Skip to main content

​
Discovery

Periphery collects hostnames under the providers’ suffixes from public sources: places where hostnames are published or logged as a side effect of being reachable on the internet. Discovery adds hostnames only; nothing else is known about a host until it is snapshotted.

​
The snapshot

A snapshot is one visit to one hostname, as an anonymous visitor:
  1. A headless browser loads https://<hostname>/ and waits for the page to render.
  2. The HTTP status, the page title, the visible text, a screenshot, and the favicon are recorded, and the favicon is hashed.
  3. Email addresses are extracted from the rendered page.
  4. The page source is scanned for credentials, and each candidate is checked with its issuer to mark it verified or not.
  5. The record is stored with the time of the visit, which becomes last seen.
If the browser cannot load the page, a plain HTTP request is made instead. Any answer, even an error status, counts as the host being alive and records its status. No screenshot, text, or findings are stored in that case: the previous snapshot’s screenshot, text, and findings stay in place, and last seen is refreshed.

​
Dead hosts

Two outcomes retire a host:
  • DNS no longer resolves. The hostname is gone.
  • The provider reports the deployment as gone. The provider’s own “not found” page answers for the hostname.
Such hosts are marked dead. They leave the search results, and their app page and API record answer “not found”. Hosts that resolve but do not answer (connection refused, timeout) are not dead; their last seen is refreshed and they are retried later.

​
Rescans

Hosts are re-snapshotted on a rolling basis, with those never or least recently seen going first. There is no fixed interval; the last seen age on each app tells you how recently it was visited and found alive, and the seen: filter narrows results by that age. See Reading an app page for why the snapshot itself can be older.

​
What is never done

Periphery fetches public URLs without credentials. It does not log in, submit forms, bypass access controls, or exploit vulnerabilities. What it records is what any visitor with a browser would see.