Free tool
Free attack surface scanner
This free attack surface scanner maps a domain's external footprint in seconds: every subdomain named in certificate transparency logs, every unexpired certificate and the CA that issued it, which hosts still resolve, and which point at third-party hosting. Passive only: it reads public records and never touches the hosts it finds.
This tool runs entirely in your browser. Certificate lookups go straight to Cert Spotter's public certificate transparency API, and DNS questions to Cloudflare's (or Google's) public DNS-over-HTTPS resolver. Nothing you type reaches Attack Surface Scan's servers, and the tool never connects to the domain or any host it discovers. The free CT API allows only a few lookups per hour from each network.
What is an external attack surface scan?
An external attack surface scan inventories everything an outsider can see of your organization on the internet: domains, subdomains, certificates, exposed services and the DNS that ties them together. It answers the first question of any security program, "what do we actually have out there?", from the attacker's side of the firewall rather than from an asset spreadsheet.
The answer is almost always longer than the spreadsheet. Staging sites, old marketing campaigns, vendor-hosted help centers and forgotten API hosts all get certificates, and every certificate is published. That makes attack surface mapping from certificate transparency one of the fastest ways to find what you forgot you own, and it is exactly what this attack surface mapping tool does. For the bigger picture, see what external attack surface management is.
Attack surface scanning: this free scan vs. continuous monitoring
This attack surface discovery tool (part subdomain finder, part certificate discovery tool) gives you a point-in-time map from public records. Continuous monitoring keeps that map current and adds the checks that need a verified owner.
| Check | This free scanner | Attack Surface Scan monitoring |
|---|---|---|
| Subdomain discovery from CT logs | Yes once, first 3 pages | Yes every 15 minutes, new hosts added to monitoring |
| Certificate inventory and issuing CAs | Yes | Yes plus an authorized-CA list and unknown-certificate queue |
| DNS resolution and third-party hosting | Yes | Yes with change alerts |
| Served-certificate and expiry probes | No | Yes daily or every 6 hours, stalled-renewal detection |
| Exposed services and open ports | No | Yes |
| HTTP security headers | No | Yes |
| Email authentication (SPF, DMARC, MTA-STS, TLS-RPT, CAA) | Separate tool SPF & DMARC checker | Yes with change alerts |
| Lookalike and typosquat domains | No | Yes DNS and CT based |
| Alerts and dated PDF reports | No | Yes critical changes immediately, the rest weekly |
Neither this tool nor the product does authenticated CVE scanning or active web application testing.
Why a passive attack surface analyzer starts with certificate transparency
Certificate transparency is the most complete public record of a domain's HTTPS hosts, because browsers refuse certificates that weren't logged. Every CA has to publish every certificate it issues, so the logs capture hosts that no DNS brute-force wordlist would guess, and they do it without a single probe against your infrastructure.
Passive discovery also means the tool is safe to point at any domain: it reads the same public logs and DNS any browser does. The same logs are how you catch a certificate you didn't request, which is why an unexpected CA in the summary above is worth a look. Certificate discovery and a CAA record together close that gap.
Questions
What is an attack surface scanner?
An attack surface scanner finds the internet-facing assets that belong to a domain: subdomains, the certificates they use, where they're hosted, and what is exposed on them. This free scanner does the discovery half passively, from certificate transparency logs and public DNS, without sending a packet to the hosts it finds.
How does this subdomain finder discover hostnames?
Every publicly trusted TLS certificate is logged in certificate transparency (CT) logs, and each certificate lists the hostnames it covers. The scanner reads those logs for your domain through Cert Spotter's public API and collects every hostname named. Hosts that only ever used a wildcard certificate, or never used HTTPS, won't appear.
Is this a crt.sh alternative?
For this job, yes. crt.sh is a fine search interface for CT logs, but it doesn't allow browser requests from other sites and returns raw rows. This tool reads the same kind of CT data via Cert Spotter, deduplicates it into a hostname and certificate inventory, then checks which hosts still resolve and which point at third-party hosting.
Is it legal to scan a domain I don't own?
This tool only reads public records: certificate transparency logs and DNS, the same data any browser or mail server looks up. It never connects to the discovered hosts. Active scanning (ports, headers, TLS probes) is a different matter, which is why Attack Surface Scan only runs those checks on domains you've verified you control.
Why are some certificates or subdomains missing?
The scan shows unexpired certificates only, reads a limited number of result pages, and is subject to the CT API's small free hourly quota. Internal hostnames that never received a public certificate are invisible to CT by design. Continuous monitoring reads every new certificate as it's logged, so nothing added later slips by.
Checked once. Now have it watched.
This scan is a snapshot. Attack Surface Scan reads certificate transparency every 15 minutes, adds newly discovered subdomains to monitoring automatically, and checks each one for open ports, TLS and certificate health, security headers and DNS changes, alerting you when something new appears.
7-day trial of the full product, no card required. Scanning needs domain ownership verified (DNS record, site file, work email or emailed approval): Attack Surface Scan never scans anything you haven't proved you control.