External Security X-Ray: see in 30s what an attacker sees of your company
We launched a free tool that passively analyses your domain's external security posture: email spoofing, HTTPS, subdomains, ports, public breaches and look-alike domains. Grade A–F and a report to your inbox.
What an attacker sees before attacking
Every attack starts with reconnaissance. Before trying anything, an attacker looks at what your company exposes publicly: whether your email can be spoofed, whether the site is well configured, which subdomains and ports are live, whether there’s been a breach, and whether look-alike domains are already registered for phishing.
We built the External Security X-Ray so you see it first — free, in about 30 seconds, with no invasive testing. You enter your work email, we analyse its domain and send the grade and full report to your inbox.
What it checks
- Email & anti-spoofing: SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI. Without DMARC, someone can send email today impersonating your company — the classic path for payment fraud and phishing against your customers.
- Site, HTTPS & certificate: certificate validity, TLS version, redirect and security headers (HSTS, CSP, clickjacking protection, cookies).
- Exposed surface: subdomains from public certificate logs, ports and known vulnerabilities (passive data) and public API docs (Swagger/GraphQL).
- Brand & leaks: registered look-alike domains, exposed sensitive files, known public breaches and blocklist reputation.
- Leaked-data hunt: ready-made searches (Google and GitHub) for your team to verify.
Passive by design
The X-Ray looks at public information only — DNS, certificate and the home page’s HTTP headers. Nothing is executed, no port is forced, no data is changed.
This is only the surface
A passive scan won’t find logic flaws, access-control issues, API problems or sensitive data exposed inside the application. Those only surface in an authorised pentest.
Generate your free X-Ray now →
If the result is alarming, talk to us about a pentest.