What is zgrab?

Watch it first. zgrab has not been categorized yet, so there is no track record to lean on. Check which pages it requests and how often, and block it if the traffic is heavy or pointed at content you would not give an unknown bot. Almost none of the top websites we track have robots.txt rules for zgrab right now.

Yes. zgrab is expected to follow robots.txt rules, so a disallow rule is the right first move. Automatic Robots.txt adds and maintains that rule for you, and Agent Analytics confirms zgrab actually follows it.

Unknown. zgrab has no documented scope, so watch what it actually requests. Repeated hits on login or admin paths are the signal to block it.

Nobody knows yet. zgrab is undocumented, so until its operator explains it, its behavior on your site is the only evidence of its intent.

Agent Analytics tracks zgrab visits in real time alongside every other known AI agent, crawler, and scraper. You can also check your server logs for requests whose user agent string contains "zgrab". Log the paths it requests and how often, since nothing about it is documented. Keep in mind that zgrab doesn't publish a verification method, so any client can claim its user agent string and a log match is a hint rather than proof.