IAM-Research-Bot

This host operates a research crawler that identifies which publicly deployed identity & access-management (IAM) technologies a website uses — Keycloak, Auth0, Azure AD, Cognito, ForgeRock, and similar. It requests each site over HTTP GET only.

Its requests identify themselves with this User-Agent:

Mozilla/5.0 (compatible; IAM-Research-Bot/1.0; +https://iam-research.fgribreau.com; rust@fgribreau.com)

Source IP: 212.47.231.124 (forward-confirmed reverse DNS: iam-research.fgribreau.com).

What it does — and does not do

• GET requests only. It never submits forms and never sends, guesses, or brute-forces credentials, tokens, or passwords.
• It reads a small number of pages per site (≤ 10) to detect login/OIDC endpoints, then moves on. No exploitation, no fuzzing, no vulnerability probing.
• It is rate-limited per domain (roughly one request per second), honors Crawl-delay, and backs off on 429/Retry-After.
• It obeys robots.txt.

How to block it

Add this to your site's robots.txt — the crawler reads and respects it:

User-agent: IAM-Research-Bot
Disallow: /

Or block the source IP 212.47.231.124 at your firewall/WAF.

Contact

To request an immediate and permanent exclusion, or for any question or complaint, email rust@fgribreau.com. Exclusion requests are honored promptly.