Surface Monitor: changes across your public footprint
Passive observations for verified domains, with sources, timestamps and follow-up.
From domain control to explainable comparisons
1. Establish control with a TXT record
Publish the exact record shown in the dashboard for that domain. This demonstrates technical control at that time; the scope requires your authorization. It does not automatically authorize subdomains or discovered names. Keep the record published for subsequent checks.
2. Observe permitted sources
Query published email DNS policies and bounded lookalike candidates as configured. If a fresh control check fails or becomes unknown, runs are paused and the last known evidence retains its timestamp.
3. Compare compatible evidence
The first observation establishes a baseline without change alerts. Later observations compare only fields with compatible scope and coverage. An error, truncated window or partial response does not establish that an asset disappeared.
Current service configuration
An enabled capability describes service configuration; it grants no account access and does not guarantee a source will respond. The dashboard checks project access, domain control, validity and budgets before each run.
Domain control through TXT
Checking…Email policies published in DNS
Checking…Bounded local lookalike generation
Checking…DNS observations for lookalike candidates
Checking…Manual runs
Checking…Scheduled runs
Checking…Compatible observation comparisons
Checking…ViciousByte evidence signature
Checking…Signed webhooks
Checking…Certificate Transparency observations
Provider authorization pending
What each observation means
DNS and email: reports describe SPF, DMARC and the DKIM selectors queried. A key absent from that set does not establish that the domain lacks DKIM; no email is sent and impersonation is not tested.
Lookalikes: a similar name that resolves is a candidate for review, not confirmed impersonation. Local generation and permitted DNS queries do not visit, capture or scan those sites.
Coverage: every source retains its timestamp, state and limits. No web crawling, port scanning or probing of the site or mail server takes place. An empty result does not establish absence of exposure.
A ViciousByte evidence signature, when configured, attests to the application report. It does not certify the provider, legal domain ownership or domain security.
Scope, scheduling and budgets
The dashboard shows applicable balance and usage before operation. Started attempts may consume credits even if a provider fails or cancellation is requested; requested cancellation remains pending until confirmed.
The published limits could not be confirmed. Review dashboard configuration; no available quotas, schedules or retention are assumed.
Privacy and retention
Projects belong to one account. Normalized observations and private comparisons are retained; website bodies and email inboxes are not archived. Queried public records may include published names and contacts.
DNS queries send queried names to the configured external resolver. That provider applies its own logging and data policies; absence of external logs is not promised. Review resolver privacy
Expiry or deletion blocks access and queues purging of observations, evidence and associated payloads. Physical purging is asynchronous; minimal quota and idempotency receipts follow separate retention.
The server may confirm project access through a compatible current investigation plan, a pilot grant or a paid Surface Monitor period. Purchasing Surface Monitor does not add credits to the global OSINT suite. An access request records interest pending review; it grants no permissions and starts no payment.
Plans and additional units
Prepaid 30-day base per project and service. Manual renewal after expiry; no automatic charges or automatic overage purchases.
Checking commercial terms…
Proposed pricing
A public view of a commercial proposal that has not been approved. These amounts are not available purchase offers and do not enable charges. Final terms may change after review.
Proposal dated October 25, 2026 · USD · base amounts exclude VAT (16%) · 30 days · manual renewal · no automatic chargesStarter
USD 19.00
40 investigation credits
Project base for one 30-day periodPro
USD 49.00
160 investigation credits
Project base for one 30-day periodBusiness
USD 99.00
400 investigation credits
Project base for one 30-day period40 investigation credits
USD 15.00 · Proposed · subject to review
120 investigation credits
USD 39.00 · Proposed · subject to review
400 investigation credits
USD 110.00 · Proposed · subject to review
Request pilot access
Register a Digital surface monitoring request for your account. This does not create a subscription, activate permissions or execute a payment.