Aegis 檢查程式說明
Aegis 是層次數位空間有限公司（LabSpace Intelligence）提供的網站資安健檢服務，幫用 AI 做出網站或工具的人，在上線前找出設定上的風險。如果你在網站紀錄裡看到下面的來源，就是我們的檢查程式。
怎麼認出我們
| 來源 IP | 136.69.176.23 |
|---|---|
| 反查名稱 | scanner.aegis.labspace.com.tw（這個名稱正查也會回到同一個 IP） |
| User-Agent | Aegis-PublicCheck/3 (+https://aegis.labspace.com.tw/scanner/)（免費初檢）Aegis-DeepCheck/1 (+https://aegis.labspace.com.tw/scanner/)（深入健檢） |
User-Agent 任何人都能偽造。要確認是不是我們，請以來源 IP 與反查名稱為準。
我們會做什麼
- 免費初檢：有人輸入網址並聲明有權檢查後，讀取網站首頁，以及首頁本身引用的同網域檔案（例如網頁載入的 JavaScript）。每次最多 21 個讀取請求（GET）、最長 60 秒。另外經公開的 DNS 查詢服務查看網域的 DNS 設定，這部分不會連到你的網站。
- 深入健檢（付費）：只對完成 DNS 驗證、證明是網站擁有者的網域進行。每次最多 60 個讀取請求、最長 150 秒，除了上面的項目，還會確認幾個常見、不該公開的檔案（例如
/.env、/.git/HEAD）是否讀得到，以及跨網域設定（CORS）。只比對有沒有讀到，不保存檔案內容。
我們不會做什麼
- 不登入、不嘗試帳號密碼、不送出攻擊或破壞性的內容。
- 不寫入、修改或刪除任何資料，不做壓力測試。
- 免費初檢不猜測沒有公開連結的路徑，而且有次數限制：同一個網路每天最多 3 次，全站每天也有總量上限。
- 免費初檢不受理政府與軍方網站（
.gov.tw、.mil.tw）。
要求停止檢查
如果你是網站擁有者，沒有授權別人檢查你的網站，請寫信到 [email protected]，附上網域與看到檢查的時間。我們會在 2 個工作天內回覆，並依你的要求把該網域（含子網域）列入停止檢查名單，之後任何人都無法再對它送出檢查。
最後更新：2026-10-31
About the Aegis scanner
Aegis is a website security check service run by Labspace Digital Co., Ltd. (LabSpace Intelligence). It helps people who build sites and tools with AI find configuration risks before launch. If you see the sources below in your logs, the requests came from our scanner.
How to recognise us
| Source IP | 136.69.176.23 |
|---|---|
| Reverse DNS | scanner.aegis.labspace.com.tw (forward lookup returns the same IP) |
| User-Agent | Aegis-PublicCheck/3 (+https://aegis.labspace.com.tw/scanner/) (free check)Aegis-DeepCheck/1 (+https://aegis.labspace.com.tw/scanner/) (in-depth check) |
Anyone can fake a User-Agent. Please rely on the source IP and reverse DNS to confirm it is us.
What we do
- Free check: after someone enters the address and declares they are authorised, we read the homepage and the same-origin files that the homepage itself references (such as its JavaScript). At most 21 GET requests and 60 seconds per check. We also look up the domain's public DNS settings through a public DNS resolver, which does not touch your site.
- In-depth check (paid): only for domains whose owner has passed DNS verification. At most 60 GET requests and 150 seconds. Besides the above, we check whether a few common files that should never be public (such as
/.envand/.git/HEAD) are readable, and the CORS settings. We only record whether they were readable, never their contents.
What we never do
- No logging in, no password guessing, no attack or destructive payloads.
- No writing, changing or deleting data; no load testing.
- The free check does not guess unlinked paths and is rate-limited: at most 3 per network per day, with a daily cap for the whole service.
- The free check does not accept government or military sites (
.gov.tw,.mil.tw).
Ask us to stop
If you own a site and did not authorise the check, email [email protected] with the domain and the time you saw the requests. We reply within 2 business days and, on request, add the domain (including subdomains) to our stop list so that nobody can submit it for checking again.
Last updated: 2026-10-31