External exposure check

See what the outside
world sees.

We map your public attack surface using public data only — DNS, certificate transparency logs, and ordinary HTTPS responses. No load on your systems, no intrusive testing. You get a clear, evidence-backed report.

Request a free check See the report
  • 3 business days
  • Public data only
  • Non-intrusive
42checks per domain
18hosts reviewed
2high-risk findings
3.2minreport generation

01 / Dashboard

Findings you can read, not decode.

Every issue is ranked by severity, backed by evidence, and paired with a practical next step. Below are anonymised, synthetic examples.

SAMPLE 0118 hosts

E-commerce · 50–100 staff

High 2Medium 3Low 6Info 4

Top findingPHP 7.4 is end-of-life

View report →
SAMPLE 0234 hosts

SaaS · 100–300 staff

High 1Medium 5Low 8Info 6

Top findingStaging environment left public

View report →
SAMPLE 0326 hosts

Manufacturing · 300–1000 staff

High 0Medium 2Low 9Info 3

Top findingLegacy TLS 1.0 still enabled

View report →

Industry, size and host counts are anonymised synthetic data, not real client records.

See all report examples →

Report example — report.example anonymised sample
High2
Medium3
Low6
Info4
CheckLayerResultDetail
DNS / NS / MXpassiveOK2 NS, 1 MX
SPF / DMARC / DKIMpassiveCHECKDMARC missing
Certificate transparencypassiveOK11 subdomains
Subdomain discoverypassiveOK18 hosts
TLS / certificatelightOKTLS 1.3
Security headerslightCHECKNo CSP
CMS / plugin versionslightHIGHPHP EOL
Archived exposurepassiveOK0 risky URLs
HighPHP 7.4 is end-of-life

ImpactNo security fixes have been provided since 2022-11-28.

ActionUpgrade to a supported release and remove unused extensions.

MediumDMARC record missing

ImpactReceivers cannot evaluate spoofing, leaving room for brand abuse.

ActionStart at p=none and tighten gradually using aggregate reports.

LowCAA record missing

ImpactAny certificate authority may issue certificates for the domain.

ActionRestrict issuance to the CAs you actually use.

02 / Approach

We look. We don't touch.

The rules are simple: only public information, and only with your consent.

01

Public data only

DNS, certificate transparency logs and ordinary HTTPS responses. No port scanning, no exploitation, no probing.

02

Evidence, not opinions

Each finding cites the configuration value or CVE behind it, so your team can act and justify the work internally.

03

Through remediation

Prioritised fixes, implementation guidance, and a re-check. We don't stop at the report.

03 / Services

Three ways to work together.

Start with the free public-data check. Move to a full assessment only if it makes sense.

Free check
  • Public-data review of one domain
  • Short report (PDF / Markdown)
  • High-severity findings only
Basic
  • Exposure assessment of agreed scope
  • Detailed report with evidence and CVEs
  • Online walkthrough
  • Prioritised remediation plan
Standard
  • Everything in Basic
  • Remediation guidance
  • One re-assessment
  • Operational rules and checklists

04 / Process

How it runs.

Four stages, from first request to re-check.

01

Collect public data

DNS, CT logs, ordinary HTTPS responses only

02

Generate report

Findings structured with evidence

03

Prioritise

Ranked by impact and effort

04

Propose

Deeper testing only with written consent

05 / FAQ

Questions.

Can you test without permission?

No. The free check only organises public information and does not access the target. Any deeper assessment requires written confirmation of the target and scope.

What do you check?

DNS records, certificate transparency logs, publicly known subdomains, ordinary HTTPS responses, CMS and plugin versions, and more. The report lists every check.

Will it affect our site?

The free check has no measurable impact. During an assessment we stay within the agreed scope and request rate.

How is our data handled?

Deliverables go only to you. We do not obtain non-public information. Retention is defined in the contract.

Can we be re-checked?

Yes. Standard includes one re-assessment; additional rounds are quoted separately.

06 / About

mierutech

Make the invisible visible.
We assess how your organisation looks from the outside, using public data only.

Name
mierutech
Representative
請求があった場合に遅滞なく開示します
Address
請求があった場合に遅滞なく開示します
Email
[email protected]
Phone
請求があった場合に遅滞なく開示します

07 / Contact

Request a free check.

Send us the domain. We usually reply within two business days.

If the form does not work, email us directly.

[email protected]

Your message will be sent to [email protected].