About our scanner
If you saw connections from us in your logs, this page explains them.
What it sends
- Only standard TLS handshakes and one
HEAD /request, to port 443. No logins, no form posts, no vulnerability tests, no other ports. - At most 16 connections per host per scan, at most 12 hosts per domain, and at most 2 at a time to one IP address (6 for large CDNs).
- The HTTP request identifies us:
postquantum.report-scanner/1.0 (+https://postquantum.report/scanner). - Results for a domain are cached for 10 minutes, so repeated requests don't reach you again.
- We never connect to private or reserved addresses.
Where it comes from
Scans run from [egress IP addresses: to be published at deploy].
Opting out
Domain owners can ask us not to scan their domain. [Opt-out by DNS record and the contact address: to be added with the opt-out feature.] Until then, write to [contact address: to be set] and we'll add your domain within a day.