Security teams
Find what your organisation left running outside the corporate perimeter.
The hackathon demo, the agency's campaign site, the staging copy an intern put on a free tier. Search by domain or by the email addresses on the page.
Not on your domain.
Still your attack surface.
Teams ship apps on Vercel, Netlify, Lovable and 19 other platforms, on subdomains no asset inventory tracks. Periphery indexes 19.3 million of them and records what any anonymous visitor sees: internal tools, login pages, leaked keys. Your company probably has a few in there.
- 100 free searches a month/mo
- No card needed
- Public URLs only
- 19.3M
- apps indexed
- 22
- hosting platforms
- ≤ 30d
- between visits to each app
22 platforms where anyone can ship anything.
Every hostname under these suffixes that we can find gets snapshotted, then visited again within 30 days.
- Vercelvercel.app
- Netlifynetlify.app
- Cloudflare Pagespages.dev
- Cloudflare Workersworkers.dev
- Railwayup.railway.app
- Renderonrender.com
- Flyfly.dev
- Herokuherokuapp.com
- AWS Amplifyamplifyapp.com
- Firebaseweb.app · firebaseapp.com
- DigitalOceanondigitalocean.app
- Surgesurge.sh
- Glitchglitch.me
- Lovablelovable.app
- Replitreplit.app
- Bubblebubbleapps.io
- Base44base44.app
- Streamlitstreamlit.app
- Hugging Facehf.space
- Nanocorpnanocorp.app
- Polsiapolsia.app
- Grokgrok.me
// 13 hosting platforms · 9 app builders
New apps ship every day.
So do the leaks.
Each app is visited again within 30 days. Every visit takes a fresh snapshot and extracts what the page shows that day.
Apps snapshotted
0
Screenshot, status and page text, taken again
850,000 / day
New apps
0
Hostnames seen for the first time
149,000 / day
New emails
0
Addresses found on a page for the first time
143,000 / day
New credentials
0
Keys found in public pages, verified or not
25,000 / day
// counted at the average daily rate.
Narrow it down.
Then pivot.
Filter by provider, status code, key type or first seen. Any email address or favicon in a result opens a new search.
Two kinds of people use this.
Researchers
Look for one pattern across millions of apps.
A phishing kit, a vulnerable template, a cloned login page. Favicon hashes match the ones Shodan, Censys and FOFA use, so you can bring your own.
// public URLs only, fetched without credentials. no logins, no forms, no exploits. what any browser would see.
Three ways in
Search from wherever
Search from wherever
you already work.
The same index and the same filters behind all three.
acme.com
acme-payroll-staging.vercel.app200
crm-proto-7f3.lovable.app200
acme-hr-portal.onrender.com503
Console
In the browserType a query, filter the results and open any app to see its snapshot, emails and keys.
Start free.
Pay when you need more.
Free
€0forever
No card needed.
- 100
- searches per month
- 10
- first results per search
- Most filters
Plus
Save 17%
€24/month
€288 billed yearly.
- 3,000
- searches per month
- All
- results per search
Everything in Free, plus:
- Credentials filter
- Partial credentials content
- API and MCP access
Need more?Watchers, notifications, attribution and labeling, resale rights. We'll set it up with you.
Contact us
// prices exclude VAT, which is added at checkout. plus starts with a 14-day free trial, then is billed monthly or yearly through stripe; cancel anytime from your account.
Somebody is going to search your domain. Might as well be you.
- 100 free searches a month/mo
- No card needed