About the Aegis scanner

Aegis is a free, passive website security scanner built and run by Viverna, a security consultancy for small businesses in Canada.

Saw Aegis in your server logs?

Someone ran a scan against your site, usually the site's owner or someone they authorized. Public scans require the person running them to confirm they own or are authorized to scan the target, and that confirmation is recorded.

Requests identify themselves with this User-Agent:

AegisScanner/1.0 (+https://aegis.aegissoc.ca/about)

To report misuse or ask for your domain to be excluded, reach out through Viverna's contact form.

What it checks

Security headers such as HSTS, Content-Security-Policy and X-Frame-Options
TLS certificate validity, expiry and protocol versions
Email spoofing protection: SPF, DMARC and MX records
Commonly exposed files like .env, .git/config and backups, using plain read-only requests
Lookalike domains registered against the site's name, checked through DNS
For SaaS and APIs: CORS, GraphQL introspection, exposed API docs, client-side secrets and source maps

What it never does

No exploitation attempts, logins, form submissions or password guessing
No scanning of private, internal or cloud-metadata addresses
No storing of raw page content or any secret it detects, only the name of the pattern that matched
Scans are rate-limited per visitor, and scan reports are never indexed by search engines