Step 1
Snapshot
Free
A one-page note about your domain, built from public data.
- Top three findings in plain English
- The evidence behind each one
- How to fix them
- Free 20-minute walkthrough
A SentinelGrid Africa product · Passive exposure review
See what the internet already knows about your business.
SentinelGrid Skyline reads public records about your domain and turns them into a one-page note in plain English: what we noticed, why it matters and how to fix it. We never touch your systems.
- Public data only
- A person checks every finding
- Free first note, no obligation
Example Stores Ltd · examplestores.ng
MediumIndicator of exposure, unverified
1. No DMARC record published
examplestores.ng has no DMARC record, so criminals can more easily send email that appears to come from you.
How to fix it: ask your email provider to publish a DMARC record, then tighten it over a few weeks.
LowIndicator of exposure, unverified
2. A name that suggests a test system is public
Source: public DNSSHA-256 a9ef43db…
An illustration of the format, not a real client.
How it works
One passive look, checked by a person, in one page
We read public records
DNS, certificate logs, registration data and internet scan indexes. It is the same information anyone can look up. Nothing connects to your website or your servers.
A person checks every finding
Automated checks raise indicators. An analyst reviews the evidence behind each one and rewrites it in plain English before anything leaves us.
You get one page
The three things most worth knowing, the evidence behind each, and how to fix them. We offer a free 20-minute walkthrough if you would like one.
What we look at
The things criminals check first, explained without jargon
Email that can be faked
Whether criminals could easily send email that appears to come from your domain (SPF, DMARC and DKIM).
Certificates
Expired or forgotten security certificates that make visitors see browser warnings.
Forgotten subdomains
Names such as staging, test or old that were never meant to be public, and records that point at services which no longer exist.
Exposed services
Databases and remote-access ports that internet scan indexes report as reachable from anywhere.
Look-alike domains
Domains that resemble yours and are live, which could be used to impersonate your business.
Reported vulnerabilities
Known issues that scan indexes match to your servers. These are often false alarms, so we flag them for checking rather than alarm.
How we work
Careful by design, because trust is the whole job
Public data only
We never connect to your systems, scan your ports or test anything. If we ever need to look closer, it happens only under a signed scope that you have agreed.
Indicators, not verdicts
Every item is marked "indicator of exposure, unverified" until your own team confirms it. We tell you when something may be a false alarm.
Reviewed by a person
Nothing reaches you that an analyst has not read, checked against the evidence and approved.
No pressure
One note, one polite follow-up, then we stop. No deadlines, no fear, and no price attached to the findings.
Minimal data, deleted on request
We keep what we collect for 12 months by default and delete it sooner if you ask. Built with the Nigeria Data Protection Act in mind.
Government and critical services
We do not cold-contact public bodies or critical infrastructure. Those start with a written introduction.
Services
Start with a free note. Go further only if it helps.
Step 2
Review
Free for now
We confirm what is real and give you a ranked list of fixes.
- Each finding checked with non-intrusive methods
- Full passive picture of your subdomains and mail setup
- Ranked fix list and a debrief call
- A free re-check after 30 days
Step 3
Pharos monitoring
Free for now
We keep watching, so it does not drift back.
- Monthly passive rescans
- Alerts on new exposure: new subdomains, certificate expiry, mail record changes, newly exposed services
- A one-page monthly status
- A quarterly review call
Everything above is free for now, and there is no payment step. Anything beyond the Snapshot happens only under a signed scope that names the domains, the dates and what is out of bounds. Checks are non-intrusive: no exploitation, no password guessing and no load testing. Findings go only to the person named in your agreement.
Received a note from us?
It came from a review of public data. Here is what that means.
- We used public data only and did not connect to or test any of your systems.
- We have not shared it with anyone.
- The items are indicators for your team to confirm, not accusations.
- You owe us nothing, and one polite follow-up is the most you will hear from us.
Confirm it was us Ask us to stop and delete our data
We act on a stop request straight away and keep only a do-not-contact entry so that we honour it.
Questions
Straight answers
How did you find this?
From public records that anyone can query: DNS, certificate transparency logs, domain registration data and internet scan indexes. We did not touch your systems, and we can show you each source.
Is this a hack?
No. Everything in a Snapshot comes from data that already exists in public. We never log in, probe, scan ports or test anything on your side.
Are the findings certain?
No, and we say so on every report. They are indicators of exposure, unverified. Your IT team should confirm them. The Review exists to do that properly, under a written scope.
What does it cost?
Nothing for now. The Snapshot, the Review and the monitoring are all free at the moment, and there is no payment step on this site. If that ever changes, we will tell you in writing before anything starts.
Do I need to give you access to anything?
No. A Snapshot needs nothing from you. Further work only starts after you sign a scope that names the domains covered, the dates and what is out of bounds.
Is this a penetration test?
No. Skyline is not a penetration test, an incident response service or a compliance certification. It is a point-in-time view of what is publicly visible, with advice on what to fix first.
Who sees my information, and for how long?
Only the person named in your agreement. We store the minimum, keep it for 12 months by default and delete it on request. We never share it.
Curious what the internet sees about yours?
Book a free 20-minute walkthrough. We will show you each source, so you can check it yourself.