What the scanner actually does

The scanner starts with the public domain signals that are most reliable for understanding internet presence: DNS records, WHOIS or RDAP registration data, email-authentication records and DNSSEC state. These records reveal who owns the domain, which name servers are in use, what mail infrastructure is present, and whether the delegation is signed. This is the foundation for any deeper reconnaissance work.

Once the domain layer is collected, the scanner moves into discovery and enrichment. It looks for subdomains, resolves their IP addresses, probes reachable services, fetches TLS certificate information, classifies the exposed service, and identifies hosting or CDN relationships. On advanced scans it also enriches the IPs with ASN data so that infrastructure ownership becomes easier to understand at a glance.

Security analysis runs in parallel with that enrichment. The tool checks for common defensive headers, evaluates the security posture of each host, classifies exposure patterns, and produces a risk-oriented result rather than merely listing records. That approach is more useful than a pure inventory dump because it connects the raw records to operational meaning.

Basic scan

Basic scan is the default mode because it is the fastest and least noisy view of a domain. It focuses on the data that is most useful for an initial assessment: DNS records, WHOIS information, email security, DNSSEC and a risk summary. It is the right choice when you want a quick answer without waiting for the deeper discovery stages.

In practice, Basic scan is ideal for situations such as verifying a domain before trusting it, checking whether mail authentication is configured, confirming registrar and expiry details, or deciding whether a deeper scan is worth running. Because it avoids the heavier host-level probes, it is also the most efficient mode for repeated checks.

The Basic scan view is intentionally concise. It should show the domain overview, DNS records, registrar metadata, SPF, DKIM, DMARC, DNSSEC state and the top-level risk outcome. There is no need to clutter this mode with subdomains or low-level fingerprinting output, because the point of Basic is to answer the first question quickly: what is this domain, who owns it, and is the core authentication posture reasonable?

Medium scan

Medium scan expands the report into a more complete operational view. It keeps everything useful from Basic mode and adds subdomain discovery, infrastructure analysis, hosting detection, WAF detection, exposure checks, host-level security scoring and summary statistics. This is the mode that will usually be most useful for a blue-team workflow, asset inventory or bug bounty recon.

Medium scan is where the report starts to answer questions about how the domain is deployed in practice. You can see which hosts are alive, which ones are likely public-facing web services, whether a CDN or reverse proxy is in front of them, and which ones appear to expose potentially interesting surface area such as public APIs or JSON endpoints. That is far more actionable than a basic registrar lookup.

Because Medium scan includes subdomain records and host summaries, it should be rendered as a continuous report rather than a tabbed layout. The user should be able to read the summary, inspect the DNS and WHOIS data, and then scroll directly into the discovered hosts. Each host should be presented as a card with clear sections for classification, infrastructure, security, exposure and risk.

Advanced scan

Advanced scan is the full report. It includes everything from Basic and Medium, plus TLS certificate details, HTTP behaviour, fingerprinting, full header analysis, cookies, raw web metadata and ASN enrichment for every IP address. This is the mode that gives you the most complete picture of a domain’s external presence.

Advanced mode is best suited to authenticated users because it exposes more detailed reconnaissance data. That does not make the information secret; it simply means the platform is avoiding unnecessary verbosity for anonymous use. The extra detail is valuable, but it is also the sort of detail that should be deliberate rather than automatic.

In Advanced mode, the scanner can show certificate issuers and validity windows, HTTP method support, fingerprinting evidence, response headers, cookies, web fingerprints and ASN organisation mapping. That gives analysts enough context to understand not only that a host exists, but how it is wired into the wider internet.

How to interpret the results

A domain intelligence report is most useful when you read it in layers. Start with the summary because it tells you whether the domain is healthy, minimal, risky or heavily exposed. Then check the domain-level records to understand registration and mail configuration. After that, inspect the discovered hosts and look for patterns: shared CDN presence, repeated ASN ownership, surprising exposure, inconsistent security headers or public APIs that were not expected.

Security grades should be treated as indicators, not absolutes. A host with a good score can still be operationally risky if it exposes an API or sensitive functionality. A host with a modest score can still be acceptable if the exposed functionality is intentionally public and tightly controlled. The goal is not to produce a single perfect number; the goal is to understand where the risk sits and which parts of the stack need attention.

Likewise, ASN information should be used to identify ownership and routing relationships rather than to make assumptions about legitimacy. Large providers such as Cloudflare, AWS, Fastly or Google can host many different services, and identical ASN data does not mean the services are equivalent. It simply helps connect IP addresses back to the infrastructure layer.

Why the tool is structured this way

The current backend is returning a rich report structure that includes domain intelligence, source metadata and per-host enrichment. That means the frontend should not hide everything behind tabs or flatten the response into a tiny summary. A single scrollable report is a better match for the data because it lets the user move naturally from high-level context to host-level detail without losing the thread.

The layout also helps with future expansion. If you later add additional intelligence such as historical DNS, reverse IP lookup, reputation, certificate transparency or service-specific findings, the page can simply append new sections instead of being redesigned from scratch. That is why the content and the visual hierarchy matter as much as the raw API response.

In other words, the scanner is no longer a single-purpose widget. It is becoming an infrastructure intelligence report generator. The page should look and behave like one.

Who should use this

• Security analysts reviewing external attack surface.
• Blue teams validating domain posture and exposure.
• Bug bounty hunters mapping owned assets.
• Developers checking DNS, registrar and mail configuration.
• System administrators reviewing hosting and certificate state.
• Incident responders correlating domains, hosts and routing data.
• Threat researchers building a quick picture of internet presence.

What good output looks like

Good output is not just complete; it is readable. A strong report should make it obvious which hosts are alive, which ones are public-facing, which ones are protected by a CDN or WAF, and which security controls are present or missing. It should also show where the report is uncertain, especially when a provider times out or a challenge page prevents a deeper fetch.

For example, if a host is behind a challenge page, that is still a meaningful result. It tells you the service is present, reachable and protected, even if the scanner cannot retrieve full page content. Likewise, an empty DKIM result is not a failure of the scanner; it is a useful indicator that a mail-authentication layer may be missing or incomplete.

Frequently asked questions

Related tools

Practical reading order

If you are using the scanner for the first time, the best reading order is simple: start with the summary, then inspect DNS and WHOIS, then look at email security and DNSSEC, then move to subdomains, and finally dig into host details. That keeps the analysis efficient and prevents you from getting lost in a wall of technical detail before you understand the domain as a whole.

For deeper review, the host cards are where most of the value sits. A host card should reveal classification, hosting, WAF, security, risk, exposure, HTTP behaviour, TLS details and ASN ownership. If a host has multiple IPs, the ASN section becomes especially useful because it helps separate routing ownership from content ownership.

The scanner is most effective when it is used iteratively. Start with Basic, move to Medium when you need infrastructure and exposure context, then use Advanced when you need a complete external profile of the domain and its live services. That layered approach is faster and more disciplined than always jumping straight to the heaviest mode.