How the ZNIMOK scanner works

What the free check sends

• DNS lookups, TLS handshakes and queries to public databases such as certificate logs and domain registries.
• HTTPS and HTTP GET requests, and HEAD where useful, only to the domain that was entered and its subdomains.
• Requests for a fixed list of well-known paths, such as /.env, /.git/config or /admin, to see whether they are publicly reachable.
• For a page that is only a thin JavaScript shell or shows a checkpoint page, the page may be loaded in a headless Chromium browser, for a small number of pages per check. This is not a captcha-solving tool.
• No exploits, no brute force, no logins and no form submissions.

What runs only on verified sites

These checks run only on a domain whose ownership has been verified. On such a domain they can be part of any check, and only the verified owner sees their results:

• An active TCP and UDP check of a curated list of service ports.
• The deep audit, which can also send POST requests to the owner’s own API endpoints and forms.
• Open redirect and Host header tests, and reading the mail server version.

How our requests identify themselves

By default, requests to the checked site use a Chrome-compatible desktop header set, the same profile our browser worker uses, so that authorized owner checks are not rejected only for looking like a bare script.

We can also switch the scanner to a transparent identity. It then sends this User-Agent:

Znimok-SecurityDiagnostics/2.1 (+https://znimok.com/security-scanner-info)

Some requests always send this User-Agent, for example our queries to public vulnerability databases.

Load and pacing

• Low concurrency, pacing with random jitter, and backoff when the site answers with HTTP 429 or a firewall challenge.
• No proxy rotation by default. An outbound proxy is used only when we configure one.
• If your site asks the scanner to slow down or blocks it, we respect that and mark that part of the report as partial or inconclusive.

Ownership verification

An owner proves control of a domain in one of three ways: a DNS TXT record znimok-site-verification=… on the domain, the file /.well-known/znimok-ownership.txt containing the token, or a znimok-site-verification meta tag on the home page. The token is shown in the ZNIMOK dashboard.

Opt out, abuse and contact

If you do not want ZNIMOK to check your site, email security@znimok.com from an address at that domain, with the site URL and any scanner IP address you observed. We handle each request by hand and reply.

The same contact is published in our security.txt file.