About the sslsnitch scanner

If you are reading this, you probably saw connections from one of our scanner hosts in your logs. This page explains what the scanner does and how to opt out.

What the scanner does

The scanner connects to standard TLS, mail and SSH service ports, reads the public certificate or SSH host key your server presents to any client that connects, and disconnects. It sends no application data, does not attempt to log in, does not exploit anything and does not store any content from your server. Certificates and host keys are public by design; that is all we collect.

On SSH servers (ports 22 and 2222, or any port that answers with an SSH banner) the scanner completes the key exchange once per host key type the server offers, records the host keys and the server's version string, and closes the connection before authentication. You will see it in your logs as sslsnitch-scan disconnecting during or right after the key exchange. It never tries a password or a key.

We scan considerately, at a modest rate, and honour opt-out requests as described below.

Why

Certificates and host keys are public by design. Collecting them across the Internet lets defenders find forgotten hosts, track certificate and host key reuse, verify a "host key changed" warning, investigate incidents and study the TLS and SSH ecosystems.

How to opt out

Email abuse [at] cryodev [dot] se from an address at the organisation that owns the range, and include the CIDR blocks you want excluded. Exclusions are distributed to all scanners within minutes and are permanent.

Identifying our scanners

Every scanner IP has reverse DNS under scanner.sslsnitch.com, and the forward record matches. Any host claiming to be us without that pairing is not us.