DomainRecon looks up DNS records, WHOIS details, SSL certificates, and IP addresses for a domain.
osint-recon
Passive subdomain reconnaissance for authorized testing is available through openSquat, a framework written in Rust.
About osint-recon
osint-recon is a Rust command-line framework for passive OSINT reconnaissance during authorized red team engagements. It automates parts of MITRE ATT&CK Reconnaissance (TA0043) using certificate transparency, DNS-over-HTTPS, public aggregators, and plain GET requests to already-public pages. Modules cover subdomains, DNS records, ASN/netblocks, certificate transparency history, GitHub dorking, Brazilian CNPJ/CEP lookups, technology fingerprinting, email harvesting, PDF metadata, and JSON/CSV export.
Use is limited to security research, education, and engagements with explicit written authorization from the target owner. The framework deliberately excludes active techniques such as port scanning, directory or subdomain brute forcing, and credential testing; collected personal data may be subject to LGPD/GDPR, and external queries depend on third-party services including crt.sh, hackertarget, dns.google, Team Cymru, BrasilAPI, ReceitaWS, and ViaCEP.
Key features
- Passive subdomain enumeration from certificate transparency and DNS-history aggregators
- DNS-over-HTTPS queries for A, AAAA, MX, NS, TXT records
- ASN and netblock enumeration via Team Cymru DNS whois
- Certificate transparency history: issuers, validity windows, expiring certificates
- GitHub dorking keyless; optional token adds code-search dorks
- Brazilian CNPJ/CEP lookup and OSINT dork pack for public business data
Best for: Security researchers and red teams conducting passive reconnaissance on systems they are explicitly authorized to assess, including those needing Brazilian business or address context.
Good for
- Passive-only design: no port scanning, directory or subdomain brute forcing, or credential testing
- Polite defaults: 1 req/s throttle, user-agent rotation, timeouts, and bounded retries
- External call failures warn and continue; results export to JSON and CSV
Watch out for
- Runs from source and requires Rust 1.95+; only that version is tested
- Authorized use only; unauthorized reconnaissance may violate Brazil's Lei nº 12.737/2012 and the U.S. CFAA
- Depends on third-party services, and collected personal data may be subject to LGPD/GDPR
osint-recon at a glance
- Category
- Privacy & Security › Website & URL Scanners
- Type
- Open-source project
- Pricing
- Not confirmed. Check the site
- Open source
- Not stated
- Language
- English
- Last checked
- Oct 6, 2026 · Online when checked
- Listed
- Oct 5, 2026
osint-recon alternatives
Tools and sites you could use instead, ranked by how closely they match.
TracerouteVisualizer maps network traceroute paths and displays the route between a device and a destination.
Research a domain’s DNS records, RDAP, WHOIS, subdomains, IP addresses, and email security in one report.
isMalicious checks IP addresses, domains, URLs, emails, phone numbers, and cryptocurrency wallets against threat intelligence data.
Freemium
23 alternatives
Web Check analyzes a website’s infrastructure and security signals through an OSINT and site diagnostics tool.
IsLegitSite checks whether a website may be a scam and reports its reputation through the Site Trustworthiness API.
Popular in Website & URL Scanners
Well-known listings from the same topic.
Columbus Projectgithub.com/elmasy-com/columbusInfoSniperinfosniper.netWho.iswho.isRobtexrobtex.comQuantcastquantcast.comFullHuntfullhunt.io
osint-recon FAQ
What authorization is required to use osint-recon?
It is intended for security research, education, and red team engagements with explicit written authorization from the target's owner. Unauthorized reconnaissance against third-party systems may violate laws including Brazil's Lei nº 12.737/2012 and the U.S. CFAA.
Does osint-recon perform active scanning?
No. It deliberately contains no active capabilities such as port scanning, directory or subdomain brute forcing, or credential testing.
What are the installation requirements?
It requires Rust 1.95+ and is built from source with cargo; earlier stable toolchains will likely work, but only 1.95 is tested.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.