ScanMend Bot

Last updated: 24 October 2026

If you found ScanMend/0.3 (+https://scanmend.com/bot) in your server logs, someone asked ScanMend to check the security of your website, or the site owner subscribed to our monitoring. This page explains exactly what we request and how to stop it.

What it is

ScanMend is a passive, outside-in website security check. It reads what any visitor's browser can see — headers, the home page, a few well-known files — and compares it with public vulnerability data. It is not a crawler: it does not follow links or index pages.

What it never does

No login attempts, password guessing or form submissions.
No exploit payloads, injection tests or vulnerability probing beyond reading public URLs.
No high-volume traffic: a scan is a few dozen ordinary GET requests.

What a scan requests

Every scan: the home page over HTTPS (and the www. variant if needed), the http:// address and its redirects, /.well-known/security.txt, /xmlrpc.php and /wp-json/wp/v2/users, on WordPress sites /readme.html, and the first kilobyte of a jQuery or Bootstrap file the home page loads when its address does not show the library version.
Only when the person scanning confirms they own the site or have permission to test it: a short list of files that should never be public (for example /.env, /.git/HEAD, database dumps and backups, phpinfo pages, config backups, /server-status, /composer.json), and the home page of up to five subdomains listed in public certificate logs, to spot exposed admin panels.
Not sent to your server: DNS records, certificate transparency logs, and public databases (Shodan InternetDB, Google Safe Browsing, OSV, NVD, CISA KEV, WPScan). The optional speed test is run by Google PageSpeed Insights from Google's own servers.

How often

On request: when someone runs a scan at scanmend.com. The same domain can be scanned at most 10 times a day.
Monitoring (only after the subscriber confirms by email): one full scan a week, on Mondays between 05:00 and 21:00 UTC, and an uptime check of the home page every 15 minutes (one GET, a second one a few seconds later only if the first fails; redirects are not followed).

Where it comes from

Requests are sent from Cloudflare Workers, so they come from shared Cloudflare IP addresses rather than a fixed list. Identify us by the User-Agent above.

How to stop it

Email [email protected] from an address at your domain (or tell us how we can confirm you run the site). We add the domain to our do-not-scan list: all scans and monitoring of the domain and its subdomains stop, and anyone who tries to scan it is told the owner opted out. You can also block the User-Agent ScanMend in your firewall — the uptime check then reports your site as unreachable to the subscriber, so emailing us is cleaner.

If our requests caused you a problem, or you think a scan went beyond what is described here, please tell us at the same address.

Lietuviškai

ScanMend – pasyvi svetainių saugumo patikra iš išorės. Ji skaito tik tai, ką mato bet kuri naršyklė (antraštes, pradinį puslapį, kelis žinomus failus), ir lygina su viešomis pažeidžiamumų duomenų bazėmis. Prisijungti nebando, formų nesiunčia, išnaudojimo bandymų nedaro.

Jautrių failų (.env, atsarginių kopijų ir pan.) ir subdomenų patikros vyksta tik tada, kai tikrinantysis patvirtina, kad yra svetainės savininkas arba turi leidimą. Stebėsena (tik el. paštu patvirtinus): pilnas skenas kartą per savaitę pirmadieniais ir pradinio puslapio pasiekiamumo patikra kas 15 min.

Norite, kad jūsų svetainės nebeskenuotume? Parašykite į [email protected] iš savo domeno pašto adreso – įtrauksime domeną ir jo subdomenus į neskenuojamų sąrašą.

Contact

ScanMend · [email protected] · operated by Braižas (braizas.lt), Lithuania.