Yes. The quick scan and the first report are free, no credit card required.

Is this an ASV or PCI scan?

No. It is not an approved ASV scan, does not replace a quarterly PCI DSS scan and is not a penetration test.

Do I need authorization to scan a domain?

Yes. Scan only a domain you own or have written authorization from its owner to check. You are asked to confirm this before the scan, and the report is sent to an email address at the scanned domain.

Back to the home page

Free phishing exposure check

Q: What does the scan check?

The quick scan checks the public DNS records of the domain (DMARC, SPF, DKIM) and shows whether email can be spoofed in the name of the domain. The full report adds checks of publicly exposed information: exposed assets, security headers, certificates and other public data.

Q: What happens after the scan?

You see the quick scan results on screen. If you request a full report, the PhishingU team reviews the request and prepares your first report free of charge, with remediation recommendations. You can also continue to employee training or a phishing simulation.

Find out within seconds whether your domain is exposed to email spoofing, BEC and phishing attacks - for example, sending an email in your organization's name to your customers, or phishing emails to your employees

Enter your domain

I declare that I own the domain being scanned or am authorized in writing by its owner to run a check on it, and that I have read the Scan policy. I understand that scanning a domain without authorization is prohibited.

The quick scan checks public DNS records only

SSL encryption

Quick scan: public DNS only

Mailing only with consent

Run a phishing simulation for your employees yourself - in 15 minutes* · from ₪999

* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.

How it works, pricing and frequently asked questions

Frequently asked questions about the free scan

Is the scan free?

Yes. The quick scan and the first report are free, with no credit card required.

What does the scan check?

The quick scan checks the domain's public DNS records (DMARC, SPF, DKIM) and shows whether an email can be spoofed in the domain's name. The full report adds a check of information exposed on the internet: exposed assets, security headers, certificates and other public information.

Is this an ASV scan or a PCI scan?

No. This is not an approved ASV scan, it is not a substitute for a quarterly PCI DSS scan, and it is not a penetration test.

Do I need permission to scan a domain?

Yes. Scan only a domain that you own or have written permission from its owner to scan. Before the scan you will be asked to confirm this, and the report is sent to an email address on the scanned domain.

What happens after the scan?

You will receive the quick scan results on screen. If you request a full report, the PhishingU team will review the request and produce a first free report for you with recommendations for fixing the findings. You can also continue to employee training or a phishing simulation.

How long does it take?

The quick scan usually finishes within seconds. The full report is produced after the request is reviewed, and there is no commitment to a specific delivery time.

Free phishing check: domain check and email impersonation check

The tool runs a free phishing check on your domain: an email impersonation check based on SPF, DKIM and DMARC records, alongside a broad domain check of exposed assets. Not sure what this means? SPF, DMARC and DKIM record check - a simple explanation.

Find out - what do hackers know about your company?

What can attackers discover about my domain?

Before any targeted attack, hackers carry out OSINT and attack surface mapping - a scan of everything visible online: exposed subdomains, API keys leaked to GitHub, information on the darknet and in forums, login forms with missing protections, and more. The check is based on methods similar to those attackers use.

What is clickjacking and why is it dangerous?

Clickjacking lets an attacker embed your website inside a hidden iframe, so that a user clicks on an element of the attacker's (a button, a form) without knowing that it is framed. The result: stolen login details and actions performed in the user's name without consent. Protection: an X-Frame-Options header or frame-ancestors in the CSP. Organizations with a customer portal, a personal area or any login form are exposed to this.

What is CSP and why is it important?

Content Security Policy (CSP) is a protection mechanism that limits which scripts can run on your website. Without a CSP, an attacker who finds a single XSS can run any code they want - steal sessions, deploy a keylogger, send data out. A properly configured CSP makes an XSS unusable.

What is BEC and why is it dangerous?

BEC (Business Email Compromise) - business email compromise, an attack that can cause significant financial damage. Attackers send an email that appears to come from the CEO, a supplier or the company's management. Without DMARC with p=reject, anyone can send an email from your domain without limit.

What is included in the full EASM report?

Dozens of checks: SSL/TLS, subdomain exposure, Git exposure, API keys - data leaks, Darknet and hacker forum monitoring, exposed backup files, open redirects, security headers (CSP, HSTS, X-Frame-Options), IP reputation, blacklists, certificate transparency and more. Every finding comes with an explanation, a risk level and remediation steps.

Is the scan intrusive?

The quick scan checks Public DNS records only (DMARC, SPF, DKIM). The full scan is carried out only after your request and approval, and includes ordinary HTTP requests to public addresses of the domain and a check of information exposed on the internet and in public databases. The scan does not include login attempts, password guessing, exploiting vulnerabilities, aggressive port scanning or downloading content that is not intended for the public, and it is designed not to harm the availability of the site.