SurfaceDiff
Sign inFree scan
free, no card required

See what's publicly exposed on your domain.

A free baseline scan - subdomains, DNS, ports, TLS, web services - then daily monitoring with alerts included, free, no card required, for as long as you want it.

Step 1 of 2

Prove you control the domain (DNS record, file, or meta tag - about 2 minutes), then we run a real scan and email you everything we found. Create a free account to see every finding in full detail plus ongoing monitoring and signed evidence packs. No card required.

Example finding and incident, one of our own monitored domains - domain name, hostnames and IP addresses redacted, rendered with the same components you'd see in your own dashboard

Open ports (1)1 to review

Group in RPC
mail.[redacted]203.0.113.421 port
22/tcp
Needs review		ssh OpenSSH 9.9 - protocol 2.0-

Web services (1)1 to review

https://webmail.[redacted]
Needs review		200 - Roundcube Webmail - Apache
KEV: CVE-2017-16651KEV: CVE-2025-68461 (unverified)
-
SeverityType / title
medium
TLS certificate chain untrusted: webmail.[redacted]:443
TLS_CHAIN_UNTRUSTED