Domain Scan

Look up which domains are hosted on a public IPv4 address, plus its network (ASN/organisation) and PTR records. Accepts an IP or a bare domain (resolved to its IPv4). Data comes from our own verified index, reverse DNS and deep discovery over public certificate transparency and reverse IP sources, which runs automatically. Read-only: no report is created and the free scan quota is not consumed, but the lookup queries external public sources, results are cached and calls are counted for abuse control (20 lookups per 10 minutes per IP without an API key). Anonymous replies list up to 20 domains; a personal API key raises the list to 100.

reverse_ip_lookup

List subdomains detected for a domain from public certificate transparency logs (crt.sh / crt.name). Only names that appear in issued TLS certificates are returned, so the list is not an exhaustive inventory. Read-only: no report is created and the free scan quota is not consumed, but the lookup queries external public sources, results are cached for 7 days and calls are counted for abuse control (20 lookups per 10 minutes per IP without an API key).

find_subdomains

Run a free security scan of a domain. Checks SSL certificate expiry, SPF, DKIM, DMARC, MTA-STS, HTTPS redirect, HSTS, Content-Security-Policy, DNSSEC, CAA records, uptime, response time, BIMI logo, domain expiration and DNS blocklists. Returns a 0-100 security score, per-check findings with fix hints, and a private shareable report link. Note: this tool persists a temporary report (expires in 7 days), consumes the caller's scan quota (20 scans per 10 minutes per IP), and may send irreversible administrative notifications.

scan_domain