What this traffic is
If a request lands on your service carrying the headers below, it's a Canary9 customer's uptime or synthetic check, not a human visitor and not malicious traffic. Someone who administers the target configured Canary9 to check it on a schedule. We don't crawl, scrape, or scan sites we haven't been asked to monitor.
Request headers
Every HTTP check the probe issues carries these three headers:
User-Agent: Canary9-Probe/1.0 (+https://canary9.com/probe)
From: abuse@canary9.com
X-Canary9-Abuse: https://canary9.com/abuse The User-Agent identifies the product and version and links back to this page. The From header gives a mailbox for questions or complaints. X-Canary9-Abuse points directly at our abuse and opt-out page.
Browser checks
Browser checks load your page in a real headless Chrome, so they send the browser's own User-Agent rather than the one above. We append the same identifier to the end of it,
so browser traffic is attributable too:
Mozilla/5.0 (...) HeadlessChrome/... Safari/537.36 Canary9-Probe/1.0 (+https://canary9.com/probe) The browser portion varies with the Chrome version we run; the Canary9-Probe/1.0 marker on the end does not. A rule that matches a User-Agent containing Canary9-Probe therefore catches both our HTTP checks and our
browser checks. See allowlisting Canary9 probes.
Current probe locations
Canary9 checks currently originate from these AWS regions (locations are labeled by their AWS region code in the app):
us-east-2(Ohio)us-west-2(Oregon)eu-central-1(Frankfurt)
We're adding more probe locations over time; this page reflects what's live today rather than the long-term roadmap. Need a location we don't offer yet? Tell us at sales@canary9.com: customer demand drives which regions come next.
If a CDN or bot-management product is blocking or challenging our checks, see Allowlisting Canary9 probes for step-by-step instructions. To report unwanted traffic or ask us to stop monitoring a target, visit Report probe abuse or opt out.