About Vulnebify

Vulnebify helps organizations turn Internet exposure into actionable threat intelligence before attackers do.

We provide safe, low-noise tools and APIs to continuously observe domains, IPs, and infrastructure, revealing exposed services, misconfigurations, and risky assets exactly as they appear on the public Internet.

Built for threat intelligence teams, red teams, blue teams, and security-focused developers.

Why it matters

The data collected by Vulnebify is used by security teams, CERTs, and authorized security researchers to identify exposures early and reduce risk. It supports proactive defense by enabling faster response times, increased visibility, and continuous assessment of Internet-facing assets.

Filtering Vulnebify traffic may reduce the effectiveness of these early-warning efforts and limit notification of emerging risks.

What we check

Vulnebify performs low-impact, non-intrusive checks of publicly reachable IP addresses and domain names. Our checks are strictly limited to metadata collection and do not attempt to authenticate, exploit, or access private systems.

Data we collect includes:

Open service availability
HTTP response metadata (status, headers, page titles)
TLS certificate chains and fingerprinting
Basic service banners and protocol-level data

We follow ethical checking principles as outlined in our Terms and Conditions.

Filtering Vulnebify traffic

We ensure our infrastructure is easily identifiable through both DNS and HTTP headers.

If you prefer not to receive traffic from Vulnebify infrastructure, you can block or filter our requests in any of the following ways:

DNS-based filtering: block IPs that have both forward and reverse DNS records matching *.scanning.vulnebify.net. This includes:
- A record: the hostname resolves to the IP
- PTR record: the IP resolves back to the hostname
User-Agent filtering: deny HTTP requests with the following User-Agent string:
Mozilla/5.0 (compatible; VulnebifyResearch/1.0; +https://about.vulnebify.net/)
Opt-out: email [email protected] with your domain, IP range or CIDR block to request exclusion

Opt-out requests are reviewed and verified for ownership before being processed. We aim to respond within 7 business days.

Contact

For questions, concerns, or abuse reports, please reach out:

Email: [email protected]

<- Home