Effective and last updated: .
InfernoBlue LLC operates this website. Business and correspondence address: 30 N Gould St, Ste N, Sheridan, WY 82801. Contact: team@infernoblue.com.
Purpose and limits
InfernoBlue’s research policy sets boundaries for evaluating security information and communicating concerns. It does not establish that a particular target has been tested, that a vulnerability exists or that research is currently running. Publishing this policy does not activate a scanner, authorize any scan or grant a legal safe harbor. Neither intent nor this policy guarantees that every activity is legally compliant or has zero impact; authority, applicable law and operational risk must be assessed for the actual activity.
Passive sources are not live testing
Review of passive, public or licensed data can include published advisories, CVE feeds, certificate records, public technical records and provider datasets. Source provenance, license conditions, permitted use and privacy obligations matter. Public availability is not permission to access an underlying system, and public information is not necessarily nonpersonal.
A connection to a target, including an HTTP request, banner check, port probe or vulnerability check, is a live interaction rather than merely reviewing a third-party record. A third-party observation can be stale, incomplete or misattributed; it is not a verified finding and does not justify contacting the target to validate it without the required authority.
Authorization before active checks
Active checks require verified authorization from an owner with authority over the affected assets in a written scope, or a directly applicable vulnerability disclosure program (VDP) whose published scope explicitly permits the proposed activity. Verify ownership or delegated authority, covered assets, allowed methods, exclusions, timing, rate limits, data handling and stop contacts before beginning. A domain association or IP address alone does not verify that authority. Shared hosting and third-party dependencies are not automatically included.
Do not infer permission from this policy, privacy terms, website terms, an unsolicited notice, silence, a sales conversation, publicly reachable services or a security.txt contact file. A security.txt file can identify a reporting channel; it is not by itself testing authorization. Follow every applicable VDP condition and exclusion. If authority or scope is unclear, do not start; if it changes or is withdrawn, stop the affected work and resolve scope before resuming.
Excluded activity without separate explicit scope
No secret validation, credential use, authentication bypass, exploit execution, bulk data extraction, operational technology (OT) testing or destructive checks are permitted absent separate explicit scope authorizing that activity from a party able to grant it. This includes testing whether an exposed key works, accessing additional records to prove impact, establishing persistence, modifying data or causing service disruption. A general assessment request does not authorize these actions. Separate scope still requires review of legal authority, affected third parties and safety; it is not a blanket exception to law or a reason to disregard risk.
Minimize collection, stop and notify
Limit observations and retained records to what is necessary for the authorized purpose. Prefer metadata and redacted descriptions over sensitive content. If incidental sensitive information, unexpected access, instability or an out-of-scope condition is encountered, stop the affected activity, avoid further access or validation, restrict the information and notify an appropriate verified owner or disclosure contact. Coordinate secure handling, correction or deletion of unnecessary evidence. Do not continue collecting simply to strengthen a report.
Do not publish target-specific evidence, credentials, secrets or identifiable sensitive records. Share necessary detail privately with verified recipients through a suitable channel. Any public educational discussion must avoid exposing targets or sensitive evidence and respect applicable obligations.
Disclosure is separate from sales
Communicate research concerns independently of any sale or payment. Reporting and coordination must not be conditioned on buying services, paying a fee or accepting a commercial proposal. Do not use threatened publication, continued testing or withholding of essential safety information as sales pressure. Describe uncertainty and source limitations clearly; a signal or public record is not proof of a live exploitable vulnerability.
Published infrastructure identity
179.236.255.156 is designated research and assessment infrastructure on IBPROD. It is also shared infrastructure for the production website. 2.25.162.218 on KVM4 is separate feed infrastructure running a public CVE feed-only service. Neither listing describes a fully operational broad public scanner.
Both addresses can carry unrelated traffic. Their current published identity does not authorize any scan. An IP address is not proof of a particular activity, its originator or asset ownership. Infrastructure roles and routing can change; correlate observations with timestamps and nonsensitive records rather than treating an address match as attribution.
Report a concern or request a stop
Email team@infernoblue.com with a subject such as “Research concern / stop request”. Include the UTC time or time range, source and destination IP addresses, hostname, a short description and non-sensitive logs if available. Explain your relationship to the affected system without including credentials or restricted information. Do not email secrets, tokens, personal datasets or raw sensitive evidence; ask for a suitable channel if more detail is necessary.
You may block an IP or take other defensive measures under your own authority without waiting for a response. Blocking shared infrastructure may also affect unrelated services. We assess reports, correlate available records, and stop affected research while unresolved scope or safety concerns are investigated. We may need proportionate verification before sharing details or changing a third party’s scope. This contact is not a guaranteed emergency response service or a promise of a response deadline.
Reports about InfernoBlue systems
You can report a suspected issue affecting our own public services to the same address using a nonsensitive description. This invitation to report is not authorization to test, access data, bypass controls or demonstrate impact. Stop if sensitive information is encountered and arrange a suitable channel before sharing evidence. No bounty, payment or immunity is promised by this policy.
Questions and changes
Contact team@infernoblue.com with questions about this policy. We may update this page to reflect changes in practices, services or applicable requirements. The date above identifies this version; additional notice will be provided where required by applicable law. A website update does not amend a signed engagement agreement by itself.
For a nonsensitive business inquiry, use our contact page. For research concerns or a stop request, email the contact above rather than submitting technical evidence through the inquiry form.