About Mangudai
Mangudai (also written Mangudai Security or Mangudai ASM, at mangudai.io) is an external attack surface scanner for small teams. You enter a domain, and it shows what an attacker can see from the outside: subdomains, open ports, weak TLS, missing security headers, exposed files and email spoofing gaps, each with fix steps.
There is nothing to install and no agent to deploy. Reports can be exported as PDF in six languages, and a technical KVKK and GDPR pre-assessment is included. It is a technical check, not legal advice or a certification.
What it checks
Asset discovery
Finds subdomains, including forgotten ones, from certificate logs and passive sources.
Port and service audit
Checks which ports and services are reachable from the internet and flags risky exposures such as databases and remote desktop.
Security headers and cookies
Checks HSTS, Content-Security-Policy, frame and content-type protections, and cookie flags.
TLS inspection
Certificate validity and expiry, protocol versions, chain problems.
Email security
SPF and DMARC records and policies that decide whether your domain can be spoofed.
Exposed files
Looks for files that should not be public, such as environment files and repository folders.
Known vulnerabilities
Matches detected software versions against the NVD. Version matches from banners are shown as unverified, because distributions often patch without changing the version.
Active web checks
Web server and SQL injection heuristics. They run only on accounts that sign the authorization declaration for that scan, and never on anonymous demo scans.
Why the name
The Mangudai were Mongol cavalry archers who rode ahead of the main army to probe the enemy and find openings before the battle. The product does the same for your domain: it looks at your perimeter first, so you can fix weak points before someone else finds them.
Who builds it
Mangudai is built and run by Oktay Bilge, founder. Questions, bug reports and feedback go to support@mangudai.io.