Eyes in the Network discovers every new subdomain the moment it appears, enriches it with DNS, HTTP, and port data, scans it for vulnerabilities, and alerts your team before attackers find it first.
Request a Demosubfinder, amass, assetfinder, findomain, crt.sh, Chaos, VirusTotal, and SecurityTrails, all running concurrently.
Every finding logs which source discovered it first, so you know what's actually new.
Every resolved subdomain runs through subzy. Candidates stay pending until an admin confirms or dismisses them from the dashboard — only then does it alert and count as real risk, so no noisy false positives.
Each new live host is crawled with katana (scoped to the root domain), and the URLs found are stored in the database — ready to feed the next iteration of targeted fuzzing or scanning.
Automated screenshots of every live host, captured as soon as it's discovered.
Web dashboard with per-subdomain detail and severity-colored findings, a full CRUD REST API, and a scriptable CLI with JSON/CSV export. Trends page charts subdomains, findings, and takeovers over 7/30/90 days.
Optional signed-cookie login — admin (full control) or auditor (read-only), with login rate limiting and a CSRF token on every write action.
A missing tool or an expired API key produces a warning, not a crash. The pipeline keeps running, and the last scan is always recorded.
One multi-stage image ships all 11 recon tools (Chromium for gowitness included), pre-compiled. docker compose up -d --build brings up the daemon and dashboard — nothing else to install by hand.
Telegram, Slack, and Discord notifications, filtered by severity. Every dispatch is audited in the alerts table.