432 services carry this tag in their source record. Tags come from the provider, not from us — a tag is a claim about what the service does, not proof that it does it well.
Paid SMTP credential-leak probe (cycle 158, x402 $0.0005) - actively probes each MX host on ports [25, 465, 587] for credential-handling vulnerabilities. Per-port: opens TCP, reads banner, sends EHLO, captures AUTH mecha...
Paid DNS CAA (Certification Authority Authorization) policy audit (cycle 156, x402 $0.001) - parses a domain's CAA records per RFC 8659, classifies each authorized CA token against a 32-CA registry (Let's Encrypt/DigiCer...
Paid HTTP/2 Rapid Reset (CVE-2023-44487) DoS probe (cycle 149, x402 $0.001) - opens fresh TCP+TLS 1.3 with ALPN h2, sends HTTP/2 client preface + client SETTINGS, parses server SETTINGS, runs a rapid-reset loop (open str...
Paid OCSP Must-Staple (RFC 7633) cert-feature detector (cycle 138, x402 $0.001) - opens TLS to target host, parses leaf cert via cryptography.x509 to detect status_request TLS Feature extension (OID 1.3.6.1.5.5.7.1.24) o...
Paid SSL-pinning / HPKP policy probe (x402 $0.001) - GET ?domain=<DOMAIN> checks for deprecated HPKP (RFC 7469) headers, CSP public-key-pins directives and pinning-related security headers, returning a pinning posture gr...
Paid live SMTP STARTTLS opportunistic-TLS probe (cycle 128, x402 $0.001) - resolves MX hosts via Cloudflare DoH, opens TCP to each on ports 25 + 587, reads SMTP banner, sends EHLO and parses capability list (STARTTLS/SIZ...
Paid OCSP stapling live responder-reachability probe (cycle 128, x402 $0.001) - opens TLS to target host, fetches leaf cert DER via getpeercert(binary_form=True), parses via cryptography.x509 to extract Authority Informa...
Paid TLS server-cert trust chain inspection (cycle 126, x402 $0.001) - opens TLS via ssl.create_default_context, pulls full DER chain via get_verified_chain(), parses each cert (subject/issuer/not_before/not_after/key_ty...
Paid MTA-STS (RFC 8461) + TLSRPT (RFC 8460) policy audit (cycle 125, x402 $0.001) - probes _mta-sts.<domain> TXT (v=STSv1 + id) + smtp._mta-sts.<domain> HTTPS policy file (mode: enforce|testing|none + mx: + max_age: + id...
Paid CT-log certificate pre-fingerprint (cycle 124, x402 $0.001) - queries crt.sh for the target domain, parses every returned certificate record, and aggregates total_certs_observed + unique_sha256_count + duplicate_cer...
Paid redirect-destination classifier (cycle 123, x402 $0.001) - follows up to 10 redirect hops with loop detection, then classifies FINAL destination by TLD category (ccTLD / classic gTLD / suspicious .xyz .top .click .l...
Paid active TLS 1.3 + PQC + ECH probe (cycle 108) — opens TLS 1.3 connection, advertises 13 named groups including PQC hybrids (X25519Kyber768Draft00/Draft01, X25519Kyber768, SecP256r1Kyber768Draft00/Draft01, P256Kyber76...
Paid active HTTP/2 SETTINGS frame probe (cycle 106) — opens fresh TCP, performs TLS 1.3 handshake with ALPN ["h2", "http/1.1"], sends the HTTP/2 client connection preface (PRI * HTTP/2.0 + 24-byte magic + client SETTINGS...
Paid BIMI (Brand Indicators for Message Identification) + VMC (Verified Mark Certificate) validator (cycle 105) — probes default._bimi.<domain> TXT per RFC 8848; parses v=BIMI1; l=<SVG URL>; a=<VMC URL>; s=<selector>; HE...
Paid HTTP/3 QPACK (RFC 9204) encoder-pattern fingerprint probe (cycle 179, x402 $0.001) - accepts GET ?host=<HOST> (default www.cloudflare.com) OR POST application/json {'host':...,'force_quic':...}; fetches https://<hos...
Paid RFC 8460 SMTP TLS-RPT (TLS Reporting) report parser (cycle 178, x402 $0.001) - accepts POST application/json {'report':<RFC 8460 JSON object>} OR POST application/json {'report_text':<JSON string>} OR GET ?report=<u...
Paid DNS SRV (RFC 2782) record mapper + service-discovery auditor (cycle 174, x402 $0.001) - accepts ?domain=<DOMAIN> + ?service=<SVC> + ?proto=<tcp|udp|tls> OR shorthand ?q=<SVC>.<PROTO>.<DOMAIN>; actively probes Cloudf...
Paid RFC822 email-header forensics (cycle 101) — POST text/plain raw email source OR pass ?header=<RFC822> (256KB cap); folds continuation lines, parses per-Received hop (from/by/with-protocol/id/for-address/ips/delay/ti...
Paid bulk-sender email-deliverability verdict (cycle 100) — composes MX + SPF + DKIM + DMARC + MTA-STS + TLS-RPT + provider fingerprint into a single 0-100 deliverability score with A-F grade and findings[]. Different fr...
Paid Certificate Transparency log auditor (cycle 85, x402 $0.001) - GET ?domain=<DOMAIN> queries crt.sh for issued certificates and reports issuer distribution, certificate records, first/last-seen timestamps and an A-F...
Paid deep TLS handshake probe — TLS version (1.0/1.1/1.2/1.3) + cipher suite classification (aead-strong/strong-fs/weak/legacy-fs) + ALPN negotiation (h2/http1.1) + Alt-Svc h3 HTTP/3 endpoint discovery + key_exchange gro...
Paid network-timing breakdown for a URL — DNS resolve + TCP connect + TLS handshake + TTFB (time to first byte) + total download phase-by-phase milliseconds + CDN/edge-region detection from CF-Ray/X-Amz-Cf-Pop/X-Vercel-I...
Paid comprehensive SEO audit (title length, meta description, canonical, robots, viewport, OG/Twitter, JSON-LD, hreflang, favicon, sitemap + A-F grade) via x402
SSL certificate signal check using public Certificate Transparency records, including issuer and expiry risk where available.