About SamtaroScan

If you saw SamtaroScan/1.0 in your logs, this page explains what it did and how to stop it.

Last reviewed: 2026-10-18

Automated scan of publicly visible website signals. Not legal advice, not a security audit or penetration test.

User-Agent

SamtaroScan/1.0 (+https://samtaro-security.pages.dev/scanner)

Free mini-scan (anyone who confirms they're authorised)

  • One request to the homepage over HTTPS, one HTTP request to check the redirect, and a request for /robots.txt.
  • Public DNS lookups (SPF, DMARC) through a public resolver.
  • No other paths, no forms submitted, no logins, no exposed-file checks.

Full scan (owner-verified domains only)

  • Runs only after the domain owner proves control with a DNS TXT record (samtaro-verify=<token>), a file at /.well-known/samtaro-verify.txt, or a reply from an admin address at the domain.
  • Up to 10 public pages, at a low request rate (at most about one request per second), in a single pass, respecting robots.txt.
  • A headless browser loads pages without accepting cookies, to see what loads before consent.
  • A short list of common sensitive paths (for example /.git/HEAD, /.env) is checked for existence only, using the HTTP status code. Contents are never downloaded, read or stored.
  • No exploitation, fuzzing, brute-forcing, port scanning or authenticated testing.

What we never do

  • Scan government or state-affiliated domains without verified owner consent.
  • Publish results about any named website or business. Reports go only to the verified requester.

Opt out

  • Add this to your robots.txt: User-agent: SamtaroScan then Disallow: /. Both the free and full scans respect it.
  • Or email scan@samtarogroup.com with the domain. We add it to our block list.

Report a concern: scan@samtarogroup.com.