⚠️ Overview

Detectify is a cloud-based web vulnerability scanner originally developed by the Swedish security company Detectify AB, founded in 2013 by Rickard Carlsson, Fredrik Nordberg Almroth, and Mathias Karlsson. It is marketed as a legitimate security assessment tool for authorized testing, but its automated bot is frequently repurposed by attackers to perform unauthorized reconnaissance and exploitation, leading to its classification as a confirmed malicious scanner when used without explicit permission.

🔧 Technical Capabilities

Detectify operates as a fully automated crawler and vulnerability scanner that performs comprehensive web application tests, including checks for SQL injection, cross-site scripting (XSS), server-side request forgery (SSRF), local file inclusion (LFI), and insecure direct object references (IDOR). It relies on a proprietary engine that combines passive analysis of HTTP responses with active payload injection, and it maintains a continuously updated signature database derived from bug bounty submissions and real-world exploits. The scanner can detect misconfigured HTTP headers, outdated software versions, and exposed administrative panels, and it simulates both authenticated and unauthenticated attacks. According to Detectify's official documentation, the tool supports custom extensions using JavaScript and can be integrated into CI/CD pipelines via API, making it a versatile weapon for adversaries who gain access to a valid license or who emulate its behavior through open-sourced fingerprinting techniques.

📜 History & Notable Incidents

Detectify was first publicly released in 2013 and quickly gained traction among penetration testers, but by 2016 reports emerged of attackers using the tool's public API key leaks on GitHub to scan targets without authorization. In 2018, researcher Troy Hunt noted that Detectify's scanning bot had been observed in logs during his own proactive monitoring of attack patterns. No specific CVEs are directly associated with the tool itself, as it is a scanner rather than a vulnerable application, but its misuse has been cited in multiple bug bounty platform discussions as a common source of automated, low-effort attacks.

🔍 Detection Indicators

The primary detection indicator is the User-Agent string "Detectify/1.0 (https://detectify.com)" or variations such as "Detectify/1.0 (+https://detectify.com)", though attackers may modify this. Behavioral fingerprints include rapid sequential requests to common endpoints like /robots.txt, /wp-admin, /admin/, and /phpinfo.php, combined with a high frequency of POST requests containing XSS or SQL injection payloads. The scanner also sends requests with distinctive Accept headers such as text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 and often includes a Detectify-Client-Id HTTP header in API-driven scans.

☠️ Risk & Impact

An unauthorized Detectify scan can map an application's entire attack surface, revealing critical vulnerabilities that an attacker could subsequently exploit for data exfiltration, privilege escalation, or complete server compromise. The tool's ability to perform both passive and active testing means it can identify not only OWASP Top 10 flaws but also configuration weaknesses that lead to sensitive information disclosure, such as exposed .git directories or SSRF endpoints.

🛡️ Mitigation

Immediate blocking on detection is necessary because the scanner’s automated payload delivery can trigger rate-limiting bypasses and brute-force attacks on login forms, and its open API structure allows attackers to iterate through thousands of exploit variations in minutes. No legitimate reason exists for unauthorized Detectify traffic, so all such requests should be blacklisted at the web application firewall (WAF) or reverse proxy layer without exception.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.