Subdomain Takeover Detection
Find subdomains that point at abandoned services an attacker could claim.
Free tier — no credit card. Runs up to 3 hops deep; Pro goes to 5.
Dig deeper
Key concepts
Read the how-to
What this workflow does and how it uses the graph, plus the copy-paste recipes it's built from.
Open the documentation →Related flows
All use cases →Attack-Surface Mapper
See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.
Certificate Transparency Asset Discovery
Every HTTPS certificate is logged publicly — and that log is a goldmine for finding assets you forgot you had. This surfaces a domain's certificates (wildcards included), when they first and last appeared, and the sibling hostnames issued alongside them. A clean way to uncover shadow assets and expansion no inventory captured.