Requests with this User-Agent come from MopokeHQ, a security tool for software agencies. One of its customers added your site as a target, usually because they build or host it.
Every request the scanner makes carries this User-Agent:
MopokeHQ external scan (+https://mopokehq.com/scanner)
The requests come from MopokeHQ's servers in Sydney, Australia. Their source addresses are not fixed yet, so the User-Agent is the reliable way to recognise the traffic. Once the addresses are fixed, they will be listed here.
Every target gets about 14 requests a day, spaced at least a second apart. They look at what any visitor can see: the certificate, which TLS versions are accepted, the security headers on the home page, and whether plain HTTP redirects to HTTPS.
The scanner also sends HEAD requests for a few files that should never be public, such as /.env and /.git/HEAD. It never downloads them. It reads only the response headers, to tell whether the file is there.
Port scans, vulnerability templates and web application scans only run after the customer proves they control the host. They prove it with a DNS TXT record at _mopokehq-verify. followed by your host name, or a file at /.well-known/mopokehq-verify.txt. Nobody can verify a site they do not control.
Active scans keep to the rate limit the customer sets, skip denial-of-service and fuzzing checks, and run in an isolated sandbox that can reach only the target. A full attack scan runs only inside a time window the owner chooses.
Email [email protected] with your host name, and the time and source address of the requests. We will find the organisation that added your site and follow it up with them.
You can also block the User-Agent at your firewall or web server.