RiskFinder - Passive OSINT Attack Surface Assessment

RiskFinder is a passive OSINT assessment service for the internet-facing attack surface of domains your organization owns. It collects public information and reports what an outside attacker could learn about you, without intrusive contact with your systems.

LANGUAGE

The application interface, the findings and every report are in Japanese only; there is no English version at this time. Please confirm this fits your team before you subscribe.

WHAT THE ASSESSMENT COVERS

Subdomain discovery from public sources: certificate transparency logs, host search, threat intelligence and DNS information services, and direct DNS resolution. DNS resolution of standard record types (A, AAAA, MX, NS, CNAME), with no zone transfer and no dictionary-based brute forcing. Email authentication posture (SPF, DKIM, DMARC), read from DNS TXT records only, with no SMTP connection or test mail. Public search for hosts and services on the domain, including reported CVEs. TLS certificate inspection of discovered hosts. Breach exposure lookup against third-party databases. HTTP access control check: one GET request to each host's root path (/) over HTTPS and HTTP, recording status code, authentication challenges, server banner and redirect target; redirects are not followed and no other port is contacted. Exposure check of four fixed paths: /.env, /.well-known/security.txt, /security.txt and /robots.txt. If an environment file is exposed, RiskFinder records only the number of assignment lines and the category of secret, never file content, variable names or values. WHAT YOU RECEIVE

A findings report with severity ratings, an attack scenario for the highest severity finding and cloud-provider remediation pointers, as a web page and as PDF and Markdown downloads, plus a comparison report against a previous assessment of the same domain.

HOW ACCESS TO YOUR TARGETS IS CONTROLLED

An assessment runs only on a domain you have verified by publishing a DNS TXT record that RiskFinder generates for your account. Verification happens once, at registration, and a verified domain covers the hosts under it. Targets are domain names; IP addresses are not accepted.

AUTHORIZATION TO ASSESS

For each domain you register and assess with RiskFinder, you represent, at the time of registration, that you own the domain or have explicit permission from its owner to have it assessed. Domain verification by DNS TXT record demonstrates administrative control over the domain's DNS; it is not a determination of legal ownership or of authority to assess a third party's domain. You are responsible for, and will indemnify Turn and Frontier Co. Ltd. against, any third-party claims, damages, or costs arising from your assessment of any target that you do not own or are not authorized to assess.

BILLING

Pricing uses an AWS Marketplace SaaS Contract with a hard stop. A contract grants scan tickets; one ticket is consumed when an assessment is accepted for execution. There is no usage-based overage: once the current term's tickets are used up, new assessments are declined until you add quantity or the term renews. Unused tickets do not carry over. Contract status and remaining tickets are shown in the application.

ACCOUNT MODEL

One subscription provides one administrator account, with no user invitation or member management. The account requires two-factor authentication with a time-based one-time password (TOTP). Recovery codes are issued once at enrollment and one is required to reset your password; there is no email-based reset.

DATA HANDLING

Assessment results are stored in Amazon S3 buckets with versioning, required TLS and server-side encryption. Customer data is separated per tenant in three layers: PostgreSQL row-level security, a tenant prefix on every S3 object key, and tenant resolution from the database, not the queue message, at execution time. Audit records are written to a separate S3 bucket with object lock. You can delete an individual assessment and its stored objects yourself while your subscription is active. When your subscription ends, your stored assessment results are deleted automatically, and we do not retain your data after the subscription term. Please download and keep any reports you need during the subscription term. Reports contain no plaintext passwords: only the password type is shown. The Markdown appendix lists affected email addresses and breach source names (personal data). LIMITATIONS AND DISCLAIMER

RiskFinder performs passive assessment: it collects public information and confirms it through ordinary access to the target, without port scanning, vulnerability scanning, brute forcing or authentication attempts. Because it is limited to what is publicly observable, the assessment does not identify every exposure or weakness, and a clean report is not evidence that a system is secure. RiskFinder is not a penetration test or a compliance certification.