Skip to content
Kovo

KovoScanner

Updated October 6, 2026

KovoScanner is a small, polite crawler run by Dyad Tech, Inc., doing business as Kovo (“Kovo”). It looks at public websites to find which version of a web framework (currently Next.js) they run, to measure how many sites run versions with published security advisories. It only reads what any visitor’s browser would read, and it never tests a site for a vulnerability.

How to recognize it

  • User-Agent: KovoScanner/1 (+https://kovo.sh/scanner)
  • IP address: 34.181.178.19. KovoScanner sends every request from this one address.

What it requests

For each site, in one visit:

  • /robots.txt for each host it contacts;
  • the home page (/), following at most two redirects on the same host or its www. form;
  • at most three JavaScript files that the home page itself references.

That is at most eight requests per site and visit, at least one second apart. It sends only ordinary GET requests with standard headers. It never guesses paths, calls APIs, submits forms, downloads source maps or sends exploit-shaped requests.

How to opt out

  • robots.txt: KovoScanner obeys rules for its product token KovoScanner (and for * when no group names it). To keep it away entirely:

    User-agent: KovoScanner
Disallow: /

  • Email: write to support@kovo.sh with the domain. We add it to the scanner’s exclusion list, which covers the domain and all its subdomains.

A 403 or 429 response to the home page or its robots.txt ends the visit, and KovoScanner then leaves the domain alone for 30 days. A 403 or 429 to a script ends the visit too. It never retries around bot protection or CAPTCHAs.

What it keeps

Only the site’s origin (for example https://example.com), when it was visited, its popularity tier (from public Chrome UX Report data), the HTTP status, why a visit stopped early, the detected framework version or version range with short technical evidence (such as the name of the script it came from), and request counts. It does not keep page content, scripts, screenshots or anything about visitors. Records are deleted after about 13 months.

Questions: support@kovo.sh. Privacy: privacy@kovo.sh.