Report abuse

If you found PingrBot in your logs

Requests from Pingr identify themselves as PingrBot/1.0 (+https://pingr.com/about). Each one is a single GET made because somebody typed your domain into Website Ping to check whether it was reachable. Pingr does not crawl, does not follow links, does not schedule repeat checks, and sends no cookies or credentials.

If you want your domain or IP range excluded from testing entirely, email us from an address at that domain, or from the abuse contact registered for the IP range, and tell us what to exclude. We will confirm when it is done.

If somebody is using Pingr against you

Tell us and include, if you have them:

the target that was tested (hostname, address or address range)
the approximate times, with a timezone
anything in your own logs that identifies the traffic as coming from Pingr

We will investigate and, where warranted, block the source and add the target to the exclusion list. Note that our logs are deliberately thin — see Privacy — so specific times and targets from your side genuinely help.

Limits that already exist

Some of this is prevented before anybody has to report it:

a limit on how many tests any one target can receive per hour, across all visitors
a tighter limit per target and port
a scanning tripwire: testing several different ports against the same host in quick succession requires verification
no port ranges, no port lists, no bulk targets and no automatic common-port sweeps
private, loopback, link-local, carrier-grade NAT and cloud metadata addresses are refused outright, including via hostnames that resolve to them

Security issues

If you have found a way to make Pingr reach a destination it should refuse, or any other security problem, please write to the same address with “security” in the subject. We would much rather hear from you than find out the other way, and we will not take issue with good-faith testing of our own service.