Updated 12 October 2026: added IP.THC.ORG as a free cross-check for subdomains.
What is passive domain reconnaissance?
Passive reconnaissance gathers intelligence about a target domain without sending any traffic to it. Instead, this tool queries public databases that have already indexed the internet: Certificate Transparency logs for subdomains, Shodan's InternetDB for open ports and CVEs, DNS aggregators for record data, and threat intelligence platforms for malicious indicators. The target never sees your IP address or knows they're being researched.
To cross-check the subdomain list, IP.THC.ORG offers a free subdomain finder, reverse DNS and reverse CNAME lookups. It needs no registration or API key. It says it indexes "6 billion+ domains" but does not state where its data comes from, so treat hits as leads IP.THC.ORG (read 12 Oct 2026).
Key Terminology
- Certificate Transparency (CT)
- A public logging system for TLS certificates. Every certificate issued by a trusted CA is logged, revealing all hostnames it covers — a goldmine for subdomain discovery.
- Shodan InternetDB
- A free, no-auth API that returns pre-scanned data for any IP: open ports, detected services, known CVEs, CPE identifiers, and hostnames. No active scanning required.
- RDAP
- Registration Data Access Protocol — the structured replacement for WHOIS. Returns domain/IP registration data as machine-readable JSON instead of freeform text.
- OTX AlienVault
- Open Threat Exchange — a crowd-sourced threat intelligence platform. Provides threat pulses, malware indicators, and reputation data for IPs, domains, and hashes.
🌐 Domain Recon Dashboard — Frequently Asked Questions
How do I scan for subdomains for free?
This tool enumerates subdomains using certificate-transparency logs and DNS data, then maps them alongside the domain’s records and tech stack — a complete attack-surface view, free and in-browser.
What APIs does the Domain Recon Dashboard query?
It queries crt.sh for Certificate Transparency subdomain enumeration, HackerTarget for DNS records and host discovery, Shodan InternetDB for open ports and CVEs on discovered IPs, RDAP for structured WHOIS data, OTX AlienVault for threat intelligence, RIPE Stat for abuse contacts and BGP data, HackerTarget for HTTP security headers, and the Wayback Machine for archive history: the latest capture from the availability API by default, plus capture-index page counts from the CDX API when the free Archive Helper is installed.
What is the difference between a quick check and a full scan?
Only the Wayback Machine part of Domain Recon depends on the mode; subdomains, DNS, ports, headers, WHOIS and threat data are the same in both. The quick check is the default and needs nothing installed: your browser asks the Wayback Machine availability API for the most recent capture of the domain, trying up to four spellings (bare domain, https, www and trailing slash), and links that snapshot and the full capture calendar. If it finds nothing, that is not proof the site was never archived. A full scan needs the free Max Intel Archive Helper browser userscript, which lets your own browser query the Wayback Machine capture index (CDX API) and adds the number of index pages of archived URLs under the domain, a rough measure of how much of the site has been archived.
Is this tool passive or active?
This tool is entirely passive. It queries public databases and APIs that aggregate already-collected data. No packets are sent to the target domain — all queries go to third-party API endpoints like crt.sh, Shodan, HackerTarget, and others.