misconfig.aiFree to start, no card
Is your cloud misconfigured?
Type a domain, a wildcard or a company name. misconfig.ai maps every host and service it finds, checks each for known misconfigurations, and keeps watching. One input, one map, one Recheck button.
Discovery uses public records only. Checks that touch a host run against what the record points at, never past it.
The map
Everything it exposes, drawn while it is found.
Published by the verified owner of this domain
Hostnames and counts only. Finding details and evidence stay in the owner's workspace. Map your own domain to see yours.
- Hosts on the map
- 0
- Checked
- 0
- Untested
- 0
- Exposed
- 0
- Fixed
- 0
- Discover
- Fingerprint
- Allowance
- Check
- Validate
- Explain
- Save
Starting
Discovery only until you prove you control . Checks that touch a host run only against verified domains. Publish either proof, then press Verify.
- DNS TXT record
with the value- Or a file on the site
containing
On Cloudflare? Verify in one step
Sign in to Cloudflare, approve DNS access for the account that holds this domain, and the TXT record is added for you. Nothing is typed or stored; the access is revoked as soon as the record is written.
Not your domain? Record what authorizes the test
Public page: off. A page at lists this domain's hostnames and open-finding counts for anyone to see. Never finding details or evidence. You can turn it off at any time.
Keyboard: focus the map, then use the arrow keys to move between findings and hosts, Enter to read the details.
The map draws itself as discovery runs.Hosts arrive from the edge and settle around the company. Untested hosts stay hollow.
Large target: hosts are grouped by subdomain. Click a group to list its hosts, or use the table below.
- Company
- Host
- Untested
- Service
- Finding
- Fixed
- Group
Hosts
| Host | Status | Services | Findings |
|---|
Check the rest
Free checks 3 hosts per target. Pro checks 50 hosts a month with 90 days of history and JSON and CSV exports; a top-up adds 25 hosts for $5.
Plans
Free to map. Pay to keep watching.
Free
$0
- Full asset discovery
- 3 hosts checked per target
- 7 days of history
- Email when a finding changes
Pro
$15/month
- 50 hosts checked a month
- 90 days of history
- JSON and CSV exports
- Signed webhooks on every scan
- Top-ups stack on top
Top-up
$5
- +25 hosts, 30-day expiry
- Buy from the map when the counter runs out
- Stacks with Pro
Questions
Before you map it.
Does it probe anything I don't own?
Discovery reads public records: DNS, certificate transparency, search indexes. Checks are read-only HTTP requests of the kind any browser makes, repeated against a control so a single odd response never becomes a finding.
Where does the evidence go?
Into your workspace, and nowhere else. Public discovery pages show asset names only; findings and evidence stay private.
What decides whether something is exposed?
Reproducible checks. The model explains a finding and writes the fix for the technology it sees; it never decides the status.