Why you may see us
Organisations use DarkRisk to understand the security of their vendors and suppliers. If your organisation is one of them, or one of their suppliers, we may look at what your public systems expose. We do this to help your customers manage their risk, and the same picture is available to you.
What we look at
Only what is publicly reachable on the internet, for example:
- DNS and email records, such as SPF, DMARC and DNSSEC;
- certificates and the protocols your services accept;
- which common ports respond, and the services behind them;
- response headers, cookies and versions your websites disclose; and
- publicly listed storage and services in cloud environments.
Scans are paced to keep the load on your systems low. A scanner sends at most four web requests at a time to any one domain. A domain scan tries each of about 110 common ports once and looks further only at ports that answer. Scans of approved IP ranges make at most 32 connection attempts per second to any one address.
What we never do
- We do not attempt to exploit vulnerabilities or send attack payloads.
- We do not guess passwords or use credentials. Where a service is commonly left open without one, we check whether it is: an anonymous FTP login, a read of the default SNMP “public” community, and requests to databases and management interfaces that need no sign-in.
- We do not keep secrets we come across. If a configuration file or key is publicly exposed, we record what kind of value it contains, never the value, and we never use it.
- We do not send email. Mail server checks stop before a message would be sent.
- We do not upload, change or delete anything on your systems.
- We do not try to disrupt or overload your services.
IP ranges and ASNs
Customers can ask us to scan IP ranges and ASNs. These are scanned only after approval, and customers must own them or be authorised to have them assessed, as set out in our acceptable use policy.
Dark web and media
Our dark web intelligence records when a company is publicly claimed as the victim of a breach, and basic details of what was affected. It does not collect passwords, credentials or personal accounts. Media monitoring follows published news coverage.
Questions and exclusions
If you want to verify that traffic came from DarkRisk, raise a concern, or discuss a finding about your organisation, contact compliance@darkrisk.io. Our scanning source addresses are available on request.
Organisations can ask us to exclude assets they own. Tell us which domains or addresses you control and how we can verify that. We review each request and may limit or stop scanning those assets; we may continue to show customers information that is already public.