Our scanning traffic
If you have seen connections or web requests from Frontage, this page explains what they are. Frontage is a security monitoring service. We scan a system only when its owner, or someone with the owner’s written authority, has asked us to, and only after verifying that they control it, for example with a confirmation link sent to an address at their domain or a DNS record that they publish.
How to recognize our traffic
Our active scans come from 3.143.226.1, a server we run on Amazon Web Services. Passive checks read only public DNS and certificate records and send nothing to your systems.
- Web requests are GET requests only, for a page’s response headers, a short, fixed list of paths that should never be public (such as
/.git/configand/.env) and, on WordPress sites, a few public files that state software versions (the feed,readme.html, the theme’sstyle.cssand thereadme.txtof up to 10 plugins the page itself references), with the User-AgentFrontage/1.0 (Frontage Security; automated security assessment; GET requests only; headers and known-sensitive paths). - Port scans are TCP connection scans of the 1,000 most commonly used ports at normal timing, which identify the service and software version on each open port.
- Encryption checks connect to web, mail and SSH services to read their certificates and supported protocols.
We do not attempt to sign in, guess passwords, exploit weaknesses, change anything or test for denial of service.
If you did not ask for this
Email abuse@frontagesecurity.com with the IP addresses or hostnames involved and the times you saw the traffic. We will check our records, which show who authorized each scan and when. If we cannot confirm that the scan was authorized by the owner of the system, we will stop scanning it, normally within one business day. Our customers can allow traffic from that address so their firewalls do not block the scans they have asked for.
Reporting a weakness in Frontage itself
See our Responsible disclosure policy.
Colin Finley, doing business as Frontage Security · contact@frontagesecurity.com