UnlimitedUser scanner

English · Deutsche Fassung

Why am I seeing this in my logs?

Requests with the user agent unlimiteduser-pentest/1.0 or unlimiteduser-scanner/1.0 come from the security checks of UnlimitedUser, a website testing service. The link to this page is part of the user agent on purpose, so you can tell who is behind the traffic.

Who can start a scan against my site?

Active security checks (penetration-test baseline, authenticated scan, ZAP baseline) only run against a domain whose owner has proven control of it inside our platform — by publishing a DNS TXT record or a meta tag that we issue per workspace. In addition, all workspaces together may start at most three active scans per target host in 24 hours. The scans are designed to be non-destructive: no denial-of-service, no brute forcing, no data modification beyond harmless canary values.

I did not authorize this — what now?

Write to hello@unlimiteduser.com with the subject “Scanner abuse / opt-out”, the affected domain, and the time and IP of the requests if you have them. We will add the domain (including all subdomains) to our block list so that no active scan can be started against it, and investigate the workspace that started the scan. Our crawler also honours a Disallow rule for the user-agent token unlimiteduser-pentest in your robots.txt.