Attack Surface lists hosts found under your verified domains from public certificate transparency logs and a short DNS wordlist. Run discovery on demand, or schedule it daily or weekly per domain. New hosts appear for review and a digest notification tells you when there are new ones.
What you can do with a host
- Add as asset turns it into a subdomain asset. It is not scanned until it is verified; you can also approve it to inherit the verification of its verified parent domain.
- Dismiss hides it on later runs. Restore brings it back.
Good to know
- Wildcard names, names outside your domain and names that resolve to private addresses are never suggested.
- Discovery never scans or connects to the hosts it finds and does not port-scan. A discovered address is not authorized for scanning. To check an address's open ports, add it as an IP asset, verify it and accept the authorization for it.
- Each candidate shows a confidence (high: independent sources; medium: one reliable source; low: only in history), its sources and a status: New, Changed (addresses or CNAME target differ from the last run) or No longer seen. A change is a fact to review, not a verdict.
- Passive DNS history is shown only when the platform has such a provider connected; otherwise the card says "Not configured".