The NO PASE scanner
NO PASE maps an organisation's public internet exposure for that organisation: the names, services, certificates and technologies anyone on the internet can already see. If you found NO PASE in your logs, this page says what it did.
How to recognise it
NOPASE-Scanner/3.0: the main scannerNO-PASE-Scanner/1.0, NO-PASE-Probe/1.0: screenshots of public web pagesNOPASE-Fingerprint/1.0: one public version file of a detected technologyNOPASE-SIEMS-Probe/1.0: detection of exposed monitoring consolesNOPASE-DanglingCheck/1.0: dangling DNS recordsNOPASE-Validator/1.0: a domain owner proving control of their own website
Screenshots are taken with headless Chromium, which sends Chromium's own User-Agent.
What it does
- Resolves the domain's names and finds others in public certificate logs and subdomain sources.
- Connects to a short list of common ports (22, 80, 443, 8080, 8443) and reads what answers: web pages, TLS certificates, service banners. Monitored domains get a wider list of common service ports.
- Requests the home page of each web service, a few public version files and common GraphQL endpoints, and takes a screenshot of public pages.
It sends no exploit, tries no password and submits no form.
Questions or unwanted traffic
Write to pase@nopase.com with the address and the time you saw, so we can look into it.