didroot Request a scan

See your client's domain the way an attacker does.

Built from public records and one ordinary request, with every finding mapped to NIS2, DORA and ISO 27001.

Request a scan How it works
Barcelona · serving the EU Founder-led
Recon report example-client.eu Synthetic example
Hosts reviewed
5
Findings
4
Public sources
47
Frameworks
3
vpn.example-client.eu
Read
Remote-access login page
Source
CT log + public DNS
State
Inferred
Maps to
DORA Art. 9
Synthetic example · not a real client
  • 47 public data sourcesCertificate logs, DNS, registries
  • One ordinary requestTo read HTTP security headers
  • No port scans or probesNothing a WAF flags as an attack
  • Mapped to regulationNIS2, DORA, ISO/IEC 27001

The same picture, without probing the client.

Most scanners send probes at the client's hosts to see what answers. didroot assembles the same picture from records that are already published, so the client's servers see nothing beyond one ordinary visit.

Active scanner

Thousands of probes against the exposed hosts. The client's WAF, SIEM and security team all see them arrive.

  • Touches servers
  • Fills logs
  • Triggers alerts

didroot

Certificate logs, DNS and registries already describe the domain. We read those, plus one ordinary HTTP request, the same one any visitor makes.

  • Public records
  • One ordinary request
  • Reads as one visitor

Every scan runs the same six passes.

Six passes over public sources, always in this order. Each pass adds to the same map of the domain, and every result keeps a record of where it came from.

A map of the synthetic domain example-client.eu being built one pass at a time. example-client.eu wwwmailvpnstagingapi NS ×2 · DNSSEC off SPF ~all · DMARC none cert9 days Headers C · no CSP NIS2 Art. 21ISO A.8DORA Art. 9 Synthetic example

Discover subdomains in certificate logs

Every TLS certificate issued for a domain is published in Certificate Transparency logs. Reading them maps every subdomain that has ever carried a publicly logged certificate, including the forgotten ones.

ResultSubdomain inventoryPass 1 of 6
Auto-play passes
Observed

Read directly from a public record: a DNS answer, a certificate, a header.

Inferred

Deduced by combining records, and labelled so the client knows it is a deduction.

Mapped

Scored, deduplicated and tied to the regulation articles it relates to.

Eight signal layers from 47 public data sources.

Each layer appears in the client's report with the record behind it.

LayerWhat it readsExample finding

Subdomains

Every name that has carried a publicly logged certificate, via Certificate Transparency.

17 subdomains

DNS

A, AAAA, MX, NS, CAA and DNSSEC from public resolvers.

NS ×2 · DNSSEC off

Mail authentication

SPF, DMARC and DKIM selectors: can the domain be impersonated?

DMARC p=none

TLS

Validity, expiry, protocol and chain from the published certificate.

Cert expires in 9 days

HTTP headers

Seven security headers from one ordinary request, graded A to F.

Grade C · no CSP

WAF / CDN

Which provider fronts each host, fingerprinted from public answers.

Cloudflare in front

Hosting

ASN, geolocation and cloud provider for every resolved address.

AS13335 · EU

Extras

RPKI, DANE, BIMI, security.txt and CORS policy.

No security.txt

Example findings are synthetic.

Findings mapped to EU regulation.

Every finding is tagged with the framework articles it relates to, so the report your client receives doubles as evidence for their auditor.

staging.example-client.euMedium
Read
TLS certificate expires in 9 days
Source
Certificate Transparency log
State
Mapped
Maps to
NIS2 Art. 21ISO/IEC 27001 A.8
Synthetic example

The mapping is evidence for an auditor, not a certificate of compliance.

NIS2

Network & Information Security Directive 2

Art. 21Cybersecurity risk-management measures

DORA

Digital Operational Resilience Act

Art. 8Identification

Art. 9Protection and prevention

ISO

ISO/IEC 27001:2022

Annex A.8Technological controls

What you can order today, and what is planned.

Passive reconnaissance is available now, by request. Monitoring and credential exposure are planned and not yet available.

Available

Passive reconnaissance

A full external review of one domain: DNS, mail, TLS, headers, subdomains, hosting and WAF, with findings mapped to regulation.

Planned

Surface monitoring

Repeated passive scans with alerts when a client's perimeter changes.

Planned

Credential exposure

Targeted monitoring of breach corpora and paste sites.

What you can rely on.

  • No probing

    Public sources and one ordinary request, which lands in the client's access log like any other visitor.

  • Founder-led

    Designed and reviewed by Dídac in Barcelona. No outsourcing.

  • Inspectable

    Every finding names the public source it came from and the state it is in.

Common questions

Almost. Everything comes from third-party public sources except one ordinary HTTP request to read security headers, the same request any visitor's browser makes. There are no port scans, no probes and no login attempts; the one request appears in the access log like any other visitor's.

Active testing shows what an attacker can do. Passive recon shows what an attacker already knows before they try. Most teams should scan passively first, then scope active testing to what the scan surfaces.

No access of any kind. A root domain is all we need. We look at it the way any outside observer could.

The report is planned to include an asset inventory, a findings list ranked by severity and mapped to NIS2, DORA and ISO 27001, an executive summary PDF and a JSON export. Ask Dídac what the current version includes.

Scan a client's domain.

Send the domain and what the client needs to show their auditor. The request goes straight to Dídac.

Request a scan