The Vulny bot
If you saw this address in your server logs, someone asked Vulny to check your site. Here's what our bot does and what it never does.
How it identifies itself
VulnyBot/0.1 (+https://vulny.pro/bot)
What it does
- Opens the page like a regular browser and reads what any visitor receives.
- Looks up public DNS records and blocklists.
- Requests about 30 well-known paths at most, like /.env, to see whether they're public.
What it never does
- Try passwords, send attacks or attempt to enter restricted areas.
- Read or store the contents of a sensitive file it finds.
- Check the same site over and over: there's a limit per domain.
Don't want your site checked?
Enter the domain and we'll add it to the list of sites we never check.