01 · Operator
Who operates Researchscan
- Company
- RWTH Aachen University (COMSYS)
- Type
- Monitoring bot
- Official docs
- researchscan.comsys.rwth-aachen.de
02 · Behavior
What Researchscan does
It sends a few packets per day to every public IP address on common ports. Responsive hosts receive standard protocol handshakes, using the zgrab scanner. The project says it never exploits flaws, guesses passwords or changes device settings.
03 · Impact
Why Researchscan matters for your site
If you allow it
- Supports academic research on Internet security
- Very low request volume per host
- Never attempts exploits or logins
If you block it
- Brings no visitors or visibility
- Probes ports and services beyond normal web crawling
04 · Allow
How to allow Researchscan
robots.txt
User-agent: Researchscan
Allow: /Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "Researchscan")
Action: Skip › All Super Bot Fight Mode rules
# Also check Security › Bots: "Block AI bots" can block it regardless of robots.txt.WordPress
# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: Researchscan
Allow: /nginx
# nginx serves every user agent by default.
# Make sure no rule like this blocks it:
# if ($http_user_agent ~* "Researchscan") { return 403; }Apache
# Apache serves every user agent by default.
# Make sure .htaccess has no rule like this:
# RewriteCond %{HTTP_USER_AGENT} Researchscan [NC]
# RewriteRule .* - [F,L]05 · Block
How to block Researchscan
Start with robots.txt. If Researchscan keeps showing up in your logs, block it at your CDN or web server.
robots.txt
User-agent: Researchscan
Disallow: /Cloudflare
# Security › WAF › Custom rules › Create rule
Expression: (http.user_agent contains "Researchscan")
Action: BlockWordPress
# WordPress serves a virtual robots.txt. Edit it with your SEO plugin:
# Yoast: SEO › Tools › File editor · Rank Math: General Settings › Edit robots.txt
User-agent: Researchscan
Disallow: /nginx
# In your server { } block:
if ($http_user_agent ~* "Researchscan") {
return 403;
}Apache
# .htaccess
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} Researchscan [NC]
RewriteRule .* - [F,L]
</IfModule>06 · User agents
User agents we see for Researchscan
The user agent published by the operator:
Mozilla/5.0 zgrab/0.x (compatible; Researchscan/t12sns; +http://researchscan.comsys.rwth-aachen.de)07 · Verification
Is it really Researchscan?
Anyone can copy a user agent. Real Researchscan requests come from the IP ranges published at researchscan.comsys.rwth-aachen.de.
FAQ
Questions about Researchscan
What is Researchscan in my logs?
It is an Internet-wide measurement scan by RWTH Aachen University. It records how protocols and security features are deployed.
Is Researchscan an attack?
No. The project states it never exploits security problems, guesses passwords or changes device configuration.
How do I opt out of Researchscan?
Email researchscan@comsys.rwth-aachen.de with your IPs or CIDR blocks. You can also drop traffic from 137.226.113.0/26 and 2a00:8a60:1014:88::/64.
Last reviewed Oct 8, 2026