What makes it different: - 100% local & private - no data leaves your machine - Zero API costs - uses Ollama with models like DeepSeek-R1 and Qwen2.5-Coder - 20 passive sources (crt.sh, Certspotter, AlienVault, etc.) - AI analysis of discovered subdomains for security insights - Written in Go for speed
I built this because most subdomain tools just dump lists without context. Adding AI analysis helps identify interesting targets faster during pentests and bug bounties, but I wanted to keep everything local for privacy and cost.
The AI features are optional - you can use it as a traditional enum tool too.
Would love feedback from the security folks here! What other analysis would be useful to add?