⚠ This tool queries Shodan InternetDB (passive, no packets) and optionally HackerTarget's nmap API (live scan from their servers). For multi-IP hosts all resolved IPs are queried. Results may differ from a local nmap depending on network path and scan scope.

Network Reconnaissance Scanner

Queries Shodan InternetDB across all resolved IPs, runs a live nmap via HackerTarget, and fetches geolocation from ipinfo.io — aggregated and deduplicated into one view.

MULTI-SOURCE — REAL DATA
  recon.js — live OSINT query
via Shodan · HackerTarget · ipinfo
// Network Reconnaissance Scanner — multi-source mode
// Enter a public IP or hostname and press Lookup.
// Sources: Shodan (all IPs) · HackerTarget nmap · ipinfo.io
 
$
Data sources:
Open Ports
CVEs Found
Hostnames
Country
Target Intelligence

Attack Surface Distribution

HIGH
0%
MEDIUM
0%
LOW
0%
Open Ports
Port Risk Service Category Sources

How It Works

Three live data sources. Zero packets sent. Real indexed intelligence.

🛡

Passive OSINT Only

No TCP connections are made to the target. All data is sourced from public internet-scan databases that have already crawled billions of IPs.

📡

Shodan InternetDB

Queries Shodan's free InternetDB API for open ports, CPEs (software fingerprints), known CVEs, hostnames, and classification tags for any public IP.

🌍

Geolocation & ASN

Fetches IP geolocation, organization, ASN, city, region, and timezone from ipinfo.io — useful for attribution and threat context.

🔗

DNS Resolution

Resolves hostnames to IPs via Cloudflare's DNS-over-HTTPS API before querying OSINT sources — no DNS leaks, fully browser-native.

🚨

CVE Intelligence

Surfaces actual CVEs associated with the target IP from Shodan's database, linked directly to NVD for full vulnerability details.

📄

JSON Export

Downloads a structured JSON report of all fetched data — ports, CVEs, hostnames, tags, and geolocation — for pipeline integration.

// CLI Usage (Python scanner)

# Install dependencies
pip install -r requirements.txt

# Basic scan — top 1024 ports
python scanner.py --target 192.168.1.1

# Full scan with subdomain enum + HTML report
python scanner.py --target example.com --ports 1-65535 --threads 200 --subdomains --output both

# Quick localhost demo (no target needed)
python scanner.py --demo