All tools

Checks whether an email address is registered on 120+ sites, without alerting its owner

Takes Email00

Enumerates a domain's DNS: standard records, SRV services, zone transfer checks and DNSSEC

Takes Domain00

Gets every known URL of a domain from the Wayback Machine, Common Crawl, OTX and urlscan

Takes Domain00

Tells whether an IP or host is behind a CDN, cloud provider or WAF, and which one

00

Scans a phone number: carrier, line type and country, plus search links to find where it appears

Takes Phone00

Probes a host's web server: status, title, technologies, TLS, CDN and IP

Takes URL00

Finds a domain's subdomains passively from dozens of public sources

Takes Domain00

Gathers emails, subdomains, hosts and IPs for a domain from public search engines and datasets

Takes Domain00

Looks up who holds an IP address through RDAP: network, ASN, organisation and contacts

Takes IP address00

Reads a server's TLS certificate: names it covers, issuer, validity, fingerprints and JARM

Takes Domain00

Lists an IP's open ports passively from Shodan InternetDB, without scanning it

Takes IP address00

Expands, counts, splits and aggregates IP ranges in CIDR notation

00