About this scanner

If you reached this page from a log entry or an abuse report, this explains who we are and why our address contacted your domain.

Who operates this

This scanner is operated by MajhenLabs (Robert Majhen), an independent security consultancy. It runs from a single server whose outbound address is:

178.104.22.81

Forward and reverse DNS for that address match, and all scanning originates from it. If you saw a different address claiming to be us, it was not us.

What a scan does

The automated scan is a light, read-only assessment of publicly accessible information only. In a single run it may:

• read DNS records (SPF, DMARC, MX, name servers);
• complete a TLS handshake to check the certificate and protocol versions;
• read HTTP response headers on the home page;
• request a small, fixed set of well-known public paths (for example a publicly exposed .git directory or .env file);
• check whether a few common TCP ports accept a connection;
• enumerate publicly known subdomains from certificate-transparency logs and similar public sources.

Volume, in concrete numbers

A complete run against one domain is:

• fewer than 80 HTTP GET requests in total (roughly 60 on a non-WordPress site, roughly 70 on WordPress), nearly all of them to a fixed list of well-known paths — that list is static and identical for every site we scan;
• 23 TCP connection attempts to common service ports, each closed immediately after the handshake;
• a handful of DNS lookups and one TLS handshake;
• total elapsed time: roughly 8–12 seconds.

For comparison, an off-the-shelf vulnerability scanner sends several thousand requests against a single host. We deliberately run about two orders of magnitude below that, because the goal is a report for the site owner, not coverage.

The same domain is not re-scanned on repeat: results are cached and a repeated request returns the stored report instead of touching your server again. Requests are additionally rate-limited per requester, per source address, and per target domain.

What a scan never does

• No exploitation, no fuzzing, no injection, no password guessing.
• No attempt to reach data that is not already publicly served.
• Nothing is modified on your systems — every request is a plain read.
• No crawling: we read the home page, not your site.
• No authentication attempts of any kind against your systems.

On whose request

A scan is not started at random. Before any scan runs, the person requesting it must receive a one-time code sent to an email address on the domain being scanned and enter it back. In other words, a scan of your domain means someone who could receive mail at your domain asked for it.

We keep a record of every scan: the target domain, the timestamp, and the verified email address that requested it. If you are the domain owner or its hosting provider, tell us the domain and the date and we will tell you which address requested that scan.

This email check is a good-faith signal, not a claim of full authorization. Any deeper, authenticated, or intrusive testing is never automated and is only ever performed under separate, written authorization.

For hosting and abuse teams

If you are handling an abuse report about the address above, please contact us directly at robert@majhenlabs.com. We respond quickly, we keep records of what was scanned and on whose request, and we will stop scanning any domain on request without argument.

---