# SysOSX

> Free tools and live data for people who run things on the internet: website health checks, SSL and domain expiry checkers, and network tools that run in the browser — plus an LLM API cost calculator with a verified pricing leaderboard. No sign-up, no clutter.

## Tools

- [Tools](https://www.sysosx.com/tools/): All SysOSX tools in one place.
- [Website Health Check](https://www.sysosx.com/tools/website-health-check/): One domain in, a full report out — uptime, response time, TLS certificate, domain registration and DNS records, with a shareable URL.
- [SSL Checker](https://www.sysosx.com/tools/ssl-checker/): A live TLS handshake against any domain: certificate issuer, validity window, days remaining, chain and hostname validation, negotiated protocol.
- [SSL Grader](https://www.sysosx.com/tools/ssl-grader/): A deep TLS audit from the server — protocol matrix for TLS 1.0–1.3, key and signature detail, forward secrecy and HSTS — with a letter grade and the reasons behind it. The checker is the quick certificate view; the grader is the full setup audit.
- [Port Scanner](https://www.sysosx.com/tools/port-scanner/): A connect-only probe of twenty well-known ports from the server — open, closed and filtered reported separately, no banner reads, no custom ports. Once port 443 is known open, the SSL Grader audits what is behind it.
- [DNS Blacklist Checker](https://www.sysosx.com/tools/blacklist-checker/): A domain's IPv4 addresses against ten IP blacklists (Spamhaus ZEN, Barracuda, SpamCop, CBL, PSBL, UCEPROTECT and more) and the domain against Spamhaus DBL, URIBL and SURBL, asked through the server's own resolver. Listed, not listed and error are reported separately — an errored zone is never presented as a clean result.
- [Email Deliverability Check](https://www.sysosx.com/tools/email-deliverability-check/): MX, SPF (expanded and counted for real against the 10-lookup limit), DMARC policy/reporting and DKIM selector probing, returned as plain-language findings in fix order. Finding no DKIM selector is stated plainly not to prove DKIM is absent.
- [Certificate Transparency Search](https://www.sysosx.com/tools/certificate-transparency-search/): Every certificate crt.sh has logged for a domain and its subdomains, searched from the server (no browser cross-origin limits) — issuer, names, validity, newest first, capped with the true total shown.
- [CVE Triage](https://www.sysosx.com/tools/cve-triage/): Paste up to 200 CVE ids (or a whole scanner report — ids are extracted automatically) and rank each one P1–P4 by known exploitation (CISA KEV catalog, cached daily on the server), exploitation probability (FIRST EPSS daily scores) and CVSS severity (NVD, cached permanently on first lookup). KEV due dates and ransomware flags are shown per row, with CSV export. A CVE missing from the results is "not in today's cached data", not "not exploitable".
- [Domain Expiry Checker](https://www.sysosx.com/tools/domain-expiry-checker/): Registrar, registration and expiry dates with a live countdown, plus nameservers and key DNS records from registry data.
- [HTTP Status Chain Checker](https://www.sysosx.com/tools/http-status-chain/): Every redirect hop for one URL — statuses, targets, final URL and security headers — traced from sysosx's server, not the visitor's browser.
- [DNS Propagation Checker](https://www.sysosx.com/tools/dns-propagation/): One question, four answers — Google, Cloudflare, Quad9 and OpenDNS on where a domain points, with TTLs and a consensus verdict.
- [BGP Lookup & RPKI Check](https://www.sysosx.com/tools/bgp-lookup/): Look up who originates an IP or prefix, how widely the route is seen by RIPE RIS collectors, sample AS paths, and whether RPKI validates the origin — plus AS overviews with prefix counts and neighbours.
- [Global Ping](https://www.sysosx.com/tools/global-ping/): Ping, HTTP, DNS, traceroute and MTR from volunteer probes in networks around the world at once, run through the Globalping network from the server — the honest answer to "is it down, or is it just you?".
- [AI Agent Readiness Checker](https://www.sysosx.com/tools/agent-readiness-checker/): Scan a domain the way an AI agent would approach it and get a 0–100 score across discovery (robots.txt and AI crawlers, sitemap, llms.txt, structured data), access (plain-HTTP reachability, bot challenges, raw-HTML content, honest status codes), usability (OpenAPI and MCP discovery, auth metadata, agent-fillable forms) and payments (agentic checkout discovery, scored only when a site sells something) — with every finding, its evidence and its fix shown free, in a fix-first order sorted by recoverable points.
- [Bulk Domain & Certificate Checker](https://www.sysosx.com/tools/bulk-domain-checker/): Paste up to 50 domains and get each one's registrar, registration and expiry dates plus its live TLS certificate (issuer, expiry, validity) in one sortable table, soonest expiry first, with a CSV export — RDAP registry data plus a live TLS handshake per domain.
- [LLM Usage Cost Analyzer](https://www.sysosx.com/tools/llm-usage-analyzer/): Drop a CSV usage export or OpenAI usage API JSON and see cost by model and by day, cached-token share and the models no price table can price — parsed locally in the browser and never uploaded; files without a cost column are priced from the site's LLM pricing table.
- [Subnet Calculator](https://www.sysosx.com/tools/subnet-calculator/): Network, broadcast and usable range, wildcard mask and binary breakdown from one IP and CIDR prefix, plus a VLSM planner and IPv6 expand/compress. Pure arithmetic, computed in the browser.
- [DNS Lookup](https://www.sysosx.com/tools/dns-lookup/): A, AAAA, MX, TXT, CNAME, NS and SOA records for any domain via public DNS-over-HTTPS resolvers (Google first, Cloudflare as fallback), with TTLs shown. Answers show one resolver's view, not worldwide propagation.
- [Log Parser & Redactor](https://www.sysosx.com/tools/log-parser/): Apache, Nginx, JSON Lines or syslog files parsed locally in the browser, filterable by level and text, with redaction of emails, IPs and tokens and CSV, JSON or text export. Files never leave the browser.
- [Test Data Generator](https://www.sysosx.com/tools/test-data-generator/): Up to 10,000 rows of realistic fake data as CSV, JSON or SQL INSERTs, generated locally with @faker-js/faker (MIT).
- [SSL Certificate Parser](https://www.sysosx.com/tools/ssl-certificate-parser/): Paste a PEM certificate to read its issuer, subject, covered names, validity and SHA-256 fingerprint locally (node-forge, BSD-3-Clause), plus an optional crt.sh Certificate Transparency history lookup. For a live server check, use the SSL Checker.
- [Domain Lookup](https://www.sysosx.com/tools/domain-lookup/): Registrar, registration and expiry dates, nameservers and status flags straight from registry RDAP data. For a countdown and monitoring, use the Domain Expiry Checker.
- [On-Call Scheduler](https://www.sysosx.com/tools/on-call-scheduler/): Team roster, rotation length and start date in — a fair round-robin on-call calendar for weeks ahead out, printable and exportable as CSV. Pure date arithmetic, computed in the browser.
- [Self-Signed Certificate Generator](https://www.sysosx.com/tools/self-signed-certificate-generator/): Common name, SANs, validity days and RSA key size in — PEM certificate and private key out, generated locally in the browser with node-forge (BSD-3-Clause) and never uploaded. For reading a certificate back, use the SSL Certificate Parser.
- [Certificate & Key Matcher](https://www.sysosx.com/tools/certificate-key-matcher/): A browser-local workbench for a pile of certificate files: drop in any mix of certificates, private keys and CSRs (PEM or DER) and it groups them by public-key (SPKI) SHA-256 fingerprint to prove which key matches which certificate, orders certificates into a leaf-to-root chain with per-link signature verification where WebCrypto allows (name-match-only links labelled honestly), converts PEM ⇄ DER per file, and generates a PKCS#10 CSR (RSA-2048 or EC P-256) with its key via WebCrypto. Private keys are held in memory only, never uploaded or stored, and the page makes no network request. No PKCS#12 export — the page shows the openssl command instead. For decoding one certificate, use the SSL Certificate Parser.
- [Backup Retention Calculator](https://www.sysosx.com/tools/backup-retention-calculator/): Grandfather-father-son (GFS) retention simulated day by day in the browser — restore points kept and storage needed after 1 month, 6 months, 1 year and 2 years, plus the peak to provision for.
- [SLA Error Budget Calculator](https://www.sysosx.com/tools/sla-error-budget-calculator/): SLA targets (99%, 99.9%, 99.95%, 99.99% or custom) over 28, 30 or 365 days converted to allowed downtime in minutes, with remaining budget and burn percentage from observed downtime or uptime.
- [Time Zone Meeting Planner](https://www.sysosx.com/tools/meeting-planner/): Pick a date and add cities (36 presets or any IANA zone): a 24-hour grid of local times coloured by work, shoulder and night hours, the all-work overlap window or the best-compromise hours, and a DST warning when a zone's offset changes within a week of the date. Pure Intl arithmetic in the browser.
- [Capacity Estimator](https://www.sysosx.com/tools/capacity-estimator/): From requests per second (or per day), CPU service time per request and a target utilisation: required cores, whole servers rounded up with none/N+1/2N redundancy, requests in flight from Little's law, optional egress bandwidth, and a 1x/2x/5x/10x growth table. Formulas shown on the page.
- [.env Parser & Validator](https://www.sysosx.com/tools/env-parser/): Paste or drop a .env file — parsed locally in the browser, never uploaded. Entries table with values masked by default; issues for malformed lines, invalid key names, duplicate keys (with both line numbers) and empty values; optional usage text cross-check (defined-but-unreferenced and referenced-but-missing names); export to JSON or YAML.
- [Base64 Encoder / Decoder](https://www.sysosx.com/tools/base64-encoder-decoder/): Base64, Base64URL, Base32 and hex for text (live as you type) and files (drag-drop encode to text or data URL; paste encoded text and download the decoded file), computed locally in the browser. Strict decoding reports the position of the first invalid character, padding errors and non-zero spill bits instead of a generic failure.
- [Hash Generator](https://www.sysosx.com/tools/hash-generator/): Real digests computed locally in the browser — MD5 implemented from RFC 1321 (WebCrypto offers none), SHA-1, SHA-256, SHA-384 and SHA-512 via WebCrypto, plus HMAC-SHA-256 with a user key — for typed text or a dropped file, with an upper/lowercase hex toggle. Files are never uploaded; an AI chat asked for a hash will invent a plausible one instead of computing it.
- [Hash Identifier](https://www.sysosx.com/tools/hash-identifier/): Paste a hash and get the likely algorithms from its prefix (bcrypt $2y$, SHA-512-crypt $6$, Argon2, MySQL asterisk format), length and alphabet, each labelled likely or possible with a one-line note. Ambiguity is stated honestly — a 32-hex string is listed as MD5 or NTLM, never decided by shape alone. Identification only: no cracking, no lookups, nothing uploaded.
- [JWT Decoder & Verifier](https://www.sysosx.com/tools/jwt-decoder/): Paste a JSON Web Token to decode header and payload to pretty JSON locally, render iat/nbf/exp as a claim timeline (expired / valid-for / not-yet-valid), and verify HS256/HS384/HS512 signatures with a user-supplied secret via WebCrypto HMAC. Loud warnings for alg=none and for asymmetric algorithms (RS256 etc.), which need the issuer's public key. The token is never transmitted — tokens are credentials.
- [Password & Token Generator](https://www.sysosx.com/tools/password-generator/): Passwords (8–128 chars, set toggles, exclude look-alikes, bulk up to 50), passphrases from a built-in 560-word list (3–8 words, separators, capital/digit options, entropy shown) and API tokens (16/32/64 random bytes as hex or Base64URL) — all from crypto.getRandomValues with rejection sampling, never Math.random, never sent or stored. Includes a strength checker using a charset-pool model minus penalties for repeats, sequences, years and known-common passwords.
- [DMARC Report Analyzer](https://www.sysosx.com/tools/dmarc-report-analyzer/): DMARC aggregate (RUA) report files — .xml, .xml.gz or .zip bundles — decompressed and parsed locally in the browser, never uploaded. Multiple reports merge into one per-source table: source IP, message count, disposition, SPF and DKIM alignment results, failing rows highlighted, plus plain-language notes on what to fix (unrecognised sources failing both alignments, forwarding patterns, p=none and pct warnings). For the records themselves, use the Email Deliverability Check.
- [Email Header Analyzer](https://www.sysosx.com/tools/email-header-analyzer/): Pasted raw headers or a full .eml analysed locally in the browser, never uploaded. Received chain in order with per-hop timestamps and computed delays (negative or over-a-day gaps flagged), Authentication-Results SPF/DKIM/DMARC verdicts with their domains, From/Reply-To/Return-Path/Message-ID domain comparison, body URLs extracted and defanged, attachment names with executable-type and double-extension flags, and a points-based findings list banded low/elevated/high with every finding explained. It reads headers only: it does not verify DKIM signatures or check URLs against threat feeds.
- [PCAP Analyzer](https://www.sysosx.com/tools/pcap-analyzer/): PCAP and PCAPNG packet captures (.pcap, .pcapng, .cap, up to 25 MB) parsed locally in the browser, never uploaded. Classic PCAP (both endiannesses, micro/nano timestamps) and PCAPNG (section/interface/enhanced/simple packet blocks and name-resolution blocks); Ethernet (incl. VLAN), raw IP, loopback and Linux SLL/SLL2 link types; IPv4/IPv6, TCP, UDP, ICMP. Output: summary with protocol mix, conversations table (per-direction packets/bytes, sortable, CSV export), DNS queries and answers, cleartext HTTP requests, TLS ClientHello metadata (SNI, ALPN, JA3 fingerprint via the site's hand-rolled MD5), cleartext-credential warnings (HTTP Basic, FTP, SMTP AUTH, POP3, IMAP, telnet — sightings only, secrets never reproduced), and a defanged IOC export (unique IPs, domains, URLs). No TCP stream reassembly and no decryption: encrypted traffic is metadata-only, stated on the page.
- [PGP Suite](https://www.sysosx.com/tools/pgp-suite/): OpenPGP in the browser, powered by OpenPGP.js (LGPL-3.0-or-later), loaded only on this page. Generate a Curve25519 or RSA-4096 key pair with optional name, email and passphrase; encrypt text to a pasted public key; decrypt with a private key and passphrase; create cleartext signatures and verify them with an honest valid/invalid verdict that names the signer fingerprint; and inspect any armored key block — fingerprint, key ID, algorithm, creation and expiry, user IDs and subkeys. Private keys and passphrases are never transmitted or stored: the job AI chats refuse, done locally.
- [APK Analyzer](https://www.sysosx.com/tools/apk-analyzer/): An Android APK parsed locally in the browser, never uploaded and never installed. Hand-rolled binary AndroidManifest.xml (AXML) and resources.arsc parsers read the package name, version name/code, min/target SDK and the app label; permissions are listed with protection levels from a curated reference table (anything unknown is labelled unknown, never guessed); debuggable and allowBackup flags and exported activities, services, receivers and providers are reported; signing certificates are extracted from both the v1 META-INF signature files (PKCS#7) and the v2/v3 APK Signing Block, with subjects and SHA-256 fingerprints.
- [EVTX Viewer](https://www.sysosx.com/tools/evtx-viewer/): Windows event logs (.evtx, up to 64 MB) parsed locally in the browser, never uploaded. The parser is the Rust evtx crate (MIT OR Apache-2.0) compiled to WebAssembly and driven by a Web Worker in batched sessions with progress. Output: a summary (record count, UTC time range, channels, computers, top providers and Event IDs), a filterable, searchable record table, per-record structured EventData/UserData fields plus the raw event XML, JSON/CSV export of the filtered records, and corrupt chunks reported with their byte offsets — never silently skipped. Honest limit, stated on the page: the rendered message text Event Viewer shows comes from Windows message DLLs and is not inside the .evtx file, so the viewer shows the fields, not invented prose.
- [LLM API Cost Calculator](https://www.sysosx.com/llm/cost-calculator/): Monthly LLM API costs across models from your own request and token volumes.
- [LLM Pricing Leaderboard](https://www.sysosx.com/llm/pricing/): A sortable table of every tracked model price, with sources and verification dates.

## API and agent access

- [OpenAPI specification](https://www.sysosx.com/openapi.json): The machine-readable OpenAPI 3.1 contract for the public checker API behind the tools above — every /api/check/ endpoint, its parameters and its response shape.
- [API documentation](https://www.sysosx.com/api-docs/): The human-readable guide to the same public API — what each endpoint checks, its parameters, the response envelope, error codes and copy-paste curl examples. Free, no account, no API key.
- [Authentication and rate limits](https://www.sysosx.com/auth.md): Why the API needs no key or account, how the per-IP rate limits and per-tool buckets work, and how an agent should identify itself with a descriptive User-Agent.
- [Full site text](https://www.sysosx.com/llms-full.txt): Everything in this file, expanded — every tool with its description, every tracked LLM model price with its verification date, and every blog article title, in one plain-text document.
- [AI catalog](https://www.sysosx.com/.well-known/ai-catalog.json): A JSON catalog of the site's agent-facing surface — the checker REST API, the LLM pricing data and the agent-readiness checker, with the links an agent needs for each.
- [Agent card](https://www.sysosx.com/.well-known/agent-card.json): An A2A-style agent card naming the skills agents can exercise here — SSL checks, domain expiry, website health reports, agent-readiness scans, bulk domain checks and LLM pricing lookups — each described as the plain HTTP call it actually is.
- [API catalog](https://www.sysosx.com/.well-known/api-catalog): An RFC 9727 API catalog (RFC 9264 linkset) pointing at the OpenAPI description, the API documentation, the access notes and the API status probe.

## Languages

Every tool above, both LLM pages, the homepage and this tools index are published in 11 languages. English is at the root URLs listed above; the other ten live under a language prefix, with the same paths after it — for example, the Base64 tool is /tools/base64-encoder-decoder/ in English and /zh-cn/tools/base64-encoder-decoder/ in Simplified Chinese. The older blog archive is English-only; every article published since 2026-10-30 is also published in all 11 languages under the same language prefixes. Entry points:

- [简体中文](https://www.sysosx.com/zh-cn/): Homepage in Simplified Chinese. Tools index: https://www.sysosx.com/zh-cn/tools/
- [繁體中文](https://www.sysosx.com/zh-tw/): Homepage in Traditional Chinese. Tools index: https://www.sysosx.com/zh-tw/tools/
- [Español](https://www.sysosx.com/es/): Homepage in Spanish. Tools index: https://www.sysosx.com/es/tools/
- [Português](https://www.sysosx.com/pt/): Homepage in Portuguese. Tools index: https://www.sysosx.com/pt/tools/
- [Deutsch](https://www.sysosx.com/de/): Homepage in German. Tools index: https://www.sysosx.com/de/tools/
- [Français](https://www.sysosx.com/fr/): Homepage in French. Tools index: https://www.sysosx.com/fr/tools/
- [日本語](https://www.sysosx.com/ja/): Homepage in Japanese. Tools index: https://www.sysosx.com/ja/tools/
- [한국어](https://www.sysosx.com/ko/): Homepage in Korean. Tools index: https://www.sysosx.com/ko/tools/
- [Русский](https://www.sysosx.com/ru/): Homepage in Russian. Tools index: https://www.sysosx.com/ru/tools/
- [हिन्दी](https://www.sysosx.com/hi/): Homepage in Hindi. Tools index: https://www.sysosx.com/hi/tools/

## Blog

- [SysOSX blog archive](https://www.sysosx.com/blogs/): Hands-on notes on Linux, servers, self-hosting and running systems.
- [Why a site looks different from different places](https://www.sysosx.com/blogs/debugging-redirects-and-dns-propagation/): A debugging guide — redirect chains, DNS propagation and the caches between you and the origin — with links to the status chain and propagation checkers.
- [One reliability routine](https://www.sysosx.com/blogs/on-call-backups-and-error-budgets/): On-call rotations, backup retention and error budgets planned together as a single weekly/monthly routine, with links to the on-call scheduler, backup retention calculator, SLA error budget calculator and certificate tools.
- [TLS grades: how they are earned, and how they are lost](https://www.sysosx.com/blogs/tls-grades-earned-and-lost/): What a TLS grade measures, the failures behind each cap — expired or mismatched certificates, broken chains, legacy protocols, missing forward secrecy and HSTS — and the fixes in the order worth doing, with links to the SSL grader and checker.
- [What open ports say about a server](https://www.sysosx.com/blogs/what-open-ports-say-about-a-server/): How to read a port scan like an operator — which open ports are normal, which are emergencies, what filtered really means, and what a clean scan does not prove — with links to the port scanner and SSL grader.
- [Why your email lands in spam](https://www.sysosx.com/blogs/why-your-email-lands-in-spam/): Spam placement as a verdict assembled from signals — blacklist listings first, then SPF/DKIM/DMARC proof of identity, and the traps inside records that look fine (+all, multiple SPF records, lookup drift, p=none forever) — with links to the blacklist checker and the email deliverability check.
- [Finding a meeting time that respects every time zone](https://www.sysosx.com/blogs/finding-a-meeting-time-that-respects-every-time-zone/): Why "9am" is not a time, the overlap arithmetic (an 8-hour work window minus the offset difference), the DST changeover weeks that move recurring meetings by an hour, and fair rotation when no good hour exists — with a link to the meeting planner.
- [How many servers do you actually need?](https://www.sysosx.com/blogs/how-many-servers-do-you-actually-need/): Capacity planning from two formulas — cores from request rate and CPU service time, concurrency from Little's law — plus the utilisation ceiling as a policy decision and why load-test benchmarks measure a different service — with a link to the capacity estimator.
- [Env files are where secrets go to leak](https://www.sysosx.com/blogs/env-files-are-where-secrets-go-to-leak/): The .env paste as the realistic breach (AI chats, tickets, commits), duplicate and shadowing bugs, empty-value traps, and the hygiene habits that survive: keep it out of version control, restrict it like a key, rotate on suspicion, validate locally — with a link to the .env parser.
- [Never let a chatbot do your secrets](https://www.sysosx.com/blogs/never-let-a-chatbot-do-your-secrets/): The three failure modes of AI chat for security work — hallucinated answers for things that must be computed (hashes above all), refusals that push people to worse services, and the logged copy every paste leaves behind — and the local tools that replace the chat for hashing, JWT decoding, hash identification, Base64 conversion and password generation.
- [Base64 is not encryption](https://www.sysosx.com/blogs/base64-is-not-encryption/): Encoding, encryption and hashing untangled — keyless and reversible by design versus key-based and reversible versus one-way — with the classic mistakes: Base64-"encrypted" API keys and Kubernetes secrets, MD5-"encrypted" passwords, and double-encoding schemes that are obfuscation, not encryption.
- [When your key does not match your certificate](https://www.sysosx.com/blogs/when-your-key-does-not-match-your-certificate/): The classic deploy failure — a rekeyed renewal, a copied certificate, the old key left in place, and a server that refuses the 2 a.m. reload. How matching actually works (the shared public key, never the file names), chain-order mistakes (alphabetical bundles, stale intermediates, the missing-intermediate error), and checking the pair before the reload — with links to the certificate & key matcher and the certificate parser.
- [Reading your DMARC reports](https://www.sysosx.com/blogs/reading-your-dmarc-reports/): What DMARC aggregate reports actually contain — metadata, the echoed policy block, per-source records — the authentication-versus-alignment distinction that decides disposition, the four populations in every source table (own infrastructure, providers, forwarders, unknown sources), and the only safe order from p=none to quarantine to reject — with a link to the DMARC report analyser.
- [Triage CVEs by exploitation, not just severity](https://www.sysosx.com/blogs/triage-cves-by-exploitation-not-just-severity/): Why CVSS-only patch queues patch the wrong things first — the KEV catalog as the known-exploited floor, EPSS as the probability ranking, CVSS demoted to tiebreak and impact estimate — with a worked patch order and the exposure split that still belongs to the operator, with a link to the CVE triage desk.
- [First ten minutes with a packet capture](https://www.sysosx.com/blogs/first-ten-minutes-with-a-packet-capture/): A capture triage workflow in order — conversations first (volume, asymmetry, strangers, beacon rhythm), then DNS because names are intent (with answers read as frozen at capture time), then the metadata encryption leaves behind (SNI names and JA3 client fingerprints), then the cleartext surprises (HTTP Basic headers, FTP and mail logins, and why a captured credential gets rotated) — plus local-only handling of the file itself, offloading artefacts in host captures, and the point where triage stops and Wireshark stream-following takes over — with a link to the PCAP analyser.
- [Anatomy of a phishing email header](https://www.sysosx.com/blogs/anatomy-of-a-phishing-email-header/): One fabricated bank-alert phish dissected in analyst order: the Authentication-Results verdict the receiving server recorded, the Received chain read with its hop delays and decaying trust, From/Reply-To/Return-Path/Message-ID disagreements, and the body's confessions — a link whose text names one domain and goes to a raw IP, and a statement.pdf.exe — with a link to the email header analyser.
- [How to check BGP routes and RPKI validity](https://www.sysosx.com/blogs/how-to-check-bgp-routes-and-rpki/): How to read a BGP lookup like an operator — who originates a prefix, how widely RIPE RIS collectors see the route, what the AS paths do and do not prove, and how RPKI ROA validity (valid, invalid, not found) is decided — with a link to the BGP lookup & RPKI check.
- [Is it down, or is it just you?](https://www.sysosx.com/blogs/is-it-down-or-is-it-just-you-globalping/): Why one vantage point cannot answer the oldest question in operations — local failure, regional routing trouble and a genuinely down service look identical from your desk — and how measuring ping, HTTP, DNS, traceroute and MTR from probes in networks around the world at once separates them — with a link to Global Ping.
- [Can AI agents use your website?](https://www.sysosx.com/blogs/can-ai-agents-use-your-website/): Agents are visitors now — what agent readiness means, the four layers it is scored on (discovery, access, usability, payments), how to read a 0–100 score and the not-applicable renormalisation, the failures that cost the most points and their fixes, and a case study of sysosx.com itself, produced by running the same scanning engine locally because the public checker blocks its own domain by design — with a link to the AI agent readiness checker.
- [Check your domains and certificates in bulk](https://www.sysosx.com/blogs/check-your-domains-and-certificates-in-bulk/): Why domains and certificates still lapse (renewal mail to departed staff, registrar and host confusion), the two-clocks habit that prevents it, and a monthly bulk-check routine — with a link to the bulk domain and certificate checker.
- [How to analyze your LLM usage file](https://www.sysosx.com/blogs/how-to-analyze-your-llm-usage-file/): Where to export usage from OpenAI and Anthropic, and what to look for once it is open — cached-token ratio, model mix drift, one runaway key — with a link to the LLM usage cost analyzer.