Subdomain discovery & takeover
Find the subdomains you forgot before someone else does.
Subdomain takeover is mundane: marketing trials a hosted service on a subdomain, the account gets closed, and your domain keeps pointing at a name anyone can claim. Then someone does, and a real address under your brand serves their phishing page. Attack Surface Scan finds your subdomains continuously and flags the ones at risk while they're still just a cleanup task. Need a one-off check first? Try the free subdomain takeover checker.
No card required to start. Plans from $25/month, flat; first report in minutes.
How takeovers actually happen
The vendor outlives the setting
A team trials a platform, the trial ends, the subdomain still points there. Months later the account name is claimable by whoever asks, and your subdomain serves whatever they put there.
Discovery favors the attacker
Every certificate ever issued for a subdomain is in public records. Attackers work through them systematically; most owners have never looked.
A takeover inherits your name
Content on a real subdomain of your domain passes casual inspection, carries convincing phishing, and in some setups can interfere with sign-ins to your main site. The reputational cost is yours.
Test systems never got retired
Preview sites and test servers get certificates too. They're part of what you expose whether or not they're in your inventory.
What changes with Attack Surface Scan
The same discovery, working for you
Continuous subdomain discovery from public certificate records (read every 15 minutes), your domain's own published settings, web archives and more: the attacker's sources, pointed at your own estate. Discovery sources →
At-risk subdomains flagged explicitly
A subdomain pointing at a hosted service that no longer exists is raised as a high severity finding with the evidence and the fix, so cleanup is a ticket rather than a hunt.
Alerts on every new name
A subdomain nobody told you about is worth hearing about the hour it appears, not during an incident. How takeover works, in plain language →
Discovered systems join the watch
Found subdomains are added to monitoring automatically, up to your plan's limit and with an exclusion list, and get the same checks as everything else, so a forgotten system can't stay both forgotten and unmonitored.
What you can show
A complete subdomain inventory
Every subdomain found, where it is hosted, and when it appeared or disappeared, exportable to a spreadsheet for your asset register or a client report.
A cleanup record
Each at-risk subdomain, when it was flagged and when it was fixed, kept in the change history: a concrete answer when a board, insurer or client asks how you manage forgotten systems.
Common questions
What is a subdomain takeover?
A subdomain takeover happens when one of your subdomains points at an outside service (a hosting platform, a storage account, a marketing tool) that no longer hosts your content, and an attacker claims that service name. Your subdomain then serves the attacker's content with your domain in the address bar. It's prevented by removing or repointing stale settings, which requires knowing they exist.
Where does Attack Surface Scan's subdomain list come from?
From public sources: the public logs of every certificate issued (read every 15 minutes), your domain's own published settings, web archives, links on your pages, and a short list of common names looked up in public records. It only looks names up; it never attacks your systems to find them, and discovery only runs for domains you've verified you own. The full list is in the documentation.
Can Attack Surface Scan take down a hijacked subdomain?
No. The fix is a change to your domain's settings that only you can make. What Attack Surface Scan does is make the window small: at-risk subdomains are flagged while they're still unclaimed, and new subdomains are alerted as they appear.
See your domain the way an attacker enumerates it.
Verify ownership and discovery starts with the first check.
Start your 7-day trialNo card required to start. Cancel any time.