Instant external security scan of your own IP — qsa.sh
Skip to main content
External security scan of your own IP — from your terminal.
Run one command. qsa.sh runs a real external port and vulnerability scan of the public IP you’re connecting from — naabu, nmap and nuclei, streamed to your terminal in about 30 seconds. Nothing to install, nothing stored.
qsa.sh — live scan
Copy command
$ curl qsa.sh
Run that in your terminal for a live external scan — open ports, service versions, TLS posture and CVE checks, streamed as they’re found.
The terminal above is an illustration; the countdown and timings are condensed for display. The real scan gives you a full 15-second window to press Ctrl-C.
curl qsa.sh connects over plain HTTP; run curl https://qsa.sh to encrypt the scan.
Scans only the IP you connect from — the one shown in the warning before the scan starts. You must be authorized to scan it. Known CGNAT and mobile-carrier connections are refused, along with IPv6 and ones our data flags as a proxy, VPN, or Tor (best-effort, IPv4-only).
No black box: qsa.sh runs the same open-source tools you could install yourself — naabu, nmap + vulners and nuclei. See exactly what each tier runs →
See pricing →<br>How it works →
See it in action
Thirty seconds: one command, a real external scan of your own IP, streamed straight back to your terminal.
Your browser can’t play embedded video. Download the clip, or just run curl qsa.sh.
What qsa.sh does
Scans your own public IP only
qsa.sh only ever scans the address your request arrives from. There is no target field. You cannot point it at anyone else, and known CGNAT and carrier addresses are refused.
Runs from our infrastructure, not yours
The scan originates from our scanner nodes — an outside-in view of what the internet can see of your host. No agent, no install.
Live streaming results
Open ports, detected service and version, TLS posture and matched CVEs stream to your terminal as they’re found — the real output of naabu, nmap + vulners and nuclei.
Nothing stored, and time-bounded
Results are ephemeral — streamed to you and never written to disk. We keep only short-lived rate-limit counters. Every scan is hard-capped in duration and self-terminates; if you disconnect, we cancel as soon as the disconnect is detected.
How it works
You run curl qsa.sh — we detect your public IP from the connection and refuse it if it’s a known CGNAT or carrier range (or an IPv6 or detected proxy/VPN origin).
You get a 15-second window to abort with Ctrl-C before anything is scanned. Continuing past the window is your authorization confirmation — this pre-scan window is the real consent gate.
Our scanner nodes probe that IP and stream findings back live, under a hard time cap.
Full details on the How it works page →
Three depths, one command
The free scan is live now. Full and Deep follow.
Free — $0
See what the internet sees.
Live terminal stream, ~30 seconds. naabu top 1,000 ports, nmap + vulners, ~2,000 curated nuclei checks. Open ports, versions, severity counts and the top 3 findings in full.
Full — $5/mo
Complete surface coverage.
All 65,535 ports plus ~2,000 high-signal nuclei checks — every open port on your host, not just the common 1,000, returned async. Full finding list plus remediation guidance.
Deep — $7 one-time
Uncovers what the surface hides.
All 65,535 ports and the entire ~10,500-template nuclei set — all severities — plus our own custom templates: the raw firehose, ~13–16 minutes. Full report emailed to you.
See pricing →
Authorization required. By running the scan you confirm you are authorized to scan the target IP. Scanning an address you don’t control may be illegal in your jurisdiction. Connections from known carrier-grade NAT (CGNAT) or a mobile-carrier network — or from an address our data flags as an anonymizing proxy, VPN, or Tor — are refused outright, because no single user can be authorized for a whole shared gateway (this proxy/VPN/carrier detection is best-effort and IPv4-only); IPv6 origins are refused pending v6 reputation support (run curl -4 qsa.sh). By using qsa.sh you agree to the Terms of Service and Acceptable Use Policy.
Terms<br>Acceptable Use