CyberRecon — Domain Threat Intelligence Platform

How CyberRecon Works

✅ CyberRecon is a passive, read-only intelligence tool. It performs no exploitation, no active scanning, no brute-force, and sends no malicious traffic to any target. Every check reads publicly available data.

When you enter a domain, CyberRecon fires a series of parallel, read-only lookups against public OSINT APIs and open data sources. Everything runs in your browser — no data transits through any server controlled by the author.

📧 DNS & Email Security

Resolves A, AAAA, MX, NS, TXT, and CAA records via Google DNS-over-HTTPS. Checks for SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI — the complete email authentication stack. DKIM is probed across 20 common selector names.

🌐 IP, ASN & CIDR Enrichment

MX and primary A-record IPs are enriched through a four-source fallback chain: ipwho.isipinfo.iordap.arin.netipapi.co — all queried in parallel to produce hosting organisation, country, ASN, and CIDR network prefix for every resolved IP. Sources fire simultaneously so IP enrichment never blocks cert or threat intel lookups.

⚠️ Threat Intelligence

Queries URLScan.io for the last 20 scans with full verdict breakdown, and ThreatFox / abuse.ch for active malicious IOC matches. DNSBL status is checked against Spamhaus DBL and SURBL via DNS.

🔐 Certificate Transparency & Subdomains

Fetches TLS certificates from crt.sh and a secondary Cert Spotter CT index fallback, then normalises the result set into a single certificate view. Wildcard and apex query paths are both checked, SAN lists are parsed on both newlines and commas, and genuine subdomains are extracted with a strict suffix match — passively revealing the domain's external attack surface without touching any target system.

📬 Email Deliverability Score

A 0–100 composite score across 8 weighted components: SPF mechanism (20pts), DMARC policy level (25pts), DKIM selector count (20pts), MTA-STS (10pts), BIMI (5pts), TLS-RPT (5pts), DNSBL clean status (10pts), and gateway presence (5pts). Rendered as letter grade A+–F with per-component progress bars. All derived from scan data — no inference.

🗺 Security Posture Heatmap

A 15-cell colour-coded summary grid covering all security domains (SPF, DMARC, DKIM, MTA-STS, Email GW, URLScan, ThreatFox, Spamhaus, SURBL, TLS Cert, CAA, WAF/CDN, Typosquats, BIMI, Deliverability). Every tile is clickable — navigates directly to the relevant tab. Colours: red=critical, orange=fail, yellow=warn, green=pass, blue=info.

🔬 Tech Stack Fingerprinting

Detects 40+ technologies from 9 passive signal sources: URLScan page URL/server/domain/tags, NS records, IP org, cloud footprint providers + CNAME targets, MX hostnames, TXT detectedTools, SPF includes, DKIM selectors, and CT subdomain names. No active HTTP requests — purely from data already collected in the scan.

🔌 API Endpoint Discovery

Mines URLScan page URLs and active CT subdomains for 21 API path patterns: versioned REST, GraphQL, Swagger/OpenAPI docs, health/metrics/admin endpoints, WordPress REST API, XML-RPC, phpMyAdmin. Also detects API-pattern subdomains (api., graphql., admin., swagger., backend.) from CT log resolution.

☁️ Cloud Footprint Discovery

Detects cloud providers (AWS, Azure, GCP, Cloudflare, Akamai, Fastly, DigitalOcean, Vercel, Netlify, and others) by matching IP organisation strings, ASN names, NS record patterns, and CNAME targets. Resolves up to 20 CT-discovered subdomains live via DNS for cloud attribution.

🛡 Brand Protection & Typosquat Detection

Generates 60+ lookalike domain variants using TLD swaps, homoglyphs, character insertion/deletion, and abuse prefix/suffix patterns. The top 18 by risk are checked live via DNS. Certificate Transparency logs and URLScan.io are also queried for brand-related domains on external infrastructure.

📊 Risk Scoring & Export

All findings feed a deterministic, rule-based scoring engine producing a 0–100 risk score with per-factor explanations. The score is fully transparent — no AI inference, no black box. The same domain scanned twice produces identical results.

📥 Export Formats

CSV — 23 sections covering every scan finding in flat spreadsheet format. Excel (.xlsx) — 9 worksheets (Overview, Email Security, Threat Intel, Certificates, Risk Factors, Brand, Cloud, Web+Tech, Tools) using SheetJS — open directly in Excel or Google Sheets. Word (.doc) — 12 fully structured sections with tables, headers, and a legal disclaimer block. PDF — browser print-to-PDF with a clean stylesheet covering 13 numbered sections. Recommendations section is excluded from all exports.

📬 Email Deliverability Score

A separate 0–100 composite score measuring email deliverability health across 8 weighted components: SPF mechanism (20pts), DMARC policy level (25pts), DKIM selector count and rotation (20pts), MTA-STS (10pts), BIMI (5pts), TLS-RPT (5pts), DNSBL clean status (10pts), and gateway presence (5pts). The score renders as a letter grade (A+ through F) with individual progress bars for each component — all derived from real scan data, no inference.

🔬 Tech Stack Fingerprinting

Detects 25+ technologies from passive signals already collected during the scan: URLScan.io page data (URLs, server strings, domain lists), cloud footprint provider attribution, and TXT record tool signatures. Identifies CMS platforms (WordPress, Drupal, Joomla, Wix, Squarespace, Shopify), hosting/CDN (Cloudflare, AWS, Netlify, Vercel, GitHub Pages), analytics (Google Analytics, GTM, Hotjar), bot protection (reCAPTCHA, hCaptcha, Turnstile), and JavaScript frameworks (React, Angular, Vue, Next.js, Nuxt.js, jQuery). No active HTTP requests are made — all detection is from existing scan signals.

📅 Domain Age & Lifecycle

Extracts registration date, expiry date, and last-updated date from RDAP responses. Calculates domain age in days and years with a risk classification — domains under 90 days are flagged HIGH risk (common in phishing infrastructure), under 1 year elevated risk. Expiry warnings trigger at 30 and 90 days. All data sourced directly from RDAP/Verisign/IANA registry responses.

✅ Web Security Verified Checks

Four security controls verified entirely from existing scan data — no external calls, no guesses: TLS Certificate (expiry status from crt.sh), CAA Records (certificate authority restriction from DNS), WAF/CDN Protection (inferred from cloud footprint provider list), and Threat Intelligence Standing (composite of DNSBL, URLScan, and ThreatFox results). Each returns a definitive PASS, WARN, or FAIL with the exact data behind the verdict.

Data Sources

Google DNS-over-HTTPSURLScan.ioThreatFox/abuse.chipwho.isipinfo.iordap.arin.netipapi.cocrt.shSpamhaus DBLSURBLRDAP/Verisignipinfo.io

Terms of Use

⚠️ By using CyberRecon you agree to these terms. If you do not agree, do not use the service.

Last updated: April 2025 · Operated by Jitendera Sarda · jitusarda@outlook.com

1. Purpose of the Service
CyberRecon is provided for defensive security, OSINT research, and educational purposes only. It helps security teams, domain owners, and investigators understand what information about a domain is publicly exposed. The Service is not intended for unauthorized access, attacks, fraud, or any illegal activity.

2. Passive / Non-Intrusive Nature
CyberRecon performs only lightweight, non-intrusive lookups — querying public DNS, RDAP/WHOIS, blocklists, IOC databases, certificate transparency logs, and third-party APIs. It does not perform vulnerability exploitation, password guessing, denial-of-service, or high-volume port scanning of any target.

3. User Responsibility & Authorization
You are solely responsible for how you use the Service and any data it returns. You agree to use CyberRecon only in compliance with all applicable laws and regulations. Where laws, contracts, or policies require authorization (e.g., for penetration testing of a third-party domain), you are responsible for obtaining any required permission before using CyberRecon results in that context. You must not use the Service to harass, stalk, abuse, or harm any individual or organization.

4. No Legal or Professional Advice
Output is provided "as is" for informational purposes only. It does not constitute legal, compliance, or security advice. Presence or absence of indicators does not prove a domain is malicious, compromised, or safe. Independently validate findings and consult qualified professionals before acting on results.

5. Third-Party Services & Data Accuracy
CyberRecon relies on multiple third-party APIs not controlled by the operator. Those services may have their own terms, rate limits, and availability constraints. Data may be incomplete, stale, or inconsistent. Do not rely on results as the sole basis for critical decisions.

6. Acceptable Use — Restrictions
You agree not to: attempt to reverse-engineer or overload the Service; use automated scripts to send abusive traffic to CyberRecon or its upstream providers; use the Service in violation of applicable export-control, data-protection, or computer-misuse laws; or represent CyberRecon output as an official statement from any data provider or domain owner. The operator reserves the right to rate-limit, block, or remove access for users who appear to be abusing the Service.

7. No Warranties — Limitation of Liability
THE SERVICE IS PROVIDED "AS IS" AND "AS AVAILABLE" WITHOUT WARRANTIES OF ANY KIND. TO THE MAXIMUM EXTENT PERMITTED BY LAW, THE OPERATOR SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR CONSEQUENTIAL DAMAGES ARISING OUT OF YOUR USE OF THE SERVICE OR ANY DATA PROVIDED.

8. Changes to the Service and Terms
The Service and these Terms may be updated or discontinued at any time without prior notice. Continued use after any change constitutes acceptance of the updated terms.

9. Contact
For questions about CyberRecon or these Terms: jitusarda@outlook.com

Data & Privacy

✅ CyberRecon stores no data on any server controlled by the author. All API calls are made directly from your browser to third-party public services.

What CyberRecon Does NOT Do

Does not store the domain names you scan on any author-controlled server
Does not require an account, login, or personal information
Does not transmit query data to Jitendera Sarda or any backend he controls
Does not use cookies, tracking pixels, or analytics
Does not sell or share any data

What Third-Party APIs May See

Because your browser calls external APIs directly, those third-party services (URLScan.io, ThreatFox, ipwho.is, crt.sh, Spamhaus, SURBL, etc.) may log the domain names and your IP address according to their own privacy policies. You should review those policies if scanning sensitive domains.

⚠️ Recommendation: Avoid scanning domains you are not comfortable sharing with third-party OSINT providers. The tool is designed for external/public domain assessment, not for scanning internal or confidential infrastructure.

Browser-Only Architecture

CyberRecon is a single HTML file that runs entirely in your browser. There is no backend, no database, no server-side processing. Export files (PDF, Word, CSV) are generated locally in your browser using Blob URLs and are never uploaded anywhere.

Report Exports

Exported reports contain domain intelligence data compiled from public sources. Reports are generated locally and not transmitted to any server. They carry a disclaimer stating data is sourced from public OSINT feeds and is provided for informational purposes only.

Do I Need Authorization?

✅ For most use cases, no authorization from the domain owner is required. CyberRecon reads publicly available data — the same data accessible to anyone with a browser and a DNS resolver.

Why CyberRecon is Generally Authorization-Free

All data CyberRecon retrieves is publicly available by design:

DNS records are public by definition — they must be resolvable by any mail server or browser that needs to reach the domain
Certificate Transparency logs are public infrastructure specifically intended for auditing; querying crt.sh is legally equivalent to reading a public bulletin board
Blocklist checks (Spamhaus, SURBL) are the same lookups any mail server in the world performs for every email it receives
URLScan.io and ThreatFox are community-maintained public threat intelligence databases openly accessible to anyone
IP/ASN lookups are the same routing information published by ARIN, RIPE, APNIC for internet operations

Querying this data is legally analogous to looking up a company in a public directory. No packets are sent to the target domain's servers. No authentication is bypassed. No systems are probed.

When Authorization May Be Relevant

⚠️ Authorization considerations apply when CyberRecon output is used as input for active follow-on activity — not for the passive OSINT lookups themselves.

Penetration testing engagements — if you use CyberRecon findings to scope or direct active pentesting of a third-party domain, your engagement contract and applicable law governs
Legal jurisdiction edge cases — some jurisdictions interpret "computer access" broadly; if you are in doubt, consult a qualified lawyer in your jurisdiction
Employer/client policy — some organisations have internal policies requiring approval before running any external recon, even passive. Check your policy.

Recommended Positioning

CyberRecon is best positioned as:

Self-assessment — scan your own domain to understand your external posture
Pre-engagement scoping — understand a client's publicly visible configuration before a security engagement (within scope of your engagement agreement)
Threat hunting & investigation — research suspicious domains as part of incident response or threat intelligence workflows
Education & awareness — demonstrate email security misconfigurations to non-technical stakeholders

Our One-Line Position

"CyberRecon reads what the internet already makes public. It is for defenders, researchers, and domain owners — not for offensive use."

Enterprise Passive Recon

Executive-ready domain intelligence with analyst-grade evidence.

CyberRecon correlates DNS, certificate transparency, threat intel, cloud signals, and email posture into a single defensive workflow without active probing or intrusive traffic.

Passive OSINT only Client-side processing Executive exports

CYBERRECON

Domain Threat Intelligence Platform

⚡ Jitendera Sarda · ✉ jitusarda@outlook.com

OSINT Feeds Active

Initialising…

🔎

Enter a Domain or Corporate Email to Begin Reconnaissance

Try: techmahindra.com · ntuc.com.sg · perplexity.ai · microsoft.com · cloudflare.com
Accepts: domain.com · www.domain.com · https://domain.com/page · user@company.com

40+ Email GatewaysSPF / DMARC / DKIM MTA-STS / BIMI / CAAcrt.sh Certificates Spamhaus DBLSURBL URLScan.ioThreatFox BGPView CIDRRDAP AI RecommendationsBrand ProtectionTyposquat DetectionVulnerability AssessmentBreach Check (Email)PDF Export

Risk Score

LOW

LOW RISK

0 risk factors

Data Sources:

📥 Export Report