About the xltl.dev collector

If you found this page in your logs, a single-operator research tool sent you a request. It is an attack surface inventory tool. It reads public, third-party data about domains its operator is studying, and it does not scan, probe or crawl the hosts it learns about.

How to recognize it

Every request carries this User-Agent:

asm-ct-tailer/0.0.0 (+https://xltl.dev/; ct@xltl.dev)

Versions after 0.0.0 keep the same URL and address.

What it reads

• Certificate Transparency logs (checkpoints and tiles)
• DNS answers through public DNS-over-HTTPS resolvers
• Domain registration data over RDAP
• Published IP-to-ASN data and cloud providers' published address ranges
• URL indexes from the Internet Archive's Wayback Machine, Common Crawl, AlienVault OTX and urlscan.io

How it behaves

• Paced requests from one client; the URL archives get one request every one to two seconds.
• It does not retry a refusal. An error or a rate-limit answer stops its requests to that service for the rest of the run.
• Every run has a byte cap.

Contact

To ask a question, ask for slower requests or have your service left out, write to ct@xltl.dev. A person reads that address. Blocking the User-Agent above also works and will be respected.