About our scanner
If you saw connections from us in your logs, this page explains them.
What it sends
- Only standard TLS handshakes and one
HEAD /request, to port 443. No logins, no form posts, no vulnerability tests, no other ports. - At most 16 connections per host per scan, at most 20 hosts per domain, and at most 2 at a time to one IP address (6 for large CDNs).
- A full scan, which someone asks for by email when a domain has more hosts, covers up to 100 hosts, more slowly: one connection at a time to each IP address, at most once a day per domain.
- The HTTP request identifies us:
postquantum.report-scanner/1.0 (+https://postquantum.report/scanner). - Results for a domain are cached for 10 minutes, so repeated requests don't reach you again.
- We never connect to private or reserved addresses.
Where it comes from
Scans run from Fly.io's network in Ashburn, Virginia (US East). Fly.io's outgoing addresses aren't fixed, so we don't publish a list; the user agent above identifies our HTTP request.
Opting out
Domain owners can ask us not to scan their domain: add the DNS record described below and submit the form. If you can't add a DNS record, write to [email protected] from an address at that domain and we'll add it within a day.