Security & blocked targets

Before RegionCheck connects to anything, it checks the resolved address against categories of addresses that should never be reachable from a public check:

• Private address ranges
• Loopback addresses
• Link-local addresses
• Multicast addresses
• Reserved and other non-routable ranges
• Cloud metadata addresses

If a target resolves into any of these ranges, the check is rejected before a connection is attempted.

Checks are restricted to the standard web ports: 80, 443, 8080, and 8443. A target on any other port is rejected before RegionCheck attempts to connect.

A hostname can resolve to more than one IP address, so RegionCheck resolves the hostname and validates every resolved IP against the blocked ranges above before connecting — not just the first one returned.

Webhook delivery re-validates the destination IP again at send time, right before the request goes out. This defends against DNS rebinding, where a hostname is deliberately changed to point at an internal address after it was first checked.

Beyond address and port restrictions, every check runs under a strict timeout, so a slow or unresponsive target can't tie up resources indefinitely. Response bodies are captured only up to a plan-based size limit, and redirects are validated the same way as the original target — a redirect can't be used to reach an address that would otherwise be blocked.

See Understanding results for what a blocked error looks like in a result, and Webhooks for how outbound alert delivery applies these same protections.