---
schema_version: "newruntime-reader-dossiers-v1"
type: "reader_dossier"
slug: "zgrab"
kind: "scanner"
operator: "unknown"
researched_at: "2026-10-23"
confidence: "medium"
json_url: "https://newruntime.com/readers/zgrab.json"
canonical_url: "https://newruntime.com/readers/zgrab/"
---

# zgrab

> ZGrab/ZGrab2 is an open-source application-layer scanner from the ZMap project for Internet-wide surveys; its default UA (e.g. 'Mozilla/5.0 zgrab/0.x') is sent by academics, scan indexers and attackers alike.

## Dossier

- Kind: Scanners & probes
- Operator: unknown (https://github.com/zmap/zgrab2)
- Documentation: none found
- robots.txt tokens: none documented
- Feeds: security scan, research
- Respects robots.txt: Not documented. Generic tool; no robots.txt behaviour; the UA identifies the tool, not the operator.
- Verification: No published method
- Labels matched in our logs: zgrab

## Why it matters to New Runtime (our interpretation)

Anonymous reconnaissance noise; exclude from audience counts.

## Observed behaviour

- Baseline 2026-10-23 (93-day window): 638 requests on 86 days; first seen 2026-07-23, last seen 2026-10-23; Regular.
- Live numbers: https://newruntime.com/bot-traffic-history.json and https://newruntime.com/crawler-journeys.json

## Sources

- https://github.com/zmap/zgrab2
- https://docs.centinelanalytica.com/crawlers/zgrab

Identity: A family name is what a client claims in its user agent. It is verified only when its request came from the operator's published IP ranges or passed forward-confirmed reverse DNS, as reported per family in /crawler-journeys.json. Anyone can claim any name.

All dossiers: https://newruntime.com/readers.md