Scanner identity
If our scanner visited your site, here is who we are.
The scanner belongs to Utlyze's security practice and runs the published checks for isyoursitesafe.com customers. This page says what it does, what it never does, and how to reach a person.
Purpose
We check websites against our published list of 61 checks so their owners get a dated report and, after a fix, proof that it worked. We send our own requests and read our own results. We do not resell scan data, and anything we read from a site is treated as data, never as instructions.
The Safe Profile and its limits
Aggressive checks are off by default.
| Layer | What it does | When it runs |
|---|---|---|
| T0 | Passive: DNS, certificate transparency logs. No packets to your site. | Always on |
| T1 | Single requests: HTTPS fetch, certificate and headers, cookies, robots and sitemap, a light page crawl. | Always on |
| T2 | A small map of common ports, connect only, at a low rate. | Paid reports |
| T3 | Version and CMS fingerprinting. | Only with your per-asset opt-in |
| T4 | Path discovery with many requests. | Complete, only with your per-asset opt-in |
| T5 | Login or exploit proof. | Complete, only with an explicit tick per asset |
- Crawl depth is capped: about 12 pages on the free check, 75 on the Site Report, 250 on Complete.
- No flooding and no denial-of-service style tests, ever. Anything able to overload a service stays disarmed.
- We never take over a subdomain to prove it can be taken; we report the candidate.
- Ask us to stop and we stop within 4 hours.
Rate
The scanner runs at a low, fixed request rate per site, and one scan at a time per site. The exact requests-per-minute ceiling and concurrency are published here, with the source addresses below, before the first public scan.
Proof of control before any paid scan
Before a paid scan runs, the customer proves they control the site: a DNS TXT record we issue, or a token file at a /.well-known path on the site. A checkbox is not enough, because the permission has to come from whoever controls the site.
The free check uses only passive and single-request checks, the kind any browser visit makes, and we ask people to check only sites they run or are allowed to check.
Source IPs
Not yet published
Source IPs: published before the first public scan.
Until this box lists addresses, no public scan has run from our scanner.
Report abuse or ask us to stop
Write to abuse@utlyze.com with the time, your domain or address, and what you saw. A person reads it, we stop scanning the asset you name within 4 hours, and we reply with what ran and why.
Questions about a scan of your own site: scan@utlyze.com. See also the rules of engagement.