Back to knowledge base

Recognising Exposentry scan traffic

Published on October 28, 2026 · Updated on October 30, 2026

Your firewall or hosting provider reports traffic from an unknown address crawling your website. If it comes from one of the addresses below, it is Exposentry, the scan you switched on yourself. This page sets out where that traffic comes from, how it identifies itself and what you can expect from it, so you can pass it on to your IT manager, hosting provider or SOC.

The addresses we scan from

Our HTTP, port and active-test traffic comes from the addresses above. We scan over IPv4 and IPv6. Which of the two a scan module picks for a system that has both differs per module, so put both addresses on your allowlist. If an address is added, it appears here before we use it. Are you unsure about traffic that presents itself as Exposentry? Then email scan@exposentry.io.

One kind of traffic is the exception: when searching for subdomains (scan level 3) we send DNS queries to your domain's name server. Those queries go through our server's DNS resolver. Their source address is none of the addresses above and cannot be put on an allowlist in advance. We do make one zone transfer attempt (AXFR) directly from the addresses above. You therefore recognise DNS queries by the content and pattern of the traffic; the source address is of no use for that.

How the traffic identifies itself

The web scanner (Nikto) and the three Nuclei scans at scan level 3 normally identify themselves with this User-Agent:

Mozilla/5.0 (compatible; Exposentry-OpenKAT; +https://exposentry.io/kennisbank/scanverkeer-exposentry)

The port scan (nmap with version detection) only sends short protocol probes, such as a bare GET / HTTP/1.0, without a User-Agent. Other scan modules that fetch a web page send their own default User-Agent. For that traffic, the source address is the most reliable way to recognise us.

What happens at each scan level

Exposentry uses the scanners of OpenKAT, the open-source security scanner developed within the Dutch government. What happens depends on the scan level of your domain:

• Level 1 does not touch your systems: we read public sources, such as DNS and certificate registries. Suppliers you monitor in NIS2 + Supply Chain stay at this level.
• Level 2 makes contact with your systems: a port scan, retrieving your website and certificates, and identifying software versions. This is the level of the Baseline scan and Ketenpartner.
• Level 3 and higher actively tests for known vulnerabilities and searches for subdomains via your name server. That is thousands to tens of thousands of requests, spread over the scan; the modules that overload systems are not run. The NIS2 plans include this by default; Ketenpartner scans at level 2 by default, and level 3 there is a deliberate choice per domain, with your consent. In both cases, only after the domain has been verified in two ways (a DNS record and a file on the web server).

Exposentry runs OpenKAT's Nuclei scanner with its own filter on the Nuclei templates: templates tagged for uploading files, guessing credentials, fuzzing, overloading or causing damage are not run. The tests are thus aimed at demonstrating vulnerabilities, not at exploiting them. That filter works on the templates' tags and is not an absolute guarantee. OpenKAT scans continuously and at any time; there is no fixed time window. How to verify a domain is explained in the guide verifying your domain.

What you can do

Pass the addresses on to your IT manager, your hosting provider and, if you have one, your SOC. If a firewall blocks the traffic, the scan sees less than an attacker would and the report no longer matches your actual external footprint. Some hosting providers ask to be notified in advance of security tests; if yours does, do that before you enable scan level 3.

Do you want us to stop, or do you see traffic from us that you do not expect? Email scan@exposentry.io. You withdraw scan level 3 yourself via the dashboard. From that moment we schedule no new level-3 tests; a test already running is completed, and the domain is back at scan level 2 within four hours at the latest. Vulnerabilities we already found at level 3 stay in your last report. You can turn level 3 back on later. What is and is not permitted is set out in the Acceptable Use Policy.

Written by Edward Hasekamp, founder of Exposentry and collaborator on the open-source OpenKAT project. See the project on GitHub and the profile at github.com/hasecon. Exposentry provides EU-sovereign, forensically substantiated vulnerability monitoring based on OpenKAT. More articles in the Knowledge base.