The short version. Passive and light-active footprinting of a domain: subdomains from certificate transparency, full DNS, registration data, origin IP behind a CDN, lookalike domains and exposed cloud storage. No exploitation, no zone transfer, no login attempts.
What this engine does
Every certificate you have ever issued is in a public log. Every DNS record you publish is readable. An attacker starts here, and it costs them nothing — so knowing what they will find is the cheapest security work available.
- Subdomain discovery from certificate-transparency logs, including hosts that were never meant to be public.
- Full DNS enumeration — records, delegation and configuration.
- Registration data via WHOIS and RDAP, including expiry exposure.
- Origin-IP discovery — whether your real server can be reached directly, bypassing the CDN that protects it.
- Typosquat and lookalike domains registered against your brand.
- Exposed cloud storage associated with the domain.
- Live subdomain probing — which of the discovered hosts actually answer.
What it deliberately does not do
Reconnaissance stops at knowing. Everything below belongs to a different engine, if you authorise one:
- No exploitation. A discovered host is reported, not attacked.
- No zone transfer. AXFR is not attempted.
- No login attempts. No credentials submitted anywhere.
- No private-IP probing. Origin discovery stops at public addresses; the SSRF guard refuses the rest.
- No personal-data harvesting. Email addresses found in public sources are PII-scrubbed before they reach the report.
How we prove you are allowed to run it
Authorisation is a hard gate, not a checkbox in our terms. A scan starts only if the asset is verified by Domain Control Verification — you place a DNS TXT record or a file we specify — or you supply an explicit legal-authority attestation stating you own the target or are authorised to test it. A request carrying neither is refused with HTTP 403, at every tier, with no override. Reconnaissance reads public sources, but we still gate it: the domain must be DCV-verified or covered by your attestation. Mapping someone else's footprint is not a service we offer.
Where your data goes, and when it is deleted
Everything runs on EU infrastructure: edge functions in EU regions, scan compute in Frankfurt, object storage under EU jurisdiction, model inference through an EU endpoint. Nothing is used to train any model — ours or a third party's — and that is a contractual term in the DPA, which every plan gets.
- The report — kept two years, so you can hand it to an auditor next year.
- Raw uploaded material — third-party scanner files 30 days, application binaries 60 days, then deleted automatically.
- The anonymous homepage preview — content erased after 24 hours.
- The authorisation record — kept, because it is the evidence that the scan was permitted.
The full schedule is in our Privacy Policy, and the sub-processor list is on the Trust Center.
How a run actually works
Deterministic collection from public sources first, then correlation: which discovered hosts are live, which look forgotten, which certificate names point at infrastructure the CDN is supposed to be hiding. The interpretation is where the value is — a list of 200 subdomains is data, while "these four answer, three are stale and one exposes your origin" is a finding.
What you get at the end
An inventory of your external footprint with the source that revealed each item, ranked by what it exposes rather than by how exotic it is. Typically the most actionable entries are a forgotten staging host and a reachable origin IP.
What this engine cannot find
Passive reconnaissance is bounded by what is public:
- Assets with no certificate, no DNS record and no public trace stay invisible.
- Whether a discovered host is actually vulnerable — that needs the Web, API or Network engine.
- Ownership: a lookalike domain may be a squatter, a partner or a legitimate variant, and confirming which is human work.
- Anything inside your network.
- Historical exposure that has since been withdrawn from public sources.
We publish this list for the same reason we publish our own assessment report, limitations section included: a vendor that cannot tell you what its tool misses is asking you to take the rest on faith.
Frequently Asked Questions
Is passive reconnaissance legal to run against my own domain?
Yes, and it reads sources anyone can read. We still require DCV or an attestation, because we do not map footprints for people who do not own them.
What is origin-IP exposure and why does it matter?
If your real server can be reached directly by IP, an attacker can bypass the CDN or WAF in front of it — every protection at the edge stops applying.
Will this find every subdomain we have?
It finds what is publicly discoverable, which is most of them, because certificates are logged publicly. A host with no certificate and no DNS record will not appear.
Do you collect email addresses?
Addresses appearing in public sources are PII-scrubbed before the report is written.
How is this different from the free tools on your site?
The free tools answer one question each about one target. This engine correlates all of them into a single ranked footprint, then tells you which parts matter.