{"schema_version":"newruntime-reader-dossiers-v1","type":"reader_dossier","id":"reader:zgrab","slug":"zgrab","name":"zgrab","kind":"scanner","kind_label":"Scanners & probes","operator":{"name":"unknown","url":"https://github.com/zmap/zgrab2"},"docs_url":null,"robots_tokens":[],"purpose":"ZGrab/ZGrab2 is an open-source application-layer scanner from the ZMap project for Internet-wide surveys; its default UA (e.g. 'Mozilla/5.0 zgrab/0.x') is sent by academics, scan indexers and attackers alike.","feeds":["security_scan","research"],"respects_robots":"unknown","robots_note":"Generic tool; no robots.txt behaviour; the UA identifies the tool, not the operator.","verification":{"method":"none_published","url":null},"why_it_matters":{"text":"Anonymous reconnaissance noise; exclude from audience counts.","kind":"new_runtime_interpretation"},"confidence":"medium","researched_at":"2026-10-23","sources":["https://github.com/zmap/zgrab2","https://docs.centinelanalytica.com/crawlers/zgrab"],"icon_url":null,"matching":{"aliases":["zgrab"],"rule":"Reduce each agent_days label to a token: for labels starting with Mozilla/ take the product after 'compatible;', else a versioned crawler token such as 'FooBot/1.0' (a truncated 'Mozilla/5.0 (Linux; Android 7.0;) AppleWebKit/537.36 (KHTML, like Gecko) Mobile' prefix logged before 23 Oct 2026 is PetalBot; anything else is unidentified-android, unidentified-linux-chrome or unidentified-browser); otherwise take the text before the first '/', '(' or ';' and drop a trailing ' token probe'. Lowercase it. A dossier owns the tokens in its aliases."},"observed_baseline":{"as_of":"2026-10-23T08:01:01.990Z","window_first_day":"2026-07-23","window_last_day":"2026-10-23","observed_days":93,"note":"Refreshed daily in production from the live aggregates (dated by as_of). For current numbers aggregate live_sources.history agent_days by matching.aliases.","total_requests":638,"first_seen":"2026-07-23T10:34:07.128Z","last_seen":"2026-10-23T05:34:22.464Z","days_active":86,"recency":"regular","categories":["scanner"],"label_variants":1,"journeys":null},"identity_note":"A family name is what a client claims in its user agent. It is verified only when its request came from the operator's published IP ranges or passed forward-confirmed reverse DNS, as reported per family in /crawler-journeys.json. Anyone can claim any name.","privacy":{"scope":"family-level aggregates only","ip_addresses":"not_output","raw_user_agents":"not_output (labels are sanitized; URLs inside them are redacted)","visitor_ids":"not_output","query_strings":"not_output"},"live_sources":{"history":"https://newruntime.com/bot-traffic-history.json","latest":"https://newruntime.com/bot-traffic-latest.json","machine_consumption":"https://newruntime.com/machine-consumption.json","crawler_journeys":"https://newruntime.com/crawler-journeys.json"},"routes":{"html":"https://newruntime.com/readers/zgrab/","markdown":"https://newruntime.com/readers/zgrab.md","json":"https://newruntime.com/readers/zgrab.json","index":"https://newruntime.com/readers.json","index_html":"https://newruntime.com/readers/"}}