SHELLZERO

SHELLZEROAutonomous AI Cyber Defense Network

When the Internet Goes Dark,
We Stay Online.

Enter a domain and SHELLZERO grades its SSL/TLS setup and security headers, looks up known vulnerabilities for every software version your server reveals, and checks whether anyone can send email in your name. It reads only what your site already shows the internet.

Scan your websiteSee what gets checked

CISA KEV catalog

1,756
confirmed as exploited
30
added in the last 30 days

Every scan checks the software it finds against this list.

  • SSL/TLS gradeA+ to F, with the reason for every point lost
  • 12 header checksCSP, HSTS, framing, cookies, version leaks
  • Known CVEsExposed versions matched to NVD, OSV, CISA KEV
  • Email spoofingSPF, DMARC, DKIM, and DNSSEC status
  • Telegram alertsSent when a scan finds something serious

What a scan looks at

SHELLZERO reads what your site already shows anyone on the internet. It does not log in, fill forms, or send exploit payloads, so you can scan a domain before proving you own it.

Deeper tests need proof of ownership

Add a DNS TXT record or a small file to your site. Verified owners get HTTP probing of their subdomains today, and active tests when they ship in Phase 2.

  1. 01

    SSL/TLS

    Certificate trust and expiry, hostname match, key size, which TLS versions the server still accepts, and HSTS.

    e.g. TLS 1.0 still enabled

  2. 02

    Security headers

    Twelve response headers that stop clickjacking, script injection, MIME sniffing, and version leaks.

    e.g. Missing Content-Security-Policy

  3. 03

    Technology and CVEs

    Server software, frameworks, and JavaScript libraries with versions, matched to published vulnerabilities.

    e.g. jQuery 3.4.1 has 2 known CVEs

  4. 04

    DNS and email

    SPF, DMARC, and DKIM records that decide whether someone can send mail as your domain, plus CAA and DNSSEC.

    e.g. No DMARC record

  5. 05

    Subdomains

    Names pulled from public certificate logs, and the ones pointing at a cloud service that no longer exists.

    e.g. Possible subdomain takeover

  6. 06

    Blacklist

    Whether threat-blocking DNS resolvers already treat your domain as malicious.

    e.g. Listed by Quad9

  7. 07

    Reachability

    Redirect chain, HTTP to HTTPS redirect, response time, IP owner, and the CDN or WAF in front of the site.

    e.g. No redirect from HTTP to HTTPS

Concept render of the threat map. The numbers in it are placeholders; the live map in the dashboard uses public data from CISA, Spamhaus, and abuse.ch.

Five agents, two of them running

Sentinel rescans verified sites on a schedule and reports what changed. Hunter rechecks the software found on them whenever CISA confirms a new exploited vulnerability. Guardian, Patch, and Chain are still in development. Each one prepares the work; nothing touches your servers or firewall until you approve it.

Status: 2 of 5 running

  • SHELL-01

    Running

    Sentinel

    Rescans your verified assets on a schedule and reports what changed: new findings, certificate expiry, blacklist status, and software versions.

  • SHELL-02

    Running

    Hunter

    Rechecks the software found on your assets each time CISA confirms a newly exploited vulnerability, and alerts when an asset's IP shows up on a botnet or hijacked-network list.

  • SHELL-03

    In development

    Guardian

    Drafts firewall and WAF rules that only apply after you approve them.

  • SHELL-04

    In development

    Patch

    Writes the fix for each finding as steps and config snippets for your stack.

  • SHELL-05

    In development

    Chain

    Watches smart contracts and wallets tied to your Web3 projects.

Where SHELLZERO is today

Scanning shipped first because every later phase builds on what it finds. Monitoring is rolling out now, one part at a time.

  1. Phase 1

    Live now

    Scan

    • Passive website scanner
    • SSL/TLS and header grades
    • CVE matching for exposed versions
    • DNS, email, subdomain, and blacklist checks
    • Ownership verification
    • Printable reports and Telegram alerts

  2. Phase 2

    In progress

    Monitor

    • Scheduled rescans with change alerts
    • Alerts when a CVE on your site becomes actively exploited
    • Threat map from public threat feeds
    • Server monitoring
    • Guardian, Patch, and Chain agents
    • Active tests for verified owners

  3. Phase 3

    Planned

    Defend and patch

    • WAF rules you approve
    • Guided patching
    • Incident playbooks

  4. Phase 4

    Planned

    Web3 shield

    • Smart contract monitoring
    • Wallet activity alerts

See what your site shows the internet

Create an account, enter your domain, and read the results while the scan runs.

Scan your websiteSign in