Acceptable Use and Scan Authorization

Before you look up a domain here, you must be able to say one of two things truthfully: you own the domain, or you hold written permission from its owner to assess it. That covers a penetration test under contract, a bug bounty program whose scope includes the domain, your own employer's infrastructure, or a domain you registered yourself.

Curiosity about someone else's infrastructure is not authorization. Neither is a domain being large, well known, or operated by a company you dislike.

The checkbox on the search form is where you make that statement. It is ticked by default because the overwhelming majority of our users are working on their own estate. Untick it and the search will not run.

We never touch the target. Everything you see is assembled from sources that are already public: certificate transparency logs, passive DNS datasets, and published network registry data. We send no traffic to the domain you enter.

That is a real distinction, and it is why this tool is safe to point at your own estate. It is not, however, a defence for pointing it at someone else's. Assembling a map of another organisation's attack surface does not become acceptable because each individual record was already published. The output is reconnaissance either way, and in several jurisdictions preparatory reconnaissance against a system you have no right to access is itself an offence.

Treat the passive nature of the data as a courtesy to the target, not as permission for yourself.

We record your IP address alongside every domain you look up. We are telling you plainly rather than burying it, because this is the record we would rely on if the service were misused.

Specifically, for each combination of IP address and domain we store:

• -the IP address the request came from
• -the domain that was looked up
• -how many times, and how many of those triggered a fresh scan
• -when it was first and most recently seen
• -the country the request appeared to come from

We keep one row per IP and domain pair with counters, not one row per request, so repeated lookups update a count rather than growing the log. Rows are deleted after 90 days.

We do not sell this data, and we do not use it for advertising or profiling. It exists to answer one question: who is hammering the service, and with what.

In most jurisdictions an IP address counts as personal data. If you want the records associated with yours removed, ask us through the contact page and tell us the address in question.

Today the authorization statement is taken at your word. We are being explicit about that rather than implying a check exists where none does.

We are building domain ownership verification, so that scanning a domain you have proven control of works exactly as it does now, while unverified lookups face tighter limits. When that lands it will be announced here and on the homepage before it starts applying.

If we find the service being used to map infrastructure the user has no right to, or to monitor a third party's estate over time, we will:

• -block the source from using the service
• -suspend the associated account, permanently in serious cases, once accounts are available
• -cooperate with law enforcement, which includes disclosing the retained records described above where we are legally required or lawfully requested to do so

We would rather never do any of this. Stating it up front is the point: nobody should be surprised later about what we hold or what we would hand over.

If your domain appears here and you want it taken down from the public listings, or you believe someone is using this service against you, get in touch through the contact page. Include the domain and, if you have it, the approximate time of the activity.

Domain owners can also run a private scan, which keeps a domain out of the public Recent and Popular listings entirely. This applies to the first scan of a domain. To remove a domain that is already listed, email [email protected] from an address at that domain, and we will take it down.