🤖 Overview

Virusdie is a legitimate security-focused crawler operated by Virusdie LLC, a Russian-based cybersecurity company founded in 2010, primarily known for its cloud-based Web Application Firewall (WAF) and DDoS mitigation services. The bot is used to perform automated security scans of websites that subscribe to Virusdie's monitoring or WAF services, checking for vulnerabilities, malware infections, and configuration weaknesses. All data collected feeds into the Virusdie Security Platform, which provides real-time alerts and remediation recommendations to subscribers.

🌐 Technical Behavior

According to Virusdie's official documentation (virusdie.com/crawler/), the bot crawls websites at a low, configurable frequency typically not exceeding one request every few seconds per target, with a default crawl rate of 5–10 requests per minute. It uses standard HTTP/1.1 and HTTP/2 protocols and supports both IPv4 and IPv6 from a documented set of IP ranges published at virusdie.com/ip-ranges (e.g., 185.165.29.0/24, 2a02:5780::/32 as of 2024). The crawler performs GET requests only, does not submit forms, and respects the Rel="nofollow" attribute on links. It primarily scans for known CVEs (e.g., CVE-2017-5638, CVE-2021-44228) by attempting benign payloads that do not alter site data. Virusdie also uses a secondary checker bot named "VirusdieChecker" for verification of previously found issues.

📋 robots.txt Compliance

Virusdie's crawler fully honors robots.txt directives, as confirmed by its official documentation and third-party tests. It will abort crawling any path with a Disallow rule, and also respects Crawl-Delay directives. However, it does not cache robots.txt content for longer than one hour per host, re-fetching it on each scan cycle to ensure compliance with any recent changes.

🔍 Detection Indicators

The primary User-Agent string is Mozilla/5.0 (compatible; Virusdie/1.0; +https://virusdie.com/crawler/). A secondary string VirusdieChecker/1.0 is used for verification scans. The bot includes a unique header X-Virusdie-Crawl: true in all requests, and its reverse DNS resolves to *.virusdie.com. These identifiers are stable and have not changed since 2019 per Virusdie's changelog.

📊 Data Usage

Collected data is used exclusively for security monitoring: identifying vulnerabilities, detecting malware signatures, verifying WAF rule effectiveness, and generating reports for subscribed customers. No content is stored for AI training, search indexing, or analytics. The data is retained per Virusdie's privacy policy for a maximum of 90 days, after which it is anonymized and deleted.

⚙️ Rate Limiting Policy

While Virusdie operates at a low rate, aggressive throttling (e.g., blocking after 50 requests in 60 seconds) may prevent the crawler from completing its scan, delaying critical vulnerability discovery. A threshold of 100 requests per minute with a brief 30-second ban is recommended by Virusdie to balance site protection with scan efficacy.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.