The Peekray fetcher

If a request from Peekray turned up in your site’s logs, this page says what it was. Peekray is a free scam-link checker (a Chrome extension and this website). When someone asks it about a link to your site, Peekray’s server visits that link once, so the person can see where it goes before they open it. It is not a crawler: it never visits a page nobody asked about, and it never follows links on your pages to other pages.

How it identifies itself

Every request carries this user agent:

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Peekray/1.0 (peekray.com/fetcher)

It looks like an ordinary browser’s, so that a scam site can’t show the checker a cleaner page than it shows people, and it ends with Peekray/1.0 and the address of this page, so you can tell it apart from a browser.

What it does

Follows redirects. For every check, one request to the link (usually HEAD, which asks for headers only) and up to four redirects after it.
Reads one page, on a deep check. Only when someone asks for a deep check, one GET of the page the link lands on, reading up to 512 KB of its HTML, with up to three more redirects. It may also fetch the page’s own small icon.
Opens a page built by scripts in a browser, on a deep check. When that page is blank, or nearly blank, without its scripts, it may open it once more in a locked-down headless Chromium on a separate, throwaway machine (a Vercel Sandbox), with the same user agent. The browser runs the page’s scripts and loads the scripts, styles and data the page asks for, but no images, video or fonts, and reads what the page built within a few seconds, following the page if its scripts send it to another address. Visits like this are capped each day.
Looks at the site’s public records. One encrypted connection to read the site’s certificate, and ordinary DNS and registry lookups.

What it never does

It doesn’t click or type anything, fill in or submit forms, or download files. Its browser runs your page’s scripts only when the page is blank, or nearly blank, without them, and lets out only requests that fetch something: a form post, an upload or any other kind of request the page makes is answered inside the browser and never sent.
It doesn’t open links that carry a sign-in code, a password-reset token or an unsubscribe token.
It doesn’t crawl: it fetches only the address it was asked about, once, and keeps no copy of your page. When the page needs its browser it visits a second time, loading the files that page asks for and going wherever the page’s own scripts send it, but it never follows a link. What it keeps are signals (for example, whether the page asks for a password), for at most an hour.
It doesn’t reach private addresses: links to internal networks, localhost and the like are refused before any connection is made, and its browser’s machine is barred from them too.
It doesn’t send anything about the person who asked. Your site sees Peekray’s server, not them.

How often

Once per check (twice on a deep check of a page built by scripts), and repeat checks of the same link are answered from a cache (10 minutes for ordinary checks, an hour for deep checks) without a new visit. Each person’s checks are rate-limited. A site would have to be checked by many different people to see more than a handful of visits a day.

If you’d rather it didn’t visit

Because each visit is on behalf of one person who asked about one link, the fetcher behaves like that person’s browser preview rather than a crawler, and doesn’t read robots.txt. To turn it away, block requests whose user agent contains Peekray/1.0: Peekray will then tell the person it couldn’t read the page, and judge the link on its address and the public lists alone. Or write to hello@peekray.com.