Commonly Asked Questions

Crimson Forge builds security tools for offensive and defensive operations. Trashhound is our DNS and SSL intelligence platform designed to identify potential threats like dangling domains and suspicious traffic patterns. 

 Trashhound performs passive internet scans, collecting SSL certificates and associated domain information. If no domains are linked to a certificate, it attempts one additional connection to the IP address to resolve domains. No further action is taken. 

 Trashhound passively gathers publicly available SSL certificate data and DNS information. This is similar to how search engines crawl websites, and no intrusive or exploitative actions are performed. 

 No. Trashhound does not crawl, spider, or attempt to resolve website content. It strictly collects SSL certificates and associated domain metadata. It is not a web crawler or spider and does not gather any page content, APIs, files, or user information. 

 We currently do not offer general opt-out because unrestricted opt-outs could be abused by malicious actors seeking to hide from security analysis. However, if you have a specific, legitimate reason, we are willing to review requests. 

 When Trashhound attempts to resolve domains associated with an IP address, it uses a "Crimson Forge/Trashhound" user agent. This process is limited to a single additional request if no domain is found and is used solely for domain discovery purposes. 

 No. Trashhound does not perform vulnerability scanning, exploitation, or intrusive probing. It only collects public SSL and DNS data for security intelligence purposes. 

 The data is used to improve threat detection, track malicious domain activity, and help organizations defend against DNS-based attacks and misconfigurations. 

 Trashhound only collects publicly accessible information—no private user data, credentials, or sensitive content is accessed or collected. 

 Trashhound is designed to be extremely lightweight. An IP will see no more than 1–2 GET requests per day, if any. In many cases, servers are only contacted once during an initial discovery phase and not revisited unless their SSL or DNS configuration changes.