What the Perimeter scanner does, and what it never does.

Summary

Perimeter is an external security posture monitoring service run by Cod3Lab. It looks at domains from the outside and reports what any member of the public could observe. It uses passive techniques only: it asks public DNS questions, completes ordinary TLS handshakes, requests a home page the way a browser would, and reads public datasets. It does not port-scan, does not attempt to exploit anything, and does not test passwords. These limits apply to every domain regardless of whether its owner has verified it.

What the scanner does

For each domain, and for subdomains discovered through public certificate transparency logs and passive DNS, the scanner performs some or all of the following:

• DNS lookups. Queries for A, AAAA, CNAME, MX, NS, TXT, DNSKEY and related records against public resolvers and, for DNSSEC and zone-transfer checks, against the domain's authoritative name servers. The zone-transfer check sends a single AXFR request and records whether the server answers; it does not retry or enumerate.
• TLS handshakes. Connects to hostnames on port 443 (and the mail server's advertised ports for STARTTLS) and completes a standard TLS handshake to read the certificate chain, supported protocol versions and offered cipher suites. No application data is sent beyond what is needed to negotiate the handshake.
• One HTTP GET of the home page. Requests / over HTTPS (and HTTP, to check redirects) with a normal browser-like request, follows up to a handful of redirects, and records the response headers and status. It does not crawl, submit forms, or request anything beyond the landing page and standard well-known paths.
• Certificate transparency lookups. Reads public CT logs (via crt.sh) to discover hostnames that have been issued certificates under the domain.
• Third-party dataset lookups (for verified domains, as those categories launch). Queries public and licensed datasets such as Shodan, Censys, DNS-based blocklists and Have I Been Pwned for records already held about the domain. These are lookups against someone else's existing data, not new scans of your infrastructure.

Every request is short, idempotent and comparable to what a search engine, a browser or an email server would do when interacting with your domain normally.

What the scanner does not do

Perimeter is a monitoring service, not a penetration-testing tool. The scanner does not perform port scanning of any kind; information about exposed services comes from third-party internet-scan datasets that already hold it. It does not run vulnerability exploits, fuzzers or web application scanners, and it does not attempt logins, password sprays, brute-force or credential-stuffing of any service. It does not send mail from or to your domain, and it does not relay-test your mail servers. It does not attempt to access any resource that requires authentication.

Checks that would require active techniques are explicitly out of scope and, should we ever add them, would be offered only to verified owners, from a separately published set of addresses, and this policy would be updated first.

Ownership verification

Anyone can add a domain to Perimeter and receive a passive scorecard at monthly cadence. To unlock more frequent scanning, the remaining check categories, alerts and a public scorecard link, the account holder must prove control of the domain by publishing a DNS TXT record. The record is:

For example, to verify example.com with the token shown in the app:

_perimeter.example.com.  300  IN  TXT  "perimeter-verify=7f3c9a1e4b2d8f60"

The token is unique per domain and per organisation. Verification is re-checked periodically; if the record disappears, the domain falls back to the unverified, passive-only tier and alerts stop until it is restored. Verification can be revoked at any time by deleting the record.

This gate exists so that the service cannot be used to keep a close watch on domains the user does not control. Free passive scans are additionally rate-limited per account and per source IP address.

How to identify our traffic

All scanner traffic originates from the following addresses. We will add to this list before using any new address, never after.

HTTP requests carry the user agent:

PerimeterScanner/0.1 (+https://perimeter.cod3lab.com/scanner)

You may allowlist, rate-limit or block these addresses. If you block them, the affected checks will report the host as unreachable from our vantage point and the relevant category will be marked as not assessed rather than failed. Please do not treat traffic claiming to be PerimeterScanner from any other address as ours; report it to abuse@cod3lab.com.

Rate and frequency

Scan cadence depends on the owner's plan: monthly for free and unverified domains, weekly on Starter and daily on Pro, MSP and Enterprise. A verified owner can also trigger a rescan on demand, subject to a per-domain cooldown. Within a scan, requests to any single host are serialised and spaced out; a full scan of a typical small domain involves a few dozen DNS queries, a handful of TLS handshakes and one or two HTTP requests per discovered web host.

Opting out and reporting abuse

If you do not want your domain to be scanned by Perimeter at all, email abuse@cod3lab.com from an address at the domain (or with other evidence of control) and we will add it to our exclusion list within two business days. Excluded domains cannot be added by any account, and any existing scorecard for them is removed.

If you believe the scanner has behaved outside this policy, or you have seen traffic that violates it, please send the relevant log lines, timestamps (with time zone) and source addresses to the same address. We treat every such report as a priority and will tell you what we found.

Because the scanner only issues ordinary public requests, a robots.txt disallow does not apply to it in the way it applies to crawlers; the exclusion list above is the supported opt-out mechanism.

Disputing a finding

Every finding in Perimeter is backed by the raw evidence the scanner captured: the DNS answer, the HTTP response headers, the certificate chain or the third-party record. Verified owners can see that evidence next to the finding and use the dispute button, which sends the evidence to our team; we answer by email and, where the check was wrong, correct the check itself. Owners can also mark a finding as accepted risk or false positive, which removes it from the score and records the decision.

If a public scorecard shows a finding about a domain you control but have not claimed, email abuse@cod3lab.com with the domain and the finding; we will review the evidence and correct or remove it. Claiming the domain is faster and gives you the evidence directly.

Changes to this policy

We will update this page before changing what the scanner does, before adding scanner addresses, and before changing the user agent. Material changes are also announced to account holders by email. The date at the top of the page reflects the most recent change.