For the person looking at our traffic
If a request from us reached your server, this page is the fastest way to find out who we are, whether the owner of that target authorized it, and how to make us stop.
Sightrove runs website security, code security and UI quality scans for companies that asked us to. We are not a research project and we are not testing your defenses out of curiosity — every active request we send exists because someone proved they own the target and asked us to check it.
Reach a human at [email protected]. We read that inbox; it does not route to a form.
A person asking us to scan a domain is never enough on its own — no checkbox, plan, or role can authorize a target. The domain has to prove it first, and the proof is checked again before we act on it, not just once at signup.
TXT record naming sightrove-site-verification on the target domain, or serves a token file at /.well-known/sightrove-challenge.txt.Custom headers get dropped by proxies and log pipelines more often than not, so the field you can actually count on is the one almost every server, WAF and CDN logs by default: User-Agent.
User-Agent: Sightrove/1.0 (authorized security scan; +https://sightrove.com/scanning)We identify ourselves in that header rather than blend in with browser traffic — a scanner claiming to be Chrome is a scanner asking you not to look at it, and that is not how we want to be found in your logs.
A second header carries the exact reference for one specific request:
X-Sightrove-Scan: prm_01a00445-532d-7000-b063-83e33f470053That value is the signed authorization record for the scan itself — scoped to one target, already carrying its own expiry — not an account or workspace identifier.
Automated lookup is not available yet. Quote the reference from the X-Sightrove-Scan header in your message to [email protected] and we will confirm within one business day.
A small, stable, published set of addresses — never a rotating or residential proxy pool, because a source that changes under you cannot be allowlisted or tied to your own logs.
Full detail on the scanner IP ranges page.
Email [email protected] with the target host and, if you have it, the X-Sightrove-Scan reference. We engage a stop against that specific target immediately — new requests are blocked before they are ever sent, not on a queue or a schedule. A request already in flight finishes inside the small rate and byte budget it was issued with; it does not keep running past that.
Found a vulnerability in a Sightrove system itself, rather than a scan we sent you? See responsible disclosure instead — a different inbox, a different process.