What can an attacker reach from outside?
Enter your domain. We map your external attack surface from public sources, the sign-in pages anyone can find, your certificates and security headers, spoofable email and look-alike domains, and rank what to close first. About 30 seconds.
A Cloudflare human check runs in the background and only asks for a click when it has to.
Free · No sign-up · Public sources only · See plans and prices
Scanning
About 30 seconds. Every check reads public sources only, and each one appears here as it finishes.
Reading DNS, mail authentication, look-alikes, certificates and breach signals…
Your exposure snapshot
The sources these checks read did not answer during this scan. They are left out, not counted as clean, so there is no overall grade until they run. Scan again later, or monitor this domain and it is checked again on its own.
A free scan looks up your domain, not each person. It does not check which staff addresses turn up in other companies' breaches. Monitoring does, for every address you add.
Who it affects, and what to do.
Counted from malware logs and breach records for your domain. Nobody is named on this page: names go only to an inbox at your domain, in the full report.
Each check, and what it found.
A check that could not run says so. It is never counted as nothing found.
Where to start.
Ranked by what an attacker would use first, and what to change in your own DNS or accounts. The full report names the exact accounts, people and hosts.
How this could be used The usual way in, against what this scan saw
Select a stage to see what it is, and what breaks it.
What a free scan sees, and what monitoring adds.
This free scan
- Malware logs: your staff, your customers and outside services, counted
- Breaches of your own website
- Mail spoofing, look-alike domains, sign-in pages, web and certificate settings
- Leaders named on your site
Your domain only, once. Counts here; names and evidence in the full report.
With monitoring
- Every staff address checked against breach data, named, with what leaked
- Checked again on a schedule, with an alert when something new appears
- Every domain you add, its subdomains, and on Professional your leaders' addresses
- Each fix proved with a re-scan
Get the full report at your company inbox.
It names the people and accounts behind each finding, so we only send it to an address at the domain you scanned.
- Every finding, with the evidence behind it
- What breach and infostealer data shows for your domain
- How many leaders your pages name, and in which roles
- Every registered look-alike, with its mail and web status
- The record or setting that fixes each one, and what was not checked
One email with a private link to the report, which works for 14 days. Free scan results are deleted after 90 days. The domain's stolen-login counts (numbers only) are kept to show change over time. See our privacy notice.
Exposure changes every week. New look-alikes get registered and new leaks surface. Monitoring re-scans on a schedule, tells you what changed and proves each fix with a re-scan.
Your perimeter, the way an attacker enumerates it.
We read only what is already public, so you see what is exposed without anything being probed or touched.
What this finds
- Sign-in pages anyone can reach. VPN portals, webmail and admin logins under your domain, found through certificate transparency logs and public DNS.
- Web and certificate health. Expired or invalid certificates and the security headers a modern site is expected to send.
- How the perimeter gets attacked. Spoofable email, look-alike domains and leaked staff logins: the ways in once a door is found.
What it does not
- Port-scan or probe your servers. No traffic that tests or exploits anything. We read public records, never your systems.
- Log in or try a password. Nothing is installed and nothing signs in.
- Need access or a key. A domain is enough. The result names what is exposed and what to fix first.
Thirty seconds, then a plan.
No account, no agent, nothing installed. We read what anyone on the internet can already see, and what is already on sale.
Enter your domain.
Your company domain, or your work email and we take the domain from it.
Seven checks run at once.
DNS, certificate logs, your public pages, stealer logs and breach records. You watch each one finish.
See what it means.
A grade, what each check found, and the first things to fix, ranked by what an attacker would use first.
Then keep it fixed.
Monitoring checks again on a schedule, tells you what changed, and proves each fix with a re-scan.
Seven checks, and where each one looks.
Named, so you know what a clean result covers. Nothing here touches your systems.
| Check | What it looks at | Where it comes from |
|---|---|---|
| Leaked credentials | Staff computers caught by password-stealing malware, and breaches of your own website. | Hudson Rock's infostealer intelligence; Have I Been Pwned's list of breached sites |
| Email spoofing | Whether mail can be forged as your domain: SPF, DKIM and DMARC as published. | Your domain's public DNS |
| Look-alike domains | Registered near-copies of your name, and which of them can already send or receive mail. | Public DNS |
| Executive exposure | Leaders named on your public pages: the target list for CEO fraud. With monitoring, their addresses are checked against breach data. | Your own public web pages |
| Sign-in surface | VPN portals, webmail and admin logins anyone can find under your domain. | Certificate transparency logs and public DNS |
| Third parties | Who runs your DNS, who may send mail as you, and who sees your mail flow. | Public DNS records |
| Web and TLS | Certificate health and the security headers a modern site is expected to send. | Your website, as any browser sees it |
We read. We do not touch.
- Public sources only. Nothing is installed, nothing logs in, and no password is ever tried.
- Nobody at your company is contacted. The only email is the full report, and only if you ask for it at an address on your domain.
- Your result is yours. It opens at a private link that only you are given, and never shows the names behind a finding.
- Kept for 90 days. Then the result and its link are deleted. Scan again any time.
More in our privacy notice.
Questions, answered.
What is my attack surface?
How do you find exposed logins and servers?
Do you run a port scan or a vulnerability scan against my servers?
What do you report?
Is this attack surface management (ASM)?
What do I do with the result?
See your perimeter before an attacker maps it.
Find the exposed logins, weak certificates and spoofable email on your external surface, then close them first.