⚠️ Overview

Assetnote is the commercial attack surface management platform operated by the Australian cybersecurity firm Assetnote Pty Ltd, founded by Shubham Shah and Andy Gill. Their automated reconnaissance bot, commonly identified by the User-Agent string "Assetnote", systematically crawls public-facing web assets to map subdomains, endpoints, and technologies for vulnerability discovery. Although the company provides legitimate security services, the bot is frequently blocked by organizations because it aggressively probes without prior authorization, mimicking malicious pre‑attack reconnaissance.

🔧 Technical Capabilities

The Assetnote bot performs deep, recursive crawling of web applications, DNS enumeration, and TLS certificate analysis to discover hidden subdomains, API endpoints, and administrative interfaces. It uses passive and active techniques: querying Certificate Transparency logs (e.g., crt.sh) for domain enumeration, employing dictionary‑based subdomain brute‑forcing with wordlists sourced from real‑world breach data, and fingerprinting server software (e.g., Nginx, Apache, IIS) along with web frameworks (e.g., Laravel, Django). The bot also extracts JavaScript files for client‑side vulnerability assessment and checks for exposed configuration files like .env, robots.txt, and .git/config. According to Assetnote’s own documentation, their scanning infrastructure rotates through thousands of IP addresses (including cloud providers like AWS, GCP, and DigitalOcean) to evade rate‑limiting. It sends HTTP requests with varying headers, including the distinctive User‑Agent: Assetnote and sometimes User‑Agent: Mozilla/5.0 (compatible; Assetnote/1.0). The bot respects robots.txt only when configured to do so, but default scans often ignore it.

📜 History & Notable Incidents

Assetnote first emerged as a security research collective around 2016, gaining notoriety for responsibly disclosing high‑profile vulnerabilities such as the Atlassian Confluence OGNL injection (CVE‑2021‑26084) and the Apache Log4j (CVE‑2021‑44228) scanning campaigns. In 2020, their bot was observed mass‑scanning Fortune 500 companies during beta testing, leading to hundreds of support tickets and temporary IP blocks. While Assetnote claims the bot operates ethically (opt‑out via their website), numerous defenders treat it as malicious due to its unannounced, high‑volume probing. No formal CVEs are assigned to the bot itself, but it has been implicated in discovering attack surfaces that later suffered breaches.

🔍 Detection Indicators

Primary indicators: the User‑Agent string containing "Assetnote" (e.g., Assetnote or Mozilla/5.0 (compatible; Assetnote/1.0)). Behavioral fingerprints include rapid sequential requests to hundreds of subdomain variations (e.g., admin.example.com, dev.example.com) within seconds, combined with TLS‑SNI scans on port 443. The bot often sources IPs from ASNs like Amazon‑02 (AWS), Google Cloud, and DigitalOcean. It also sends requests for path patterns like /wp‑admin, /api/v1, and /.well‑known.

☠️ Risk & Impact

The Assetnote bot can map an entire external attack surface in minutes, revealing undocumented endpoints, third‑party integrations, and sensitive configuration files. If a malicious actor obtains these results, they can leverage them for targeted attacks. The bot itself does not exploit vulnerabilities, but its comprehensive reconnaissance significantly lowers the barrier for subsequent exploitation. Organizations may experience increased server load, log clutter, and resource exhaustion due to the volume of crawl traffic.

🛡️ Mitigation

This bot is blocked immediately because its aggressive, unauthenticated scanning constitutes unauthorized reconnaissance, often violating acceptable use policies and terms of service. Defenders should deny all requests containing the string "Assetnote" in the User‑Agent header and implement IP‑based rate‑limiting on known cloud provider ranges.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.