About our scanner.

Public logs, not your server.

ArgusLeaf reads public Certificate Transparency logs maintained by Google (Argon/Xenon), Cloudflare (Nimbus), DigiCert (Yeti/Nessie), and others. These logs are publicly accessible over HTTP — we do not scan private networks, internal services, or any server without a public CT entry.

In Phase 0 (current), we do not perform active scanning of discovered domains. We only read the CT log metadata: domain name, certificate serial, issuer, and issuance date.

When we do contact a domain.

For high-scoring matches, we perform a limited enrichment pass: a single HTTP HEAD request (or GET if HEAD is unsupported) to the root URL, and a DNS lookup. This is the same request a browser makes when you type a URL — it retrieves the HTTP status code, server headers, and page title to give our users context.

The following actions are explicitly out of scope — we never perform them:

• ✕Submitting forms or interacting with page elements
• ✕Attempting to log in or test credentials
• ✕Sending POST, PUT, PATCH, or DELETE requests
• ✕Executing JavaScript (we read raw HTTP responses only)
• ✕Probing for software vulnerabilities or misconfigurations
• ✕Port scanning or network enumeration
• ✕Spidering or following links beyond the root URL

Our user-agent string for all enrichment requests is:

ArgusLeaf/1.0 (+https://argusleaf.com/about-our-scanner)

Any server seeing this string can identify the source immediately.

Verify a request came from us

If you see a request in your logs and want to confirm it is ours: the user-agent string above is necessary but not sufficient on its own (it can be spoofed). The authoritative check is the user-agent combined with the fact that the request is a HEAD or GET to the root path only, with no authentication headers and no payload.

We do not publish a fixed egress IP range — our infrastructure may change IPs as it scales. If you receive an enrichment request that does not match the above profile, please report it to [email protected].

We don't hammer servers.

Enrichment requests are rate-limited to at most 1 request per domain per 24-hour window. We honor robots.txt for web crawling (though our primary data source — CT logs — doesn't involve web crawling at all).

We don't cache or store the full content of enriched pages — only extracted metadata: HTTP status code, page title, and redirect chain length.

Remove your domain from enrichment.

To opt out of ArgusLeaf enrichment requests entirely, email [email protected] with your registrable domain (e.g. example.com). We'll add it to our suppress-list within 48 hours. Opt-outs are applied at the registrable domain level and cover all subdomains automatically — you don't need to list each one separately.

What we keep.

CT log metadata (domain, serial, issuer, date)

Retained indefinitely — it's public data already available to anyone.

Enrichment results (HTTP status, title, DNS records)

Retained 90 days, then purged.

User watch-list data (brand terms, domains)

Retained only for active monitoring relationships; deleted upon account closure.

Third-party sharing

We don't sell or share any data with third parties.

Full privacy policy →