JC-Lab is offering a free external security self-check that accepts one domain, public IP address, or website URL without registration. According to its service page, the Korean service brings together public subdomains, exposed ports, software versions, known vulnerability matches, and web-security settings using public information and harmless browser-like requests.
The useful distinction is between finding something worth investigating and confirming that an attacker can exploit it. JC-Lab explicitly places the free service in the first category. Its separate AI penetration-testing service requires customer registration and verified ownership of the assets being assessed.
The primary technical document is JC-Lab’s undated service page. A TUMN curation record dates a GeekNews post promoting the tool to October 19, 2026. That establishes an earlier public mention, not a verified launch timestamp.
What the Free Self-Check Collects
The entry point is simple: submit a domain, a public IPv4 or IPv6 address, or an HTTP/HTTPS website address. JC-Lab says no installation or account is needed. Private and reserved IP addresses are excluded, and operators are instructed to assess only assets they own or have permission to check.
The documented report covers five areas:
- Subdomains and hostnames: Public records are used to discover externally visible names and identify the IP addresses they resolve to.
- Open ports and services: The report organizes externally exposed ports and the services or products associated with them.
- Software versions and CVEs: Identified versions are matched against known vulnerabilities and presented by severity.
- Web frameworks and server-side components: Fingerprinting attempts to identify frameworks and library versions, including signals associated with React Server Components.
- Web-security settings: The service retrieves the homepage and referenced scripts to inspect security headers, cookie settings, and potentially vulnerable JavaScript libraries.
That combination makes this useful as an inventory exercise before it becomes a vulnerability exercise. An operator may first need to establish which public hosts exist, which services appear on them, and which software deserves closer inspection.
