Demo — no DNS lookups are performed and no subdomains are contacted
Demo. This page shows the tool's interface and how it scores what it finds. Live analysis is not running for you yet.
Live access is by invitation. Verify an approved email to run this page against your own target, or ask for access.
How it works
1Probe 60+ common subdomains (www, api, staging, blog, dev, cdn, mail…) for CNAME records via DNS-over-HTTPS
2Match each CNAME target against 28 service fingerprints — GitHub Pages, Heroku, Netlify, Vercel, Azure, S3, Shopify, Fastly, Zendesk, and more
3For matched CNAMEs, HTTP-confirm by fetching the subdomain and checking for unclaimed service body fingerprints
4For unrecognised CNAMEs, check if the CNAME target has a live A record — if not, it's a dangling pointer attackers could claim