Security scanner
sqlmap
Probes looking for vulnerable software, or research projects mapping the internet.
Last updated
At a glance
| Category | Security scanner |
|---|---|
| User agent match | contains "sqlmap" |
| Executes JavaScript | No |
| Respects robots.txt | No |
| Identity verifiable | No, the name is only a claim |
| IVT class | SIVT (sophisticated invalid traffic) |
What sqlmap is
sqlmap probes sites rather than reading them: it checks what software you run and whether known weaknesses are exposed. Some operators are research projects that scan the whole internet and publish findings; others are attackers doing reconnaissance. Either way it is not an audience.
Can the name be trusted?
There is no published way to verify sqlmap: the operator provides no IP ranges and no reverse DNS scheme, so the name in the user agent is only a claim. Any script can send it. TrueVisit still names the traffic, and weighs the claim against behavioral signals instead of trusting it.
Should you block it?
Blocking sqlmap costs nothing and trims log noise, so do it freely. Do not mistake it for protection: scanners that matter do not announce themselves, and the real defense is keeping your software patched. Treat the block as hygiene and the scanner as a reminder to update things.
For enforcement rather than a polite request, the Cloudflare blocking guide generates copy-paste WAF rules from this same signature list, with guardrails that keep verified search engines safe.
How TrueVisit reports it
Visits from sqlmap appear in your bot report under this exact name, never as an anonymous percentage, and every verdict stores the reason it was reached. Because this client never executes JavaScript, a browser-only tracker cannot see it at all; it is visible through server-side collection, which is how the visits reach your report.