see your estate the way we see it first
Every engagement opens the same way: before anyone touches a system, we build a picture of it from public sources alone. This runs that phase live against a domain you own, and grades what it finds. It takes about twenty seconds.
- runtime
- ~20 seconds
- modules
- 12
- depth
- passive OSINT
none of this requires your permission, which is the point
Reconnaissance is the phase you cannot detect and cannot prevent. Everything below is already public, already indexed, and already available to anyone who is interested in you. The only question is whether you have looked at it before they did.
certificate transparency
Every publicly trusted certificate since 2018 is in an append-only log. A hostname you never published is public the moment it gets a certificate.
public dns
Zone records, mail authentication, delegation and the negative answers that reveal a dangling record pointing at a service someone else can claim.
registration records
RDAP gives registrar, age, expiry and the lock status that decides how hard your domain is to steal.
exposure indexes
Shodan's existing crawl of the internet, queried by address. We read what it already recorded — no packet from this scan reaches your hosts.
breach corpora
Public breach records attributed to the domain, and the data classes each one exposed.
lookalike registry
Plausible typo and homoglyph variants of the name, checked for registration and for working mail — the infrastructure invoice fraud runs on.
the boundaries
A scanner that is vague about what it does to you is not one you should point at your own infrastructure. So, precisely:
- what it does
- Reads public records and makes a handful of ordinary GET requests to your own web root, exactly as a browser would.
- what it never does
- No exploitation, no brute force, no port scanning, no authentication attempts, no traffic to hosts you do not control.
- what we keep
- Nothing. Results live in your browser tab for as long as it is open, and are not written to disk or logged.
- scan a domain you are responsible for
- Reading public records about a third party is lawful nearly everywhere, and the web requests this makes are indistinguishable from a visit. It is still your call to make, and the demo is rate limited accordingly.
a scan is not a test
Automation is good at breadth. It will find the staging host nobody decommissioned and the mail record that lets anyone invoice your customers in your name. It cannot tell you whether the authorisation logic on your payments API can be walked around, because that requires understanding what the application is for.
Treat this as the first twenty seconds of an engagement. The rest is six stages long and mostly done by people.
found something you did not expect?
That is usually how this starts. Send us the reference from your scan and we will tell you what we would do with it — and whether it is worth a full engagement.