How does drupalxray.com find out the modules present on a thirdparty website? drupalxray.com gives an exhaustive list of the modules present in a third party website. How does it ascertain which are the modules present on a site?

Note : It also identifies the modules which are not enabled. 

Based on How to determine the modules enabled on a third party website? but making it a separate question as others might find it useful.
I enabled access log on my site and then let www.drupalxray.com to review my site.

The entries in the access log looked like below.

HEAD /sites/all/modules/token_custom/LICENSE.txt HTTP/1.1
HEAD /sites/all/modules/active_tags/active_tags.js HTTP/1.1


As you can infer, looks like they have an exhaustive list of static files in all the modules that they can ascertain through their service. 


They are using HEAD requests to save the bandwidth.
If the HEAD requests return 404 response code, the module is not present in the code base if it gets a 200 response code then it can ascertain that the module is present.


However it would be good to know if they have a list of modules with static files or if they have automated that to find the static files all the module on drupal.org.

The suggestion to enable access log was made by Clive.

Note : Currently the services only looks at the sites/all/modules folder only. But I think they can easily tweak a little to make it more generic.