From 15ca9a2afbbd0db5eda1c864ba27b878e5e62121 Mon Sep 17 00:00:00 2001
From: Alwin <alwinytsma@gmail.com>
Date: Fri, 10 Jul 2026 09:19:39 +0200
Subject: [PATCH 1/2] Add signatures for Palo Alto Cortex Xpanse, Infrawatch,
 ModatScanner, krynos

Found these missing while investigating an unexpected spike in new-visitor
tracking on a Laravel site using this package.
---
 src/Fixtures/Crawlers.php          | 4 ++++
 tests/data/user_agent/crawlers.txt | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/src/Fixtures/Crawlers.php b/src/Fixtures/Crawlers.php
index f23f8bc..c1666af 100644
--- a/src/Fixtures/Crawlers.php
+++ b/src/Fixtures/Crawlers.php
@@ -39,6 +39,7 @@ class Crawlers extends AbstractProvider
         '^Goose\/',
         '^Grabber',
         '^Gradle\/',
+        '^Hello from Palo Alto Networks',
         '^HTTPClient\/',
         '^HTTPing',
         '^Java\/',
@@ -628,6 +629,7 @@ class Crawlers extends AbstractProvider
         'infohelfer',
         'InfoTekies',
         'InfoWizards Reciprocal Link',
+        'Infrawatch\/[0-9]',
         'inpwrd\.com',
         'instabid',
         'Instapaper',
@@ -694,6 +696,7 @@ class Crawlers extends AbstractProvider
         'KOCMOHABT',
         'kouio',
         'krawler\.dk',
+        'krynos',
         'kube-probe',
         'kubectl',
         'kulturarw3',
@@ -803,6 +806,7 @@ class Crawlers extends AbstractProvider
         'mixed-content-scan',
         'mixnode',
         'Mnogosearch',
+        'ModatScanner\/[0-9]',
         'mogimogi',
         'Mojeek',
         'Mojolicious \(Perl\)',
diff --git a/tests/data/user_agent/crawlers.txt b/tests/data/user_agent/crawlers.txt
index 56aac8f..806e5c0 100644
--- a/tests/data/user_agent/crawlers.txt
+++ b/tests/data/user_agent/crawlers.txt
@@ -3718,3 +3718,7 @@ undici
 Web Downloader/6.9
 Najdu (Vyhledavac sluzeb (obsah) najdu.s.holubem.eu)
 Najdu (Vyhledavac sluzeb (hlavicka) najdu.s.holubem.eu)
+Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity
+Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)
+Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
+mozilla firefox 5.0/krynos made

From 65957a0bf5aaa2115eb5535fee08ef285874c062 Mon Sep 17 00:00:00 2001
From: Alwin <alwinytsma@gmail.com>
Date: Fri, 10 Jul 2026 09:45:33 +0200
Subject: [PATCH 2/2] Add more scanner signatures found over the following two
 days
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- ExposureScanner, Goosee-Audit — self-identified internal-security-audit scanners
- visionheight.com/scan — domain-prefixed scanner spoofing a Chrome UA
- foda-scanner, pathscan, HaveInListEnricher — additional self-identified scanners
---
 src/Fixtures/Crawlers.php          | 6 ++++++
 tests/data/user_agent/crawlers.txt | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/src/Fixtures/Crawlers.php b/src/Fixtures/Crawlers.php
index c1666af..3666c68 100644
--- a/src/Fixtures/Crawlers.php
+++ b/src/Fixtures/Crawlers.php
@@ -34,9 +34,11 @@ class Crawlers extends AbstractProvider
         '^DHSH',
         '^docker\/[0-9]',
         '^Expanse',
+        '^ExposureScanner',
         '^FDM ',
         '^git\/',
         '^Goose\/',
+        '^Goosee-Audit',
         '^Grabber',
         '^Gradle\/',
         '^Hello from Palo Alto Networks',
@@ -65,6 +67,7 @@ class Crawlers extends AbstractProvider
         '^TLS tester ',
         '^twine\/',
         '^ureq',
+        '^visionheight\.com\/scan',
         '^VSE\/[0-9]',
         '^WordPress\.com',
         '^XRL\/[0-9]',
@@ -436,6 +439,7 @@ class Crawlers extends AbstractProvider
         'fluffy',
         'Flunky',
         'flynxapp',
+        'foda-scanner\/[0-9]',
         'forensiq',
         'ForusP',
         'FoundSeoTool',
@@ -550,6 +554,7 @@ class Crawlers extends AbstractProvider
         'HappyApps-WebCheck',
         'Hardenize',
         'Hatena',
+        'HaveInListEnricher',
         'Havij',
         'HaxerMen',
         'HEADMasterSEO',
@@ -941,6 +946,7 @@ class Crawlers extends AbstractProvider
         'panscient',
         'Papa Foto',
         'parsijoo',
+        'pathscan\/[0-9]',
         'Pavuk',
         'PayPal IPN',
         'pcBrowser',
diff --git a/tests/data/user_agent/crawlers.txt b/tests/data/user_agent/crawlers.txt
index 806e5c0..3fcb275 100644
--- a/tests/data/user_agent/crawlers.txt
+++ b/tests/data/user_agent/crawlers.txt
@@ -3722,3 +3722,9 @@ Hello from Palo Alto Networks, find out more about our scans in https://docs-cor
 Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)
 Mozilla/5.0 (compatible; ModatScanner/1.2; +https://modat.io/)
 mozilla firefox 5.0/krynos made
+Mozilla/5.0 (compatible; pathscan/1.0)
+Mozilla/5.0 (compatible; foda-scanner/0.1)
+ExposureScanner/1.0 (internal-security-audit)
+visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36
+Goosee-Audit/1.0 (+internal-security-audit)
+Mozilla/5.0 (compatible; HaveInListEnricher/1.0)