How QROS Explore works
Three steps: search a target, QROS maps what it exposes, and you open the host dossier with its full exposure context. Free, no login.
Search or paste a target
Type a query like country:ES port:443, a CVE id, a product, an IP or a domain. Faceted search narrows across ports, services, products, countries and CVEs.
QROS maps the public surface
The crawler and on-demand workers probe only what the host exposes — open ports, banners and certificates — exactly as any network client would. No exploitation.
Open the host dossier
Click any host for a full dossier: ports, software, CVEs with CVSS, TLS certificate, web technologies, geo location and a risk score.
Search syntax
country:ESfilter by country (ISO code).port:443open port.service:sshservice (ssh, http, tls, ftp, dns…).product:nginxdetected product/software.cve:CVE-2021-44228hosts with that vulnerable version (or paste the bare CVE id).vuln:criticalworst vulnerability severity (critical/high/medium/low).hascert:truehosts presenting a TLS certificate.ip:1.2.3.0/24restrict to a host or range (or paste a bare IP).Bare terms match product, service, organisation, domain or technology. Try Explore now — free, no login.
FAQ
Is QROS Explore really free?
Yes. The search engine and per-host dossiers are public and require no sign-in. QROS charges for the authenticated platform: guided scans, quantum-readiness reports, certificate tooling and hardening playbooks.
How is this different from Shodan or Censys?
Same operating principle — indexing what hosts publish to every connecting client — but open and transparent, with on-demand scanning, CVE attribution and a quantum-readiness angle the others don't offer.
Is scanning legal?
Yes. QROS only reads what a host exposes to any client: open ports, banners and certificates. It does not bypass security measures, authenticate, exploit or access personal data. See the legal notice for the full analysis under the Spanish Criminal Code and European law.
Can I search by CVE?
Yes. Search `cve:CVE-2021-44228` or just paste the CVE id to find every indexed host running that vulnerable version, and filter by severity with `vuln:critical`.
Does it detect a website's technology?
Yes. When a port serves a web page, QROS identifies the stack — server, framework, CMS and JS libraries (WordPress, Magento, Next.js, React, Vue, Drupal) — and attributes its CVEs by version.
My host is not in the index. What now?
Search its IP or domain. If QROS has not indexed it, a scan task is enqueued and the host appears in a few minutes.
How do I remove my host?
Any network operator can request removal by writing to support@qros.dev from a verifiable address of the network owner. The record is removed as soon as possible. See the legal notice.
Start your cryptographic risk assessment with QROS
Explore now →