DNS records and IPs
Add A, AAAA, CNAME, MX and NS context to a host without opening a connection to the target.
Resolution is an active step, so this needs a deliberate, opt-in design and its own source.What comes after the first list.
The explorer is intentionally narrow today. These are the next layers, ordered by what makes the existing result more useful without pretending passive data is active coverage.
Available now
Everything in this list works in the explorer today.
Certificate-transparency discovery from public logsShipped
Deep scan with Cert Spotter and Wayback hostnamesShipped
Archive paths grouped by folderShipped
Search, regex, noise labels, sorting and paginationShipped
CSV, JSON and TXT exportsShipped
24-hour result cache and shareable view linksShipped
In planning
No dates. Each item is only promoted when its behaviour, limits and privacy impact are clear.
HTTP status and technology
Show reachability, redirects and a conservative server-stack guess for hosts you choose to check.
Only on explicit request, host by host. Not part of a passive scan.Takeover signals
Flag CNAMEs that point at unclaimed services, with the evidence attached rather than a vague score.
Requires DNS context first. False positives must stay visible.Scheduled monitoring
Save a surface, re-run it on a schedule, and diff hosts that appeared or disappeared.
This is the first feature that needs an account, because something has to run when the tab is closed.Custom wordlists
Add dictionary discovery for teams that have authorization to run active enumeration.
Explicitly active. It will be labelled as such and never folded into the passive result.API access
Run a scan from a script and read the same records, sources and dates the explorer shows.
Needs an authenticated proxy and a clear shared-quota model.Have a feature that belongs here? The most useful requests explain the workflow, not just the missing field. Until then, the current explorer stays deliberately small and honest about what it reads.