What it is
AFS-Scanner is the monitoring engine behind Attack Surface Scan, an external attack surface monitoring service operated by Instant City Solutions LLC (Miami, FL). It checks websites and internet-facing services for configuration and security problems on behalf of the organization that owns them.
Why it visited you
The scanner only visits hosts under a domain whose owner has proven control to us: a DNS TXT record, a file on the website, a work email at the domain, or an approval from someone with a mailbox at the domain. If it visited you, someone at your organization (or a provider acting for it, such as an MSP) set that up.
What it does and does not do
It makes ordinary page requests, TLS handshakes, DNS lookups and TCP connections, and reads what your servers return. It never attempts logins, sends exploits, submits forms or load-tests. The full list is on How scanning works.
Did not authorize this?
Email security@attacksurfacescan.com with the domain, the times and the source IPs from your logs. We will check which account verified the domain and how, and suspend scanning while we investigate. Scanning a domain without authorization is a breach of our terms. General questions go to support@attacksurfacescan.com.