Perimeter Watch Scanner

Passive external-perimeter checks for the domains you own or manage. This is the scanner engine behind Perimeter Watch — open-sourced so you can verify exactly what it does and run it yourself.

The hosted version is here: https://entradox.github.io/perimeter-watch-site/ ($9/mo for 3 domains, $19/mo for 10 — weekly briefs with evidence, zero maintenance). Self-hosting this repo gets you the scanner only: you build the cron, the diffing, the delivery, and the retention archive yourself.

What it checks (all passive, public data only)

1. TLS certificate expiry — read from public Certificate Transparency logs (crt.sh); direct-connect fallback; alert window <14 days
2. Domain registration expiry — whois with RDAP fallback (rdap.org); alert window <21 days
3. Dangling DNS / subdomain takeover — 50 common subdomains checked via DNS; CNAME targets fingerprint-matched against the can-i-take-over-xyz list (Heroku, S3, Azure, GitHub Pages, Netlify, Shopify, etc.). A fingerprint CNAME whose target no longer resolves = takeable = RED
4. Lookalike domains — hyphen/plural/suffix variants queried in CT logs (info-only; content-verification is planned as Phase 2)

What it never does: port scans, crawling, active testing, credential access, takedowns, or fixes. If it can't reach a source, it says COVERAGE_GAP in the output — it never guesses.

Quick start

# requirements: python 3.10+, dig (bind-utils/dnsutils), whois (optional — RDAP fallback exists)
python3 perimeter_scan.py --domain example.com --state state.json --brief --evidence-dir ./evidence

Output: full JSON (stdout + state file), a rendered one-page brief, and an append-only evidence line in evidence/<domain>.jsonl.

Sample run (real output):

# Perimeter Watch Brief — example-site.com
**Rating: GREEN** | Scan window: 2026-09-03T15:54 → 15:54
## COVERAGE
- tls:               OK — cert expires in 93 days
- domain_lifecycle:  OK — 294 days remaining
- dangling_dns:      OK — 50 subdomains checked, zero takeable records
- lookalikes:        OK — 4 variants queried, 0 registered

Weekly cron

# crontab -e — Mondays 03:00, every domain in domains_authorized.txt
0 3 * * 1 cd /path/to/repo && for d in $(cat domains_authorized.txt); do python3 perimeter_scan.py --domain "$d" --state "state_${d}.json" --evidence-dir evidence >> briefs/weekly_log.md 2>&1; done

Rules baked into the code

• Authority before scan. Only scan domains you own or are authorized to manage.
• Passive only. Public records: CT logs, whois/RDAP, DNS resolution. No probing, ever.
• Honest failure. Unreachable sources produce COVERAGE_GAP, never a fake GREEN.
• No takedowns, no fixes. Detection and evidence only.

License

MIT. Attribution appreciated, not required.

Don't want to run cron yourself?

The hosted service does all of this weekly, delivers the brief with evidence to your inbox, and supports agency-resell terms: https://entradox.github.io/perimeter-watch-site/

Contact: entradox@icloud.com