Scans your own public IP only
qsa.sh only ever scans the address your request arrives from. There is no target field. You cannot point it at anyone else, and known CGNAT and carrier addresses are refused.
Run one command. qsa.sh runs a real external port and vulnerability scan of the public IP you’re connecting from — naabu, nmap and nuclei, streamed to your terminal in about 30 seconds. Nothing to install, nothing stored.
The terminal above is an illustration; the countdown and timings are condensed for display. The real scan gives you a full 15-second window to press Ctrl-C.
curl qsa.sh connects over plain HTTP; run curl https://qsa.sh to encrypt the scan.
Scans only the IP you connect from — the one shown in the warning before the scan starts. You must be authorized to scan it. Known CGNAT and mobile-carrier connections are refused, along with IPv6 and ones our data flags as a proxy, VPN, or Tor (best-effort, IPv4-only).
No black box: qsa.sh runs the same open-source tools you could install yourself — naabu, nmap + vulners and nuclei. See exactly what each tier runs →
See it in action
Thirty seconds: one command, a real external scan of your own IP, streamed straight back to your terminal.
Runs from our infrastructure, not yours
The scan originates from our scanner nodes — an outside-in view of what the internet can see of your host. No agent, no install.
Live streaming results
Open ports, detected service and version, TLS posture and matched CVEs stream to your terminal as they’re found — the real output of naabu, nmap + vulners and nuclei.
Nothing stored, and time-bounded
Results are ephemeral — streamed to you and never written to disk. We keep only short-lived rate-limit counters. Every scan is hard-capped in duration and self-terminates; if you disconnect, we cancel as soon as the disconnect is detected.
How it works
- You run
curl qsa.sh— we detect your public IP from the connection and refuse it if it’s a known CGNAT or carrier range (or an IPv6 or detected proxy/VPN origin). - You get a 15-second window to abort with Ctrl-C before anything is scanned. Continuing past the window is your authorization confirmation — this pre-scan window is the real consent gate.
- Our scanner nodes probe that IP and stream findings back live, under a hard time cap.
Three depths, one command
The free scan is live now. Full and Deep follow.
Free — $0
See what the internet sees.
Live terminal stream, ~30 seconds. naabu top 1,000 ports, nmap + vulners, ~2,000 curated nuclei checks. Open ports, versions, severity counts and the top 3 findings in full.
Full — $5/mo
Complete surface coverage.
All 65,535 ports plus ~2,000 high-signal nuclei checks — every open port on your host, not just the common 1,000, returned async. Full finding list plus remediation guidance.
Deep — $7 one-time
Uncovers what the surface hides.
All 65,535 ports and the entire ~10,500-template nuclei set — all severities — plus our own custom templates: the raw firehose, ~13–16 minutes. Full report emailed to you.