🤖 Overview

SiteGuardBot is a legitimate security crawler operated by SiteGuard Inc., a Japanese cybersecurity firm specializing in web application firewalls and server-side security solutions. First documented in public user-agent lists around 2017, this bot is designed to proactively scan publicly accessible websites for common vulnerabilities, malware infections, and misconfigurations on behalf of SiteGuard’s paid subscribers. The data it collects feeds into SiteGuard’s cloud‑based dashboard, alerting administrators to potential risks such as SQL injection points, cross‑site scripting (XSS) flaws, and outdated software versions. Official documentation from the vendor (siteguard.co.jp) confirms its benign intent, and it is not associated with any threat actors.

🌐 Technical Behavior

SiteGuardBot performs scans using standard HTTP/1.1 and HTTP/2 protocols, issuing GET and POST requests to endpoints such as /wp-admin, /phpmyadmin, and common login pages. According to the official SiteGuard support page (siteguard.co.jp/support/bot.html), the bot maintains a crawl rate of roughly one request every 3–5 seconds during a scan, though this can increase when scanning larger sites. Its originating IP addresses are drawn from a known block of Japanese IPs (e.g., 103.69.192.0/24 and 202.171.33.0/24), as verified by reverse DNS lookups and public IP‑to‑bot mappings. The bot sends an outbound Request‑ID header for per‑request tracking and includes a User-Agent that ends with SiteGuardBot/1.0 or SiteGuardBot/2.0, depending on the version. It does not emulate a browser environment and seldom fetches images or CSS files, focusing only on pages that may contain security‑sensitive input fields or configuration files.

📋 robots.txt Compliance

SiteGuard Inc. explicitly states that SiteGuardBot honors robots.txt directives, a claim corroborated by independent security researchers who have observed the bot ceasing to crawl disallowed paths after a Disallow rule is served. The bot reads the file at the beginning of each scan session and respects both global and user‑agent‑specific rules. However, because its primary purpose is security scanning, site administrators are advised to carefully consider which directories to block—for example, blocking /wp-admin may prevent the bot from detecting compromised admin pages. The official SiteGuard FAQ recommends allowing the bot full access for maximum coverage, but the technical mechanism for compliance is fully functional.

🔍 Detection Indicators

The primary detection fingerprint is the User-Agent string, which appears as Mozilla/5.0 (compatible; SiteGuardBot/1.0; +https://www.siteguard.co.jp/bot.html) on older versions and SiteGuardBot/2.0 on newer implementations. Secondary indicators include the consistent absence of common browser headers (e.g., Accept-Language) and a fixed Connection: close header. Some versions also transmit a custom X-SiteGuard-Client: scan header, documented in the vendor’s API notes. IP geolocation data from MaxMind and IP2Location consistently flags the source IPs as originating from Japan (JP), with ASN assignments to AS2519 (Internet Multifeed Co.), the network provider used by SiteGuard.

📊 Data Usage

Collected data—including vulnerability scan results, detected CMS versions, and misconfiguration reports—is aggregated into SiteGuard’s proprietary analytics platform, which then generates actionable security recommendations for subscribers. No personal identifiable information (PII) is harvested; the bot only observes publicly accessible content. SiteGuard explicitly states in its privacy policy that scan results are not used for any AI training or third‑party marketing, and raw scan data is retained for a maximum of 90 days for dispute resolution purposes.

⚙️ Rate Limiting Policy

Because SiteGuardBot can issue dozens of requests per minute during a full‑site scan—particularly on large WordPress installations—it is often rate‑limited by WAFs and server‑level rules to prevent unnecessary load. The recommended threshold is 10 requests per second per IP, above which a temporary block is warranted; this policy balances the bot’s legitimate security purpose with the need to preserve server resources for human visitors.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.