DjojiBot is the scanner behind Djoji Ghost Scan. It contacts a domain when someone scans it on djoji.com, and during occasional research runs.
Web requests send this User-Agent:
Mozilla/5.0 (compatible; DjojiBot/1.0; +https://djoji.com/bot)
A scan also looks your domain up in third-party sources: Certificate Transparency logs, WHOIS, and breach and exposure databases. Those requests go to those services, not to your server.
Scans someone runs on djoji.com read /robots.txt to see which paths it lists; it does not stop the scan. Research runs do respect it (see below).
When the account running the scan has proven it controls the domain with a DNS TXT record, the scan also checks which common ports accept a connection, sends an HTTP OPTIONS request, and tries a DNS zone transfer. These checks are rate-limited per domain and use this User-Agent:
DjojiBot/1.0 (authorized security assessment; contact: security@djoji.com; https://djoji.com)
From time to time we run the DNS, TLS, homepage and robots.txt checks above across a list of domains, one domain at a time with a pause between each. Research runs skip the third-party lookups and the verified-owner checks. They also respect robots.txt: we fetch it first, and if it disallows / for DjojiBot (or for all bots), we skip your homepage and only run the DNS and TLS checks. We publish aggregate counts only, never named domains.
Email hello@djoji.com with the domain. Opted-out domains are excluded from research runs. This does not block a scan that someone runs on djoji.com.
Found a security issue in Djoji itself? See our security policy.