Skip to content
STRATIC Sentinel

About the scanner

This page is for people who run a website or a server and have seen StraticSentinel in their logs.

Who it is

StraticSentinel belongs to STRATIC Sentinel, a service that checks a website for common security problems on behalf of its owner. Every request it sends carries this user agent:

Mozilla/5.0 (compatible; StraticSentinel/1.0; +https://stratic-coral.vercel.app/sentinel/scanner)

Its requests come from these addresses: [the scan workers' fixed IP addresses]. A request with this user agent from anywhere else is not ours.

Why it is on your site

Someone with control of the site asked for it. Before any check, the scanner looks for a code unique to their account in one of three places: a DNS record named _stratic-verify, a file at /.well-known/stratic-verify.txt, or a stratic-verify tag in the home page. If the code is not there, nothing else is requested. How ownership is proven.

If you see only requests for that file and the home page, someone has added your address to an account and has not been able to prove it is theirs. Nothing more will happen unless the code appears on your site.

What it does

  • It sends GET, HEAD and OPTIONS requests only, and never a request body. It cannot submit a form, sign in or change anything.
  • It reads the home page and follows links on the same host, up to 40 pages and 3 links deep. It never follows a link or a redirect to another host.
  • It asks for a fixed list of addresses where files and admin pages are often left exposed, such as /.env and /phpinfo.php. Expect 404s for these in your log.
  • It makes one TLS handshake for each protocol version, to see which your server accepts.
  • It sends at most 5 requests a second and 400 in one check, and reads at most 512 KB of any response. A typical check is 100 to 200 requests.
  • It honors robots.txt when following links.
  • It runs once a week for each website, and when the owner asks.

How to stop it

  • Remove the code. Delete the file, the tag or the DNS record. The next check finds no proof and does not run.
  • Tell it not to crawl. It follows rules written for it by name in robots.txt:
    User-agent: StraticSentinel
Disallow: /
  • Block it. Refuse the user agent or the addresses above. The owner is told the check could not finish.
  • Tell us. If the scanner is on a site that did not ask for it, or is causing a problem, write to [abuse email address] with the site's address. We keep a record of who asked for every check and every address it contacted.