What Sansec does
The Sansec Security Monitor is a crawler that has checked about 400 thousand online stores daily since 2015 for malicious code, focusing on digital skimming attacks such as Magecart. When it detects malicious code, it alerts the contacts listed in the site's /.well-known/security.txt file, or a known domain address such as info@yourdomain.com if no security contact exists. It identifies itself with the user agent "Mozilla/5.0 (compatible; Sansec Security Monitor/1.0; +https://sansec.io/monitor)", respects robots.txt directives and crawl delays up to a maximum of 30 seconds, and publishes a live IP list. Because it inspects sites from the outside, it cannot see code running on the server and does not replace server-side malware monitoring required by PCI standards.
How to identify Sansec
Temso identifies Sansectraffic by matching the request's User-Agent header against this pattern. User-agent strings can be spoofed, so treat a match as an indication, not proof.
Sansec Security MonitorSansec FAQ
What is Sansec?
Sansec Security Monitor is a crawler that scans online stores daily for malicious code and digital skimming (Magecart-style) attacks, alerting the site's security contacts when it finds an infection. It identifies itself with the user agent "Mozilla/5.0 (compatible; Sansec Security Monitor/1.0; +https://sansec.io/monitor)".
Can I block Sansec with robots.txt?
Yes. Sansec documents that the monitor respects robots.txt, and you can block it by adding a group with "User-agent: Sansec Security Monitor" and "Disallow: /" to your robots.txt file.
About Operational Bots
Monitoring, security scanning, link previews, webhooks, and feed fetchers: the utility traffic that keeps integrations and shared links working.
Most of this traffic is service-critical or user-triggered. Webhooks and previews don't follow robots.txt, and blocking them tends to break things you rely on.
