The Cyphward scanner.

01 · WHO ASKED FOR IT

Only domains their owners verified

Cyphward scans a domain only after its owner proves control of it by adding a DNS TXT record. Scans run when the owner starts one, and once a day at about 06:00 UTC.

Results go only to that verified owner, in their private Cyphward workspace.

· WHAT IT NEVER DOES

Read-only, and gentle

• No login attempts and no password guessing.
• No form submissions and no submitting credentials.
• No denial-of-service, stress or load testing.
• No fuzzing.

The known-vulnerability checks are limited to about 10 requests a second per host, run one at a time, and templates that would log in, submit a form, fuzz or stress a service are excluded from the set.

02 · WHAT IT DOES

What the scanner checks

• Looks up public DNS records for the domain and its subdomains, including SPF and DMARC.
• Lists subdomains from public sources such as certificate transparency logs.
• Requests public web pages: each host's homepage and robots.txt, and for the privacy check up to ten public pages such as /privacy, /cookies and /.well-known/security.txt.
• Checks which of the 100 most common TCP ports accept a connection.
• Reads TLS certificates and connection settings.
• Runs read-only known-vulnerability checks (open-source Nuclei templates), most serious first, rate-limited.

03 · HOW TO RECOGNISE IT

User-Agent

Every web request the scanner makes carries this User-Agent:

Cyphward-Security-Scanner/1.0 (+https://cyphward.com/scanner)

Requests can come from more than one network: Cyphward's scanning servers and the Cyphward service itself. Port and TLS checks are network connections, so they carry no User-Agent.

04 · ALLOWLISTING

Letting the scanner through

Bot protection and web application firewalls sometimes answer the scanner with a challenge or a block page. When that happens, the scan still runs, but the blocked checks are marked not assessed rather than passed. To let the checks run, allowlist the scanner by either of these:

• User-Agent contains Cyphward-Security-Scanner, or the full value above; or
• source IP address 20.164.35.81.

On Cloudflare, add a WAF custom rule or a bot-management skip for that User-Agent or IP. On Vercel, open the project's Firewall, add a rule whose condition matches the User-Agent header (or that IP) and set the action to Allow (bypass the challenge).

05 · CONTACT

Something look wrong?

If the scanner visited a domain you own and you did not verify it with Cyphward, or the scans are causing you trouble, email security@cyphward.com with your domain and the time you saw the requests. We will look into it and can stop scans of a domain while we do.