Attack Surface Monitor discovers your internet-facing assets from your own server, the way an attacker sees you, and tells you what changed.

Features

• Passive discovery: subdomains via Certificate Transparency and DNS; keeps only assets that resolve
• Exposure checks: reachable databases (Postgres/MySQL/Mongo/Redis), open RDP/VNC/Telnet, full open-port inventory
• The daily diff: new subdomain or opened port = new finding; closed ones auto-resolve
• Honest coverage: a wildcard certificate hides subdomains from CT, and the report says so
• Every finding carries the fix; bursts become one digest
• Ownership gate: no probing until you prove control via DNS TXT or HTTP file

Server

• Linux x86-64; single binary or Docker; ~10 MB binary, ~10 MB RAM idle, SQLite — no database server
• Minimum host: 1 vCPU, 512 MB RAM, 200 MB disk
• Dashboard 127.0.0.1:8423; outbound DNS/HTTPS to CT logs and your own domains only

Tiers. Free: 1 domain, webhook + syslog alerts (GitHub). Pro: 10 domains, custom interval, scan-now, email/Slack/Telegram. Team: unlimited, PagerDuty/MS Teams, priority support. 14-day trial.

Wazuh/Splunk-ready, every tier: file, syslog JSON/CEF, Splunk HEC; free Wazuh rules + Splunk add-on on GitHub.

AI Assist (optional, offline): explains any finding on your hardware; the engine decides.

Delivery: key by Whop DM; files in Downloads.

Whop sells paid licences only. Free: github.com/nizartuanku/attack-surface-monitor