PentrawlBot

Pentrawl is a free, passive security scanner. A visitor enters a domain, and Pentrawl checks what that domain already shows to anyone on the internet: DNS and email settings, the certificate, security headers, common exposed files and admin paths, WordPress details and the links on the homepage. The visitor then gets a report.

PentrawlBot is the name our scanner uses when it asks your website for those pages. In your logs it looks like this:

Mozilla/5.0 (compatible; PentrawlBot/1.0; +https://pentrawl.com/bot)

• It only reads. Every request is an ordinary read request for a public address. It does not log in, submit forms, guess passwords or try to exploit anything.
• It stays gentle. It sends at most six requests at the same time to one website, never runs two scans of the same domain together, and limits how much of each answer it reads.
• It only connects to public internet addresses. It does not follow redirects to other websites.
• It does not keep your pages. A scan stores the findings, not a copy of your website, and the results are deleted after 30 days.

Some websites and firewalls answer unknown bots with a refusal (HTTP 403). When that happens, the scan retries that request once with a standard browser identifier, so the report can still show what a visitor would see. If your firewall treats us as a bot, you may see those requests as a normal browser.

Email security@pentrawl.com with your domain name and tell us you do not want it scanned. We will stop scans of that domain. You can use the same address to ask for a report about your domain to be removed, or to ask any question about a scan.