CLI

Open-source passive reconnaissance for domains, subdomains, hosts, and emails

Best for: Collecting first-pass public leads around an organization's domains, hosts, and exposed contact patterns.

Open-source email registration checker for public account-signal triage

Best for: Checking whether an email address may have public account-registration or account-recovery signals during authorized people or exposure research.

Open-source modular reconnaissance framework for technical OSINT

Best for: Technical analysts who need repeatable passive reconnaissance and enrichment around domains, organizations, contacts, or infrastructure leads.