About our checks
For site owners and administrators who saw requests from “Perimeter-Analyser” in their logs.
What you saw
Seen From Outside checks how a website is set up, as seen from the public internet: whether it uses HTTPS properly, its certificate, its security headers, and its email-domain settings (SPF and DMARC). Our requests identify themselves with this User-Agent:
Perimeter-Analyser/<version> (passive configuration check; https://seenfromoutside.com/about-our-scans)
“Perimeter” is the name of the software behind Seen From Outside.
Why your site was checked
We only check a domain when its owner has asked us to. Before any check runs, the owner proves they control the domain by adding a DNS record we give them, or engages us directly. If you did not ask for this and don’t know who did, contact us and we’ll look into it.
What a check does, and what it never does
A check is small and read-only.
For each analysis, it:
- Connects to your site only at the domain itself and its www host, and only on ports 80 and 443
- Sends only ordinary GET requests for the home page, and follows redirects only within those two hosts
- Opens a few TLS connections to read the certificate and see which TLS versions are offered
- Looks up public DNS records through an ordinary DNS resolver, as any visitor’s computer does, and asks the domain registry for the registration expiry date, registrar and status
It never:
- Scans ports, or tries other hosts or subdomains
- Guesses paths or files, or tries to log in
- Follows links, scripts or images found in your pages
- Submits forms or sends anything other than a plain page request
- Tries to exploit or stress anything
Each analysis has a hard limit: at most 12 web requests and, separately, 12 TLS connections for the certificate and TLS-version checks. A scheduled check runs at most once a day; owners can also start one by hand, which is rate-limited.
It is a configuration check, not a penetration test or a vulnerability scan.
Where the requests come from
Web and TLS requests to your site come from a single server in Sydney, Australia: 104.156.232.55. It has no IPv6 address. DNS lookups reach your nameservers through a DNS resolver, so they show the resolver’s address, not ours.
Contact us, or ask us to stop
Email hello@seenfromoutside.com. Tell us the domain and, if you can, the time and the address you saw the requests from.
If you are responsible for a site and want the checks to stop, tell us and we will stop them. We read every message.