What is the Noroshi scanner?

What the scanner is

Noroshi provides continuous external security monitoring for European organisations and SMEs. Our scanner periodically checks the external posture of domains registered with our service: HTTP response headers, reachability of the website, DNS records used for e-mail authentication, and publicly available DNS and WHOIS data related to the domain.

The scanner performs non-intrusive observations only. It does not run penetration tests, exploit payloads, credential attempts or any kind of attack. It behaves like a regular browser visitor at a modest, respectful frequency.

How the scanner identifies itself

All Noroshi scanner requests identify themselves with this user-agent string:

NoroshiScanner/1.0 (+https://noroshi.eu/scanning)

If you see requests with this user-agent, they are ours. Our infrastructure is operated entirely within the EU, and every request originates from systems we own and monitor.

Why it visited your site

The operator of that domain is a Noroshi customer who has added it to their monitoring account. Deep scans only run on domains where the customer has proven ownership by publishing a DNS TXT record containing noroshi-verification=… . If a domain in our service fails verification, we stop deep scans on it.

Questions or concerns

If you believe the scanner is misbehaving, or you are a hosting provider with a question, contact us at info@noroshi.eu . We respond to every report.