Domain Intel
Domain Reconnaissance
Domain Intel maps a domain's full attack surface: who registered it, which subdomains exist, which hosts are live, what they run, and which vulnerabilities respond.
Every signal Domain Intel pulls
RDAP registration history
Subdomain enumeration
Live host & tech detection
ASN & CIDR mapping
IP enrichment
Nuclei vulnerability scanning
Who reaches for this engine
Mapping a domain's real attack surface — which subdomains exist, which hosts actually respond, and what technology answers on each one.
Confirming a suspected takeover by checking whether a subdomain still resolves to the hosting provider it claims.
Getting a full ownership and infrastructure picture of a domain before an assessment, engagement or acquisition review.
Under the hood
Full-spectrum domain investigation: RDAP registration, subdomain enumeration, live host detection, ASN/CIDR mapping, IP enrichment, and Nuclei vulnerability scanning. Combines 14 tools including subfinder, katana, httpx, nuclei, and more.
Questions about Domain Intel
- How does Domain Intel enumerate subdomains?
- It combines several enumeration sources in one pass, including certificate transparency logs and passive DNS. Results are then checked for live hosts, because a subdomain that appears in a certificate log may have been decommissioned years ago and still resolve in no meaningful way.
- Does Domain Intel run vulnerability scans?
- It runs Nuclei against hosts it has confirmed are live, so you get findings against reachable services rather than a long list of dead hostnames. This is a reconnaissance pass for an authorised assessment, not an exploitation tool, and it is meant to be run against infrastructure you own or have permission to test.
- What does 'live host detection' mean?
- A hostname resolving in DNS is not the same as a service answering on it. Domain Intel actively probes each discovered host to confirm it responds, and fingerprints the technology stack it is running, so the output reflects what is actually exposed rather than what once existed.
- Which open-source tools power Domain Intel?
- The pipeline combines 14 tools, including subfinder and katana for domain and subdomain discovery, httpx for live-host detection and fingerprinting, and nuclei for template-based vulnerability scanning. The rest cover the RDAP registration, IP enrichment and ASN mapping stages of the same pass.
- Can I run Domain Intel against a domain I do not own?
- Only with written permission. The acceptable-use rule is explicit: scanning and reconnaissance tooling must only be used against infrastructure you own or have authorisation to test. If an assessment calls for it, proof of authorisation should be on record before any scan starts.