Echo Scanner

See your attack surface the way an attacker does.

Before anyone runs a single exploit, they quietly map your DNS, email and hosting footprint. This passive recon scanner shows the high-level data they can collect in seconds – safely, with read-only lookups.

DNS records loading…
Passive only – no intrusive scanning
DNS & WHOIS footprint overview
Perfect for small & mid-size businesses

What this tool shows you

High-level signals attackers use during recon, including:

  • • A / AAAA records – where your website actually lives
  • • MX & NS records – email & DNS infrastructure
  • • TXT records – SPF / DKIM / other security hints
  • • SOA & WHOIS highlights – registrar & lifecycle data

What it does not do

This is a safe demo, not a full penetration test.

  • • No active port scanning or service enumeration
  • • No exploitation or “breaking in” attempts
  • • No changes to your DNS or infrastructure
  • • For a full assessment, you still need a scoped pentest.

DNS & WHOIS Passive Recon

Type a domain you control or want to evaluate (e.g. example.com).
Passive DNS
WHOIS summary
No intrusive traffic

High-level summary

  • • Run a scan to see your footprint.
{ "message": "Results will appear here as JSON once you run a scan." }

From one snapshot to ongoing protection.

This scan is just the reconnaissance piece. In real-world attacks, this view is combined with web, API, network and identity weaknesses — and attackers probe you continuously, not once. That’s why most of my clients move from a single assessment into an ongoing security care plan.

  • • Monthly or quarterly external checks on your real attack surface
  • • Human-reviewed findings instead of raw tool output
  • • Re-testing after you’ve fixed critical issues
  • • Clear, prioritised actions for owners, not just engineers
No automated spam, no pressure — just a technical walk-through of what long-term protection would look like for your business.
  • External attacker view of your web & API surface
  • Network & infrastructure testing for exposed services
  • Identity & access weaknesses that enable account takeover
  • Business-logic paths specific to how your apps work