Blog

Notes on attack surface monitoring - from how we build it to real incidents we've caught.

23 July 2026 · 5 min read

How to Monitor for New Open Ports on Your Domain

Learn how to monitor open ports with nmap, scheduled scans and diffs, and how to detect new public exposure automatically.

23 July 2026 · 4 min read

A Real Incident: Getting Proof That a Port Closure Actually Worked

A walkthrough of a real incident from our own monitored infrastructure - not just catching a change, but having timestamped evidence that a fix actually took effect.

23 July 2026 · 4 min read

How to Get Alerted When a New Subdomain Appears

Forgotten staging subdomains and unreviewed marketing microsites are how attack surfaces grow quietly. The DIY approach with subfinder/amass, and where it runs out of road.

23 July 2026 · 4 min read

SSL Certificate Expiry Monitoring: Free Scripts vs Automated Tools

A simple cron script genuinely solves expiry countdowns. Here's that script, plus how SurfaceDiff covers the same warning across your whole surface - and the change-detection a script can't do.

24 July 2026 · 6 min read

A Real Incident: How Service Fingerprinting Triggered a fail2ban Ban

We wanted to identify what's actually running on an open port, not just that it's open. Here's how that feature tripped a real fail2ban jail on our own infrastructure, and the queue-based design that fixed it for good.

27 July 2026 · 4 min read

Website Change Detection for Security Monitoring: What It Actually Needs to Catch

Most "website change detection" tools watch for edits to a page's visible text. Security-relevant change detection is a different job entirely - here's what it needs to cover, and why uptime monitoring doesn't cover it either.