Egress and web filtering
Whether traffic can leave, and where to. Every published run tries to reach internet-wide scan databases, exploit archives, malware repositories, web proxies, Tor and consumer cloud storage — and records which of them the network actually stopped.
No published reports yet
Egress and filtering results appear once 3 runs have been published. Each destination category needs that many reports of its own before it is listed.
What gets tried, and what is deliberately not
The client resolves and fetches the landing page of two dozen security-research services, grouped into the categories a web filter is actually configured with: scan databases, exploit archives, offensive tooling, malware repositories, anonymisers, breach data and hacking forums. Each service is tested twice — DNS then HTTPS — because DNS filtering and URL filtering are different controls that fail differently.
Nothing is downloaded. The exploit archives are touched, not harvested, and the response is read and discarded. Criminal marketplaces and breach forums are deliberately excluded: a filter that blocks Shodan blocks those too, and there is nothing to learn from visiting one.
Every destination the client can ever contact is listed by
securitycheck --list-targets, and --explain prints the ones a
particular command would reach. Both exist so a security team can approve a run in advance.