Research Scanner
Standard Output's research scanner makes a one-time, read-only measurement of websites when their first TLS certificate is issued.
What this is
We monitor public Certificate Transparency
logs, which record every TLS certificate issued by a public certificate authority. When a
certificate is issued for an Australian hostname, we make a small number of ordinary
GET requests to it, once, and record how the server is configured.
The purpose is to measure how often newly deployed Australian websites are briefly reachable in an unconfigured state — for example, with a content management system installer that has not yet been completed — and how long that state lasts. The results will be published as aggregate statistics.
Our addresses
| IPv4 | 134.199.160.58 |
|---|---|
| IPv6 | 2400:6180:10:200::f181:a000 |
| Reverse DNS | scanner.standardoutput.com.au |
| User-Agent | Mozilla/5.0 (compatible; ct-dayzero/0.1; +https://standardoutput.com.au/research/ct-dayzero; research scan, opt out at that URL) |
What we do and do not do
| We do | We do not |
|---|---|
Send a handful of GET requests per hostname, normally once |
Attempt to log in, guess credentials, or submit any form |
| Record status codes, response headers, sizes and content digests | Store page content, credentials or any secret value |
| Re-check a host only if we found it exposed, to see when it was fixed | Modify, create or delete anything on your server |
Identify ourselves in the User-Agent on every request |
Attempt to evade logging, rate limits or blocks |
| Honour exclusion requests, checked before any request is made | Exploit any weakness we observe, or retain it beyond aggregate counts |
If we found a problem on your site
If our scan recorded something that puts your site at immediate risk — most commonly an unfinished installer that would let a stranger take ownership of the site — we attempt to notify the operator, and otherwise route it via AusCERT. You are welcome to contact us first.
Blocking us
Our requests come only from the addresses listed above and are trivially blockable. Blocking, rate-limiting or returning an error to us is entirely fine and we will not route around it.