About MAADD-Diligence traffic
If you found MAADD-Diligence in your logs, this page explains it.
What it is
Qualified Cyber performs external cybersecurity due diligence for mergers and acquisitions. Our tool, MAADD, looks at an organization's internet-facing systems the way an outsider would: public websites, DNS, email settings and certificates.
It is authorized
We only collect against systems named in a signed engagement, and only within its dates. Every request is checked against that authorization before it is sent, and every request is logged.
How to recognize it
Requests identify themselves honestly with this User-Agent:
MAADD-Diligence/<version> (+https://qualifiedcyber.com/scanning; engagement <name>; contact <address>)
The engagement name is a code name. Your organization's contact for the engagement will know it. We do not disguise or rotate this identifier.
How we behave
- Most collection is passive.
- Requests are paced slowly, one at a time per host.
- We honor
robots.txt, and we back off when a site says it is busy. - We never submit forms, log in or try passwords.
- More intrusive checks run only when the engagement explicitly allows them.
Lookups to public services
We also query public services such as certificate-transparency logs and vulnerability databases. Those requests carry only the version and this link, never an engagement name:
MAADD-Diligence/<version> (+https://qualifiedcyber.com/scanning)
Questions, or think it isn't authorized?
Email scanning@qualifiedcyber.com. Include the engagement name from the User-Agent, the source IP and the times you saw it. We will confirm the activity or stop it.
To report a security vulnerability in our own systems, see our security.txt.
Last updated: