Scans

How a Gradefort scan identifies itself

A passive grade looks at public DNS, one page request, a TLS handshake, certificate logs, and public exposure data. It does not need proof that you control the domain.

A deep scan is different. It runs only after the domain is verified and the account holder checks both boxes: they are authorized to test it, and they accept the terms. That authorization is logged with the account, the time, and the scope. The scanner does not accept jobs for an unverified domain.

What the deep scan sends

Requests use the user agent GradefortScanner/1.0 (+https://gradefort.com/scanning). The scan fetches a short list of well-known paths with GET or HEAD, and it opens a TCP connection to a short list of ports. It does not log in, submit a form, send an exploit, or change the site. It pauses between requests.

The default scanner is a small process sized for a modest host. It skips modules it does not include and reports those names. A skipped module is not treated as a failure.

Stopping a scan

The owner stops future deep scans by not queueing another one. A scan that is already queued can be left to finish or to expire; the node does not keep a long-lived session on the site. Removing the domain from the account deletes the stored findings.

If you see this user agent on a host you operate and you did not authorize the scan, the request is not from a public crawl of the open web. Do not verify a domain you do not control. This site does not publish a contact address.

Report a scan

If a scan reached a host you operate, send the domain and a short note. Do not include an email address in the note. The form does not ask for one.

Domain What you saw Send the report