External Exposure Check
What this check does, and how to opt out.
The External Exposure Check is a free, passive look at one domain from the outside, the way anyone on the internet sees it. Someone who said they own or are authorised for the domain asked for it and confirmed the request from their work email. If you saw us in your logs and didn't ask for this, you can opt out below and we'll never check your domain again.
In your logs
How to recognise it.
- User-Agent
MRELabs-ExposureCheck/1.0 (+https://mrelabs.dev/exposure-check-about) - Source address76.13.141.78, reverse DNS
exposure-check.mrelabs.dev - VolumeAt most 2 requests a second and 150 HTTP requests in total for a domain, with short timeouts. One check per domain every 90 days at most.
What it does
Ordinary requests, like a browser or a mail server.
- DNSLookups through public resolvers: mail records (SPF, DKIM, DMARC, MTA-STS), DNSSEC, and where the domain's subdomains point.
- TLSOne scan of the main host's protocols, ciphers and certificate, with ordinary handshakes.
- Web pagesGET, HEAD and OPTIONS requests to the homepage, the scripts and source maps it links to, and one random page that doesn't exist, to see the error page.
- Well-known pathsA short, fixed list of 34 paths, such as
/.git/HEAD,/.env,/server-statusand/.well-known/security.txt. It honours robots.txt for these. A backup file is only checked with HEAD, never downloaded. - GraphQLIf a GraphQL endpoint is found, one introspection query.
- Public sourcesCertificate transparency logs (crt.sh) for subdomain names, and endoflife.date for support dates of the software versions a site shows.
What it never does
No attacks, no load.
- NeverPort scans, login attempts, password guessing, fuzzing, payloads or exploits, brute-forcing paths or subdomains, DNS zone transfers.
- Not your neighboursNothing is sent to third-party services your site uses. Redirects to other domains are noted, not followed.
- No secrets keptIf something sensitive turns up, the report shows only a masked fragment, never the value itself.
- A person reads itEvery report is reviewed by hand before it goes to the person who asked for it.
Opt out
Keep your domain out, for good.
This adds the domain and all its subdomains to our exclusion list permanently and stops any check that is still running. Results already collected for it are deleted.
If you give an email address on that domain, we'll confirm by email. Questions or concerns: zilvinas@mrelabs.dev.