Our scanner

Footprint checks only the domains an organisation has verified and asked us to monitor. If you see this scanner in your logs, here is how to recognise it and what it does.

Scans from
15.134.112.83 (AWS Sydney, ap-southeast-2). All scan traffic leaves from this one address.
User agent
Mozilla/5.0 (compatible; OSXP-Footprint/1.0; +https://osxp.au/scanner.html)
Operated by
OSXP.AU, Australia
Contact
hello@osxp.au

Allowlisting

If you are a Footprint customer, you can allow the address above in your firewall or WAF so our checks see what the internet sees, without being blocked. You don't have to: when a check is blocked or challenged, we mark it as inconclusive and never try to get around the block.

What it does

  • Reads public sources first: DNS, certificate transparency logs and internet-scan data.
  • Makes light, read-only requests to confirm a finding and rule out false positives, such as reading a page's headers or checking whether a service answers.
  • Reads only enough of an exposed file, such as a .env file, to confirm what it is. Values are never recorded.
  • Paces its requests per host, so it never adds noticeable load.

What it never does

  • Log in, or use any password, key or token it finds.
  • Exploit a vulnerability, send attack payloads or try to bypass authentication.
  • Download data, change anything or create accounts.
  • Try to defeat a CAPTCHA, WAF, rate limit or bot check.
  • Scan lookalike domains, which belong to someone else. We only take a passive snapshot of their public page.

Not a customer?

If you think our scanner has reached a system that isn't part of a customer's verified domains, email hello@osxp.au with the time and the address it reached. We'll look into it and stop.