What an attacker sees of your domain
Map everything about a domain that's exposed to the outside world, scored for risk.
No credit card needed.
What it solves
Security teams rarely know their organisation’s full external footprint, because subdomains, SaaS delegations and CDN dependents accumulate for years, often outside the team that provisioned them. Shrinking what’s reachable from the outside starts with a footprint nobody has to build by hand.
It starts from the domain and walks every DNS record, certificate-transparency log entry and delegation chain to find its subdomains, name servers and mail servers, then checks each one for dangling delegations, look-alike registrations and third-party dependencies, and looks for candidate origins behind any CDN or WAF.
Attack-surface mapping usually means running several separate tools and copying their output into one spreadsheet by hand, and the picture is stale again the moment a new subdomain goes live.
- a certificate-transparency log search tool
- a subdomain enumerator
- a WHOIS lookup tool
- a spreadsheet to track it all
What this means
- Give it a domain and it maps every subdomain, name server, mail server and third-party service tied to it.
- It returns a scored exposure picture crossing DNS, BGP, WHOIS, TLS and threat-intel layers, from the CDN edge down to candidate origin servers behind it.
Dig deeper
Read the how-to
What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.
Open the documentationWhy teams run this
The job this flow does, the failure mode it removes, and the proof it produces.
Security leadersRelated flows
All use casesThreat Investigation
The deep-dive you run when something looks bad and you need the full story. Give it one indicator and it works outward across its whole footprint (the related domains, the real servers behind any CDN, the neighbouring infrastructure) and checks each piece for known abuse. You get one coherent read on how dangerous it is and why, with safe next steps to pivot on. Reach for it when a quick check says 'look closer.'
Digital Infrastructure Mapping
Map the digital estate an indicator belongs to. Starting from any domain, IP, ASN or prefix, this works out the true owner (even behind privacy WHOIS and CDNs) via the atlas operator, the canonical registrant organization and the registrant email, then enumerates everything that owner owns: the subdomain namespace, the rest of its domain estate, the networks and prefixes that host it, and the facilities it physically sits at. Assets run by someone else (CDN, managed DNS, cloud) are marked as the vendor border, not owned.
Subdomain Takeover Detection
A dangling subdomain, one still pointing at a service you've since torn down, is an open door: anyone can re-register that service and speak as you. This walks a domain's subdomains and flags the ones aiming at deprovisioned targets, so you can reclaim or remove them before someone else does.