Envoy
Envoy is a high-performance service proxy, common as an edge proxy, API gateway or sidecar in modern microservice deployments. ScanMalware detects it from the server: envoy response header.
Envoy in front of a site confirms a proxied, often cloud-native backend, but it reveals nothing about the application behind it — that is what the rest of the scan examines.
Commonly deployed alongside Envoy
Of the 4,146 public scans where Envoy was detected, these are the technologies most often present on the same site. The share is the percentage of Envoy sites that also ran each one.
| Technology | Category | Share of Envoy sites |
|---|---|---|
| HSTS | wappalyzer | 67.79% |
| Cloudflare | wappalyzer | 24.42% |
| HTTP/3 | wappalyzer | 23.05% |
| Cloudflare Bot Management | wappalyzer | 22.85% |
| Open-Graph-Protocol | miscellaneous | 17.45% |
| PoweredBy | miscellaneous | 17.31% |
| X-UA-Compatible | miscellaneous | 15.41% |
| Google Tag Manager | wappalyzer | 14.8% |
| MetaGenerator | miscellaneous | 14.15% |
| Google Analytics | wappalyzer | 12.56% |
| Amazon Web Services | wappalyzer | 11.45% |
| OpenSearch | miscellaneous | 10.92% |
| jQuery | wappalyzer | 9.86% |
| Google Cloud | wappalyzer | 9.86% |
How ScanMalware detects Envoy
Envoy is detected by analysing the response headers, HTML markup, JavaScript runtime and asset URLs captured when ScanMalware loads the site in a real headless browser.
From any scan you can pivot into related signals — JARM TLS fingerprints, ASN ownership and BGP routing, certificate history, JavaScript analysis and the overall security verdict — to understand not just that Envoy is present, but how it is being used. Open the full search interface for Envoy →
Recent public scans featuring Envoy
A rolling sample of recent public scans where Envoy was detected. Listing a site here is not a safety judgement — open a scan to see its full verdict.
| Site | Scanned |
|---|---|
| Home - BYU https://www.byu.edu | 2026-08-04 |
| Uppsägning av anställd - så gör du, steg för steg | Framfot https://r.nl.framfot.se/mk/cl/f/sh/WCPzyXJTZ6vLwu5jNuRR5DMETw6Za5qs/cJM71O8TKmEV | 2026-08-04 |
| Home - NL - OliNo Services https://olino.org | 2026-08-04 |
| USA: Falsche Bestände kosten 400 Mrd. Dollar Umsatz | etailment https://r.brevo.etailment.de/mk/cl/f/sh/7nVU1aA2nfuTHPyoyOjeaAYmYwCW7fi/5dI6spp2N3bz | 2026-08-04 |
| https://discord-social-server.mpsdk.easebar.com | 2026-08-04 |
| Login | Account https://pigment.app | 2026-08-03 |
| Home - LDS Living https://ldsliving.com | 2026-08-03 |
| Trang không tìm thấy https://api.wescan.vn | 2026-08-03 |
Frequently asked questions about Envoy
- Does using Envoy mean a website is unsafe?
- No. Envoy is a stack component, not a verdict. ScanMalware scores the whole page — its scripts, redirects, certificates, threat-intelligence matches and behaviour — so a site using Envoy can be perfectly safe or actively malicious.
- How many sites using Envoy has ScanMalware scanned?
- Envoy has been detected in 4,146 public scans on ScanMalware.com. Each scan is a real headless-browser visit, and the figure updates as new URLs are submitted.
- What technologies are commonly used with Envoy?
- Across scanned sites, Envoy is most often seen alongside HSTS, Cloudflare and HTTP/3. The full co-occurrence breakdown is listed on this page.
Browse all profiled technologies on the technology index, or scan a URL to see its full stack.