Perform WHOIS lookup for a domain.

Enumerate DNS records for a domain. Returns A, AAAA, MX, NS, TXT, CNAME, SOA records.

Perform Nmap port scan on a target IP or domain.

scan_type options:

• "basic" : Top 100 ports, fast (-F)

• "service" : Service & version detection (-sV -F)

• "os" : OS detection, needs admin (-O -F)

• "full" : All 65535 ports, slow (-p-)

• "vuln" : Basic vulnerability scripts (--script vuln -F)

Inspect SSL/TLS certificate details for a domain. Returns cert validity, issuer, SANs, expiry, and cipher info.

Detect technology stack of a website. Identifies web server, frameworks, CMS, CDN, analytics, and security headers.

Find the Autonomous System Number (ASN) and network ownership for a domain or IP using Team Cymru WHOIS. Useful for identifying hosting provider and network ownership. No API key required.

Execute all registered reconnaissance tools in dependency-aware waves, extract security signals, and build the final threat analysis payload.

Look up known CVEs for a software name and version using the NVD API.

Check whether an IP address is reported as malicious using AbuseIPDB. Requires ABUSEIPDB_API_KEY in the environment.

Search crt.sh Certificate Transparency logs with browser spoofing, and automatically falls back to passive DNS if crt.sh times out.

Analyze HTTP security headers for a domain.

Returns a dict with header analysis including present/absent status, actual values, issues found, and severity ratings.

Check SPF, DKIM, and DMARC DNS records for a domain to assess basic email anti-spoofing configuration.

DKIM detection is best-effort here. It checks a fixed list of common selectors used by major email providers, since DKIM selectors cannot be discovered via DNS without already knowing them.

Trace the full redirect chain for a URL, hop by hop.

Follows redirects manually (allow_redirects=False + loop) instead of relying on requests' built-in auto-follow, so each hop's own status code and destination are visible. Flags TLS downgrades, private-IP destinations, redirect loops, excessively long chains, and cross-domain hops along the way.

Takes domain as input and return complete metrics and results for cloud urls exposed or not for a company

Fetch and parse the robots.txt file for a given domain to reveal hidden directories and sitemaps.