SitewardenBot

If you found this page in your access logs, here is exactly what hit your server and why.

Identifying it

SitewardenBot/1.0 (+https://aicour.site/bot)

A customer of ours asked for an audit of your domain. Under our Acceptable Use Policy they confirmed they own it or have permission to audit it. If that is not the case, tell us — see below.

What it requests

• One DNS resolution of the hostname, plus public record lookups.
• One TLS handshake on port 443 to read the certificate.
• A GET for the URL supplied, following at most five redirects, reading at most 2 MB.
• A GET for /robots.txt and /sitemap.xml.

That is three or four requests in total, once, when a person clicks a button. It is not a continuous crawl.

What it never does

• Authenticate, or use credentials of any kind.
• Send anything other than GET requests, or submit a form.
• Probe for vulnerabilities, fuzz parameters or attempt injection.
• Enumerate paths, directories or subdomains.
• Generate load capable of affecting your availability.

Blocking it

The audit reads robots.txt as one of its checks but does not treat it as permission, because a site owner auditing their own site should not have to edit it first. To refuse the bot outright, block on the user agent at your edge:

# nginx
if ($http_user_agent ~* "SitewardenBot") {
    return 403;
}

A 403 is reported to our customer as a finding, so they will know the block is deliberate.

Reporting misuse

Email abuse@aicour.site with the timestamp and hostname from your logs. We keep request records for 90 days, will investigate, and will tell you what we found. Sitewarden suspends accounts used against third parties without permission.