About the Vitrina Engine monitor

Vitrina Engine checks whether a site is up, how long it takes to answer, and whether its certificate is about to expire. A check is a single request on a fixed schedule — most commonly once a minute, and never faster. It does not crawl: it requests exactly the URL it was given, follows no links, and indexes nothing.

The same identifier is used when we deliver a webhook to an endpoint a customer configured, which is a single POST at the moment something they are monitoring changes state.

Every request carries this User-Agent:

VitrinaEngine/1.0 (+https://vitrinaengine.com/bot)

A User-Agent is only a claim, and anybody can copy it. So do not rely on it alone — there are two ways to actually verify a request is ours.

Signatures — the reliable way

Every request is cryptographically signed, using HTTP Message Signatures (RFC 9421) as Web Bot Auth defines them. Three headers carry it:

Signature-Agent: "https://vitrinaengine.com"
Signature-Input: sig1=("@authority" "signature-agent");…;tag="web-bot-auth"
Signature: sig1=:…:

Our public keys are published as a JSON Web Key Set at /.well-known/http-message-signatures-directory. This is the check to prefer. A signature cannot be replayed against a different host, cannot be forged without our private key, and does not depend on anybody's DNS being current.

Reverse DNS — a secondary check

Our probes reverse-resolve to hostnames under infinitycurve.com. To verify one, resolve the connecting address to a name, check the name ends in that suffix, then resolve the name back and check it returns the same address. The round trip is what makes it proof — a reverse record on its own is set by whoever controls the address block.

$ dig +short -x 203.0.113.10
host1234.infinitycurve.com.

$ dig +short host1234.infinitycurve.com
203.0.113.10

Use this if your edge cannot verify signatures. It is corroboration rather than proof, and it depends on records published by whoever operates each address block — which is not our system, and is not always in place.

We do not publish a list of addresses, and we would rather you did not build one. Probes move between hosts, providers and locations as we place them, so anything you pin to a specific address or data centre will eventually stop matching with nothing to say why. Verify the signature instead — it is true wherever the request came from.

If your robots.txt names us, we obey it. This stops our checks on that path within the hour:

User-agent: VitrinaEngine
Disallow: /

We deliberately do not treat a wildcard rule as applying to us. A monitor is not a crawler — it requests one URL somebody registered, discovers nothing and stores nothing — and sites that publish a blanket disallow are usually staging environments, admin panels and internal tools, which are exactly the things people ask us to watch. A rule naming us is unambiguous; a rule aimed at search engines is not.

Ask whoever set it up. A monitor exists because somebody entered your URL, and they are the person who can remove it — usually a colleague, an agency, or a hosting provider acting for you. That is the fastest route by a distance.

If you cannot find them, mail support@vitrinaengine.com with the URL being checked and we will stop it. You do not have to prove you own the domain to have us stop requesting it; we would rather stop and be asked to resume.

Blocking the User-Agent, the robots.txt rule above, or the hostnames also works and needs nothing from us. Be aware of what it means: the monitor will report the site as unreachable, and whoever set it up will notice.

• It does not crawl, spider, or follow links.
• It does not collect content, train anything, or retain response bodies.
• It does not attempt to authenticate, submit forms, or probe for vulnerabilities.
• It does not ignore a block. Refused is a result, and it gets recorded as one.