See your client's domain the way an attacker does.
Built from public records and one ordinary request, with every finding mapped to NIS2, DORA and ISO 27001.
- Subdomains found
- 17
- Findings
- 4
- Public sources
- 47
- Frameworks
- 3
- Read
- vpn.example-client.eu appears in CT logs; the name points to a remote-access login
- Source
- Certificate Transparency
- State
- Inferred
- Maps to
- DORA Art. 9
- 47 public data sourcesCertificate logs, DNS, registries
- One ordinary requestTo read HTTP security headers
- No port scans or probesNothing a WAF flags as an attack
- Mapped to regulationNIS2, DORA, ISO/IEC 27001
The same picture, without probing the client.
Most scanners send probes at the client's hosts to see what answers. didroot assembles the same picture from records that are already published, so the client's servers see nothing beyond one ordinary visit.
Active scanner
Thousands of probes against the exposed hosts. The client's WAF, SIEM and security team all see them arrive.
- 09:14:02SYN:22blocked
- 09:14:02SYN:3389blocked
- 09:14:02SYN:445blocked
- 09:14:03GET/admin403
- 09:14:03GET/.env404
- 09:14:03GET/wp-login.php404
- 09:14:04POST/login429
- Touches servers
- Fills logs
- Triggers alerts
didroot
Certificate logs, DNS and registries already describe the domain. We read those, plus one ordinary HTTP request, the same one any visitor makes.
- Certificate Transparency17 names
- Public DNS42 records
- Mail authenticationSPF · DMARC · DKIM
- TLS certificates5 certificates
- 09:14:05GET/200
- Public records
- One ordinary request
- Reads as one visitor
Illustrative logs. Times, counts and addresses are examples.
Every scan runs the same six passes.
Six passes over public sources, always in this order. Each pass adds its result for the domain to the same report, and every result keeps a record of where it came from.
Swipe to see every column
Discover subdomains in certificate logs
Every TLS certificate issued for a domain is published in Certificate Transparency logs. Reading them maps every subdomain that has ever carried a publicly logged certificate, including the forgotten ones.
Every result carries one of three states
- Observed
- Read directly from a public record: a DNS answer, a certificate, a header.
- Inferred
- Deduced by combining records, and labelled so the client knows it is a deduction.
- Mapped
- Scored, deduplicated and tied to the regulation articles it relates to.
Eight signal layers from 47 public data sources.
Each layer appears in the client's report with the record behind it.
Subdomains
Every name that has carried a publicly logged certificate, via Certificate Transparency.
17 subdomainsDNS
A, AAAA, MX, NS, CAA and DNSSEC from public resolvers.
NS ×2 · DNSSEC offMail authentication
SPF, DMARC and DKIM selectors: can the domain be impersonated?
DMARC p=noneTLS
Validity, expiry, protocol and chain from the published certificate.
Cert expires in 9 daysHTTP headers
Seven security headers from one ordinary request, graded A to F.
Grade C · no CSPWAF / CDN
Which provider fronts the domain, fingerprinted from public answers.
Cloudflare in frontHosting
ASN, geolocation and cloud provider for the domain's addresses.
AS13335 · EUExtras
RPKI, DANE, BIMI, security.txt and CORS policy.
No security.txtExample findings are synthetic.
Findings mapped to EU regulation.
Every finding is tagged with the framework articles it relates to, so the report your client receives doubles as evidence for their auditor.
- Read
- TLS certificate expires in 9 days
- Source
- Certificate Transparency log
- State
- Mapped
- Maps to
- NIS2 Art. 21ISO/IEC 27001 A.8
The mapping is evidence for an auditor, not a certificate of compliance.
Network & Information Security Directive 2
Art. 21Cybersecurity risk-management measures
Digital Operational Resilience Act
Art. 8Identification
Art. 9Protection and prevention
ISO/IEC 27001:2022
Annex A.8Technological controls
What you can order today, and what is planned.
Passive reconnaissance is available now, by request. Monitoring and credential exposure are planned and not yet available.
- Available
Passive reconnaissance
A full external review of one domain: DNS, mail, TLS, headers, subdomains, hosting and WAF, with findings mapped to regulation.
- Planned
Surface monitoring
Repeated passive scans with alerts when a client's perimeter changes.
- Planned
Credential exposure
Targeted monitoring of breach corpora and paste sites.
What you can rely on.
No probing
Public sources and one ordinary request, which lands in the client's access log like any other visitor.
Founder-led
Designed and reviewed by Dídac in Barcelona. No outsourcing.
Inspectable
Every finding names the public source it came from and the state it is in.
Common questions
Almost. Everything comes from third-party public sources except one ordinary HTTP request to read security headers, the same request any visitor's browser makes. There are no port scans, no probes and no login attempts; the one request appears in the access log like any other visitor's.
Active testing shows what an attacker can do. Passive recon shows what an attacker already knows before they try. Most teams should scan passively first, then scope active testing to what the scan surfaces.
No access of any kind. A root domain is all we need. We look at it the way any outside observer could.
The report is planned to include an asset inventory, a findings list ranked by severity and mapped to NIS2, DORA and ISO 27001, an executive summary PDF and a JSON export. Ask Dídac what the current version includes.
Scan a client's domain.
Send the domain and what the client needs to show their auditor. The request goes straight to Dídac.
- Email[email protected]
- Read byDídac, founder
- BasedBarcelona · serving the EU