About this bot
Splunk Attack Analyzer is an automated identity associated with Splunk and used for analyzing suspicious URLs, phishing sites, and malware-related content for Splunk Attack Analyzer.
The primary recorded identity signal is TwinWaveScanner. Representative HTTP identity: TwinWaveScanner.
Directory status: Active. Identity classification: Unverified with Medium confidence. Identity type: observed.
robots.txt is not used as a reliable access-control mechanism for this request class.
Risk classification: Caution. Recommended handling: depends.
How to identify this bot
- User-agent and crawler identifiers
-
TwinWaveScanner - Also known as
- TwinWaveScanner; TwinWave
Details
- Kind
- Threat analysis scanner
- Family
- Splunk
- Purpose
- Phishing and malware analysis
- Common Use
- automated phishing, credential-theft, malware, and suspicious-URL analysis
- Respects robots.txt
- No
Verification
- Identity Type
- Observed
- Evidence Method
- The Splunk Attack Analyzer product and its automated threat-analysis role are current, but the recorded `TwinWaveScanner` request identity lacks sufficient current operator-controlled documentation for Verified status.
- Detection Notes
- The product was formerly TwinWave; retain the observed scanner token conservatively until the exact current outbound request identity is documented.
Website controls
- Robots.txt Snippet
# This identity does not use robots.txt as an access-control mechanism. Use server-side controls if restriction is required.- Apache Rule
SetEnvIfNoCase User-Agent "TwinWaveScanner" bot_match- Nginx Rule
if ($http_user_agent ~* "TwinWaveScanner") { set $bot_match 1; }