reads the home page and checks /.well-known/security.txt.

  • Discovery and verification

    Passive · subdomain probes only in a deep scan

    User-Agent

    NoroxiTools/1.0 (+https://noroxi.com/tools)
    • Subdomain discovery reads subdomain names from the home page HTML.
    • The email security tool reads the policy file /.well-known/mta-sts.txt at mta-sts.<domain>.
    • When the person who added the domain to their account asks for verification, /.well-known/noroxi-verify.txt is read.
    • In a deep scan and in the paid plan's inventory job, a limited number of GET and HEAD requests go to discovered subdomains: subdomain takeover fingerprints and whether the name is still in use.

  • SSL/TLS tool

    Passive · works without an account

    User-Agent

    NoroxiTools/1.0
    • One request goes to the http:// address to check for a redirect to HTTPS; only the response headers are read, no body is downloaded.
    • Certificate and protocol details come from the TLS handshake; the handshake is not an HTTP request, so it carries no User-Agent.

  • WP Lens (WordPress scanner)

    Light for everyone · deep only on paid plans with an authorization confirmation

    User-Agent

    Mozilla/5.0 (compatible; NoroxiWP/1.0; +https://noroxi.com/wordpress)
    • A light scan sends at most 12 read-only GET requests: the home page, REST API namespaces and public files.
    • A deep scan sends at most 52 requests: plugin readme.txt versions and exposed backup or log files. File contents are not stored; no passwords are tried.

  • Port scan

    Active · authorization confirmation on every scan

    User-Agent

    NoroxiPorts/1.0 (+https://noroxi.com/port-scan)
    • Before scanning, one HEAD request with this identity goes to the home page; if the domain is behind a CDN, a WAF or a hosting platform, no scan is run.
    • A full connection is made to 106 common TCP ports, at most 24 at a time. A TCP connection carries no User-Agent.
    • On an open port the greeting banner is read; a port that answers HTTP gets one request with this identity.
    • A deep scan (paid plan and authorization confirmation) sends Redis, Memcached, Elasticsearch, Docker and etcd one unauthenticated, read-only version query. No password guessing, no exploitation, no UDP scanning.

  • Site monitoring

    When a Noroxi member adds the site to monitoring

    User-Agent

    NoroxiMonitor/1.0 (+https://noroxi.com/tools)
    • One HTTPS request; only the response headers are read and redirects are followed a limited number of times. Every 30 minutes on the free plan, 5 on Pro and 5 on Team.
    • The instant check on the site monitoring page uses the same identity.

Requests to data sources (such as crt.sh, Cert Spotter, rdap.org, Cloudflare DNS, hstspreload.org) also carry the NoroxiTools identity; those do not reach your site.

Respect for the target

  • Government domains (gov.tr, .gov, .mil, gov.<country> and similar) are never scanned by any tool, not even with passive checks.
  • Domains behind a CDN, a WAF or a shared hosting platform get no port scan; the visible address belongs to the provider.
  • Active and deep scans require an "I am authorized" confirmation, and the confirmation is recorded. A target gets at most 10 active or deep scans in 24 hours.
  • We do not hide our identity: we never impersonate a browser to get past a WAF that returns 403; the result is reported as "not visible".
  • The address is re-checked at every redirect and at connection time; no requests go to internal network addresses.

IP addresses

We do not publish a fixed list of egress IPs. Recognize Noroxi traffic by the User-Agent strings above.

Block or report

To block the traffic, write a rule for these User-Agent strings in your firewall. If you believe a scan was unauthorized, write to us: include the domain, the date and time (with time zone) and the User-Agent string you saw in your logs.

Contact guvenlik@noroxi.com

Responsible disclosure policy