Effective protocol
HTTPS is attempted first, redirects are followed, and the protocol reported is the scheme of the final URL — so a site that redirects to HTTPS is never mislabelled as plain HTTP.
HTTP/1.1 · HTTP/2See the attack surface
behind a domain
Enumerate subdomains from several independent sources, then inspect every host: the protocol actually reached after redirects, HTTP version, TLS certificate, open ports and security headers.
What it collects
Every host is probed concurrently and results stream in as they arrive.
TLS certificates
A fully validating handshake runs first. If it fails, the certificate is still described and the reason is reported — expired, self-signed or hostname mismatch — instead of the failure being swallowed.
TLS 1.2 / 1.3 · SAN · ALPNPorts and services
Seventeen common ports are scanned in parallel. Where a service announces itself — SSH, FTP, SMTP, IMAP, POP3 — the banner is read and matched, because an open port is not proof of the service behind it.
Banner-confirmedMultiple sources
SecurityTrails, Certificate Transparency, HackerTarget and AlienVault OTX are merged and de-duplicated. Any one source failing degrades coverage but never fails the scan.
Merged · de-duplicatedSecurity headers
HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and Permissions-Policy are checked on every reachable host.
6 headersBuilt for scale
One event loop and one shared connection pool. Hosts that fail to resolve stop immediately rather than waiting out a timeout on every port.
Streamed resultsHTTP API
Everything the interface does is available over HTTP with Basic credentials, so it can be driven from a browser, a script or any client.
Scope
This tool issues ordinary reconnaissance traffic — DNS resolution, TCP connects, one HTTP GET and one TLS handshake per host. Even so, only scan domains you own or have written authorisation to test.