Know your attack surface
before attackers do.
Real-time sensors on SSL certificates, DNS changes, data leaks, domain expiry and subdomain exposure. Get alerted the moment something changes.
No credit card required · Free plan includes 5 sensors · Setup in 60 seconds
2 min
DNS check interval
5 min
SSL check interval
5
sensor types
A–F
risk grade
Total sensors
12
OK
9
Warning
2
Critical
1
5 sensor types
Complete visibility,
one platform
Each sensor runs on a fixed schedule, detects anomalies and fires notifications automatically.
SSL Certificate
Monitor TLS version, cipher suites, expiry date, OCSP stapling and cert transparency. Alerts at 90/30/7 days before expiry.
DNS Records
Watch A, AAAA, MX, TXT, NS, CNAME and SOA records. Instant alert on any value change — DNS hijacking detected in minutes.
Data Leaks
Continuous scanning of credential databases and breach repositories. Notified the moment new records appear for your domain.
Domain Name
WHOIS expiry tracking and registrar monitoring. Never let a domain drop because you missed the renewal email.
Attack Surface
Subdomain discovery via certificate transparency logs (crt.sh) and passive DNS. Get alerted when new subdomains appear.
Instant Alerts
Email via AWS SES, Telegram bot and HTTPS webhooks (Slack, Teams, custom). One event triggers all your channels simultaneously.
Setup in 60 seconds
How it works
Add a sensor
Choose a sensor type, enter your domain or host. SurfaceWatch validates it and runs the first scan immediately.
Automatic scanning
Celery workers run checks on a fixed schedule — every 2 minutes for DNS, every 5 minutes for SSL. Zero configuration needed.
Get alerted
The moment an anomaly is detected, you receive an alert via Email, Telegram or your webhook. Act before it becomes an incident.
[2026-03-13 14:32:01] CRITICAL DNS A record changed on api.example.com
[2026-03-13 14:32:01] Previous: 203.0.113.10 → Current: 198.51.100.47
[2026-03-13 14:32:02] NOTIFY Email → [email protected] ✓
[2026-03-13 14:32:02] NOTIFY Telegram → @SOC_Team ✓
Your employees' credentials are leaking.
Know it before hackers act.
Every 30 minutes, SurfaceWatch scans breach databases and stealer log repositories for email/password pairs matching your domain. When a new credential appears, you get an instant alert — not a weekly digest.
-
Stealer logs & breach databases
Email + password pairs from infostealer malware, combo lists and known breach dumps.
-
Alert on new records only
No noise. SurfaceWatch only fires when a credential appears that wasn't there last scan.
-
Every 30 minutes
Faster detection window than any weekly report. Minutes matter when credentials are live.
Data Leak · acmecorp.com
Last scan: 4 minutes ago
47
total credentials
12
unique passwords
6
breach sources
j.martin@acmecorp.com
password: Acme2024! · Stealer log — Jan 2026
s.dupont@acmecorp.com
password: S3cur1ty# · Stealer log — Jan 2026
admin@acmecorp.com
password: •••••••• · LinkedIn 2024
p.bernard@acmecorp.com
password: •••••••• · Combo list 2023
SurfaceWatch Bot
🚨 2 new credentials leaked for acmecorp.com
j.martin@... · s.dupont@... · Stealer log Jan 2026
Simple pricing
Start free, scale when ready
All plans include the same check frequencies. Limits only apply to sensor count.
Free
Perfect to get started.
- ✓ 5 sensors
- ✓ All 5 sensor types
- ✓ Email notifications
- ✓ Telegram + webhooks
Pro
For security professionals and SMBs.
- ✓ 50 sensors
- ✓ All 5 sensor types
- ✓ Email + Telegram + webhooks
- ✓ Risk grade A–F per sensor
Business
For security teams and MSSPs.
- ✓ 200 sensors
- ✓ All 5 sensor types
- ✓ All notification channels
- ✓ PDF reports export
Enterprise — unlimited sensors
Custom limits, dedicated support, SLA and onboarding.
FAQ
Frequently asked questions
Start in 60 seconds
Know your attack surface.
React before it's too late.
Free plan. No credit card. 5 sensors ready to monitor.