$ ./lookup --domain
Attack surface lookup
Type your domain once. Every link below opens a public service with it already filled in - 29 views of what the internet knows about you.
Nothing runs on this site and nothing is stored: the links point straight at each service. Inspired by web-check, which runs these checks on its own server.
⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.
Paste a URL if you like - https:// and paths are stripped. Your domain is remembered in this browser only.
## subdomains & certificates
Every certificate is public. These show the hostnames in them - including the ones you forgot.
## dns & email
DNS answers through Google’s public resolver. Weak email records let attackers spoof your domain in phishing.
## history & code
Old URLs and public code. The past is part of your attack surface.
## exposure & tech stack
What scanners and crawlers already know about your servers and software.
## tls & security headers
These services scan your site for you - they send requests to it, so use them on your own domains.
## files on the site itself
Opens a URL on the domain directly. Only for domains you own or may test.
→ run it all at once: one-liner and recon.sh report · → step-by-step checklist