Scan traffic: who is requesting, and why

You found conct in your server log and want to know who that was. Here it is — in full, with an address to object to.

What the request was

An automated website check: an address is loaded the way a visitor would load it, rendered in a browser and examined for technical defects — security headers, encryption, cookies set before consent, mandatory legal information, findability, accessibility. The result goes to the operator of the site checked, not to third parties, and it is not published.

The request is passive: it loads what a visit with a browser loads, plus files meant to be fetched by third parties (robots.txt, sitemap.xml, security.txt).

What explicitly does not happen:

• no form input, no injection of strings,
• no login attempts, no password guessing,
• no path enumeration, no fuzzing,
• no load testing, no parallel requests to the same page,
• no exploitation of a weakness found.

That is not a setting somebody could flip: those capabilities are not built into the tool being used.

There is one exception, and it is tied to a signature: where a written commission from the operator explicitly covers it, a number of fixed paths are also requested — paths where files that should not be public typically sit (/.git/config, /.env and the like). Those, too, are plain GET requests, the kind any browser makes.

How to recognise the request

The log will show:

WebAudit/0.1 (+https://conct.de/pruefverkehr/)

An ordinary browser identification precedes it, because the check runs a real Chromium and a site would otherwise be served differently than it is served to a visitor — what your visitors receive is what should be examined, not what a server sends to a tool.

Why your site was requested

There are exactly two possibilities:

1. A commission exists. The operator of the site commissioned the check. The authorisation is on file with domain, client and expiry date; without that entry the tool does not run, and there is no switch to bypass it.
2. Somebody used the free self-check. An address can be entered on the home page. Anyone doing so must first declare that they are responsible for that website or act on behalf of the responsible party. That declaration is recorded together with the time and the connection data.

The second case is the one an administrator rightly doubts: a declaration in a form is not a verification of authority. That is why the self-check is narrow — the home page only, passive only, at most three checks per domain per hour, and only findings that help the operator are returned. Server versions, library versions, reachable paths, secrets in the page source and details from error pages remain tied to a filed authorisation and never appear in the self-check. A stranger therefore learns nothing from it that would help an attack.

If you do not want this

Write to abuse@conct.de and name the domain. It will then be blocked from further requests, regardless of who enters it. You do not need to give a reason.

If you want to know whether and when your domain was checked, ask at the same address.

What is stored

• For the self-check: the address entered, the declaration of commission, the time and the technical connection data. The declaration is kept as long as it is needed as evidence that the request was commissioned. The result is discarded after 30 minutes.
• For a commissioned run: the report, held by the contractor, for the duration of the engagement.
• Details are in the privacy notice.

Who is behind this

The postal address is in the page footer and in full in the imprint. For security reports about conct.de itself there is a security.txt to RFC 9116.