Tracedown

Agent traffic

What is “tracedown-agent” in my logs?

Tracedown is an API monitoring service. If you see the “tracedown-agent” User-Agent in your logs, it is likely that someone has configured Tracedown to make scheduled HTTP calls to a service you operate.

Identifying it

Agents we operate are configured to send:

tracedown-agent/<version> (+https://tracedown.io/agent)

Please note that it is not a definitive indicator, and someone else might have set their requests to use the same string.

What a check may do before a domain is verified

We ask whoever set up a check to prove they control the domain it targets, with a DNS record or a file we name. Until that is done, a check run through our infrastructure against a domain nobody has verified is held to fixed limits:

  • it is dispatched at most once every 5 minutes, whatever its schedule says;
  • it may make at most 3 requests per run;
  • no response body from it is kept;
  • a script that searches inside your responses for arbitrary text is not dispatched.

A check may still assert on the content of a response.

Stop the traffic with a DNS record

Publish the following DNS TXT record on your domain, with any value, and requests to that domain will no longer be dispatched:

_tracedown-noprobe.example.com. TXT "1"

The record takes effect within an hour.

This stops probes from Tracedown Cloud and from any self-hosted installation left on the default setting.

Reporting abuse

If you believe a probe is being used to attack, scrape or otherwise abuse a service you operate, write to abuse@tracedown.app.

Please include enough for us to find it:

  • the log lines themselves — timestamps, the URLs requested, the source address and the User-Agent as your server recorded them;
  • the domain or host being hit;
  • confirmation that it is yours. We will ask you to demonstrate control of the domain before acting.

What we can do depends on where the traffic originated. If the check was scheduled through Tracedown Cloud — on our agents or on a customer's own runner — we can trace a request back to the account behind it and stop the schedule. We have no control over self-hosted installations.