RepoLookoutBot: What It Is & How to Block It

01 · Operator

Who operates RepoLookoutBot

Company: Crissy Field GmbH
Type: Monitoring bot
Official docs: repo-lookout.org

02 · Behavior

What RepoLookoutBot does

It checks sites for exposed .git folders and related Git files. Target URLs come from Common Crawl, the Tranco list, Chrome UX Report and Certificate Transparency data. Findings are reported to the domain's technical contacts. The project says it is no longer actively maintained.

03 · Impact

Why RepoLookoutBot matters for your site

If you allow it

Can warn you about a leaked .git folder
Requests are throttled and small

If you block it

Probes for sensitive files
Project is no longer actively maintained

04 · Allow

How to allow RepoLookoutBot

robots.txt

User-agent: RepoLookoutBot
Allow: /

Cloudflare

# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "RepoLookoutBot")
Action:     Skip › All Super Bot Fight Mode rules

# Also check Security › Bots: "Block AI bots" can block it regardless of robots.txt.

WordPress

# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: RepoLookoutBot
Allow: /

nginx

# nginx serves every user agent by default.
# Make sure no rule like this blocks it:
# if ($http_user_agent ~* "RepoLookoutBot") { return 403; }

Apache

# Apache serves every user agent by default.
# Make sure .htaccess has no rule like this:
# RewriteCond %{HTTP_USER_AGENT} RepoLookoutBot [NC]
# RewriteRule .* - [F,L]

05 · Block

How to block RepoLookoutBot

Start with robots.txt. If RepoLookoutBot keeps showing up in your logs, block it at your CDN or web server.

robots.txt

User-agent: RepoLookoutBot
Disallow: /

Cloudflare

# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "RepoLookoutBot")
Action:     Block

WordPress

# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: RepoLookoutBot
Disallow: /

nginx

# In your server { } block:
if ($http_user_agent ~* "RepoLookoutBot") {
    return 403;
}

Apache

# .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} RepoLookoutBot [NC]
RewriteRule .* - [F,L]
</IfModule>

06 · User agents

User agents we see for RepoLookoutBot

The user agent published by the operator:

RepoLookoutBot/1.0.0 (abuse reports to abuse@repo-lookout.org)

07 · Verification

Is it really RepoLookoutBot?

RepoLookoutBot’s operator publishes no IP ranges or hostnames, so requests cannot be verified. Treat the user agent as a claim, and watch your logs for unusual request rates.

FAQ

Questions about RepoLookoutBot

Why is RepoLookoutBot requesting /.git/ on my site?

It checks whether your Git repository is publicly exposed so it can notify you.

How do I opt out of Repo Lookout?

Email opt-out@repo-lookout.org with your domain, IP range or ASN, or deny the RepoLookoutBot user agent.

Is Repo Lookout still active?

Its website states that Repo Lookout is no longer actively maintained.

RepoLookoutBot is Crissy Field GmbH’s monitoring bot