Attack Surface Monitor discovers your internet-facing assets from your own server, the way an attacker sees you, and tells you what changed.

Features

• Passive discovery: subdomains via Certificate Transparency and DNS; keeps only assets that resolve
• Exposure checks: reachable databases (Postgres/MySQL/Mongo/Redis), open RDP/VNC/Telnet, full open-port inventory
• The daily diff: new subdomain or opened port = new finding; closed ones auto-resolve
• Honest coverage: a wildcard certificate hides subdomains from CT — the report says so instead of calling a small number the whole surface
• Every finding carries the fix; bursts become one digest
• Ownership gate: no probing until you prove control via DNS TXT or HTTP file

Server requirements

• Linux x86-64; single binary or Docker; ~10 MB binary, ~10 MB RAM idle, SQLite — no database server
• Minimum host: 1 vCPU, 512 MB RAM, 200 MB disk
• Dashboard 127.0.0.1:8423; outbound DNS/HTTPS to CT logs and your own domains only

Tiers. Free: 1 domain, webhook + syslog alerts (GitHub). Pro: 10 domains, custom interval, scan-now, email/Slack/Telegram. Team: unlimited, PagerDuty/MS Teams, priority support. 14-day trial.

Offline activation, no phone-home.

AI Assist (optional, offline): Explain any finding on your own hardware; the engine still decides.

Delivery. Key by Whop DM; download in the Downloads tab.

Whop sells paid licences only. Free: github.com/nizartuanku/attack-surface-monitor