Subdomain explorer

Peek at benign infrastructure labels before you widen your roadmap. Lightweight DNS fingerprints only.

Apex domain

We append a curated prefix list (31 combos) using Cloudflare public DNS-over-HTTPS. Omit leading `www` so probes stay symmetrical.

Not a brute force engine

This BenOpt preset stops at polite nouns founders actually deploy: dashboards, portals, CDN edges, SMTP helpers, staging sandboxes. You will not paste giant dictionaries here because we refuse to pretend this is covert reconnaissance tooling.

Concurrency intentionally stays low inside the Worker so resolver etiquette stays intact. Loud failures become explicit rows instead of hanging the entire panel.

Combine with fuller DNS lookups

After you skim IPv4 footprints, broaden with DNS record lookup for TXT, MX, and NS fidelity. Ownership narratives still belong in RDAP lookup when timelines matter more than pings.

Signals come from ephemeral resolver caches. Sensitive infrastructure should rely on authoritative monitoring, authenticated dashboards, or internal inventories instead of anonymous browser sessions.