What is this scanner?Research scanner
If a connection from Google Cloud to your server on port 443 shows up in your logs once a month, ending right after the TLS handshake, it is probably ours. This page says who we are, what the scanner does and how to make it stop.
Who scans
ecdsa.com, for its monthly report The State of Signatures on the Web. The scan runs as a Google Cloud Run job in the europe-west1 region (Belgium), from Google's shared addresses, on the 2nd of every month from 03:00 UTC. The scanner is the same code as the site's public Domain Signature Health check.
What it does
- Resolves your domain once and checks every address it gets: names that point into private or reserved address space are not contacted at all.
- Opens one TCP connection to port 443 and completes one TLS handshake, with your domain name as SNI. It records the protocol version, the cipher, the key-exchange group your server picked and the certificate chain you serve.
- Opens one more connection that offers nothing newer than TLS 1.1 — and, only if your server accepts that, one capped at TLS 1.0 — to see whether the deprecated protocols are still enabled.
- Closes every connection right after the handshake. Domains are scanned in batches of at most 64 per scanning task (the job runs four tasks side by side), with a pause between batches.
What it does not do
- It sends no HTTP request: no page, no robots.txt, no headers are ever fetched. That is also why there is no User-Agent to see — TLS has none.
- It does not retry. A domain that times out or refuses is recorded as such and not contacted again that month.
- It contacts nothing but port 443 of the names on the lists, and only the one address it connected to first.
- It never sends credentials or anything beyond the standard handshake every browser makes.
Which domains
The 10,000 highest-ranked domains of the Tranco research list of the day, and the 1,000 most visited sites of nine countries from the Chrome UX Report. Your domain is on one of these public rankings; we did not pick it.
Leave your domain out
Write to privacy@ecdsa.com from an address at your domain, or with another sign that you control it. We add the domain to the scanner's exclusion list — a file in the site's repository, which covers the domain and every name below it — and it applies from the next monthly run. Excluded domains are dropped while the month's list is built, before any name is resolved or any address contacted; the report states how many were excluded.
The method
Everything else — the lists, the grading, what is compared with what — is in the methodology of each issue, starting with the latest one. The scanner's code is part of the site's repository: scripts/research/ on top of lib/health/.