CLI

Open-source passive reconnaissance for domains, subdomains, hosts, and emails

Best for: Collecting first-pass public leads around an organization's domains, hosts, and exposed contact patterns.

Open-source network mapper for authorized exposure and service discovery

Best for: Authorized network inventory, service discovery, exposure validation, and defensive technical assessment.

Open-source email registration checker for public account-signal triage

Best for: Checking whether an email address may have public account-registration signals during authorized people or exposure research.

Open-source modular reconnaissance framework for technical OSINT

Best for: Technical analysts who need repeatable passive reconnaissance and enrichment around domains, organizations, contacts, or infrastructure leads.