Attack surface monitoring

See what you expose — before someone else does Subdomain discovery

For every domain you have verified, TasScan lists the subdomains it can find from public certificate transparency logs and a curated DNS wordlist. You review the results; nothing is scanned until you add a host as an asset and it is verified.

Request an invite Continuous monitoring

TasScan is invite-only right now. Request an invite and we will be in touch.

How it works

Discovery with consent built in

Sources

Certificate transparency logs and a short wordlist of common names resolved through public DNS resolvers, at a low rate. A discovery run never opens a connection to a discovered host and does not port-scan. An optional passive DNS provider can add history, but only when the platform operator has connected one; it is not configured by default.

Candidates, not assets

Discovered names are suggestions in a review table. Wildcards, names outside your domain and names that resolve to private addresses are filtered out. Nothing is scanned automatically.

Approval and verification

Add a host as an asset yourself. It then needs verification like any other asset, or you can approve it to inherit the verification of its verified parent domain, with an audit record.

On demand or on a schedule

Run discovery now or daily or weekly per domain, see what is new or no longer seen since the last run, and get a digest when new hosts appear.

Exposed services

Ports and services: only where you have authorized them

Open-port and service checks are separate from discovery. They run only for IP address assets that you added, verified and authorized, through the Deep or Custom scan profile, and never for hosts that were merely discovered.

Port check: TCP connects to a fixed list of common web, admin and database ports on a verified IP address, at a low rate. No credentials are tried.
Service identification is optional and off by default: when your authorization allows it, one read-only exchange per open port (a banner read, one HEAD request or a TLS handshake) produces a product guess with a confidence.
Passive DNS history is available only when the platform operator connects a provider; it is not configured by default.

Let's talk

Verify a domain, then discover its subdomains.

Add your domain, verify ownership and switch discovery on from the Attack Surface page.

TasScan is invite-only right now. Request an invite and we will be in touch.

Get started

Run a free check →Request an invite

We only scan assets you confirm you own.