"Map the surface. Own the signal."
The OPSEC-native OSINT framework — a shared stealth egress layer, one-click Tor, and an honest per-scan report of exactly what you leaked.
pip install deadrecon
A single deadrecon scan orchestrates the entire pipeline — resolving DNS and WHOIS, mapping open ports and services, fingerprinting the technology stack, correlating threat intelligence across dozens of API sources, and crawling the public web surface — then rolls every finding into a single Risk Score and writes a shareable HTML report.
$ deadrecon scan example.com --profile standard --format html ◈ Target : example.com (domain) ◈ Profile : standard (~2–5 min) ◈ Modules : dns_recon port_scan tech_detect api_hunt web_crawl intel [1/6] DNS & WHOIS ......... 42 records · 7 subdomains [2/6] Port scan .......... 6 open · 22 80 443 8080 … [3/6] Tech fingerprint ... nginx · Cloudflare · React · WordPress [4/6] Threat intel ....... 31 sources queried · 0 malicious [5/6] Web crawl .......... 128 URLs · 3 exposed endpoints [6/6] Scoring ............ Risk Score 34 / 100 (MEDIUM) ◈ Attribution : EXPOSED — 100% of HTTP proxied · attributable: port_scan, intel ✓ Report written → ./reports/example.com.html
DeadRecon 1.29 makes Tor work from one click and checks its OPSEC grades against packet captures. If you used Tor before 1.29.0, those scans were not on Tor. No other open-source OSINT framework tells you what a scan leaked about you.
Click 🧅 and DeadRecon starts Tor for you, with nothing to install or configure. It fails closed: each scan confirms it's on Tor before touching the target and stops if it can't. Modules that would bypass Tor are skipped and listed in the report, and .onion addresses are never sent to a resolver.
The web console now requires a login. Blocks SSRF and DNS rebinding, adds a nonce-based CSP, parses hostile XML safely, and runs Docker as non-root with dependencies pinned by hash.
Every scan ends with an honest OPSEC grade — masked, partial, exposed or quiet — computed from real egress telemetry and checked against packet captures: % proxied vs. direct, JA3/JA4 fingerprints presented, WAF challenges, and a per-module breakdown of what's masked vs. traceable to you. The grade is deliberately unflattering.
A shared client for web recon and proxied modules: rotating proxy pool, per-host adaptive pacing, sticky browser identity, and optional JA3/JA4 impersonation. Seed the pool in one click from curated free feeds or an uploaded list, watch your posture in the navbar chip, and it all persists across restarts.
The vuln_scan module wraps nuclei, emitting normalised-severity vulnerability findings into the Findings & Exposure view and exporting them as STIX 2.1 Vulnerability SDOs. Active and loud, so it's strictly opt-in, and always reported as attributable: don't rely on a proxy to hide it.
Optional Go-native tools join the pipeline when installed — subfinder, naabu, katana, tlsx — each tagged honestly in the attribution report. subfinder and katana use your proxy; naabu and tlsx can't, so they're reported as attributable. A binary-free install keeps working: every adapter falls back to its pure-Python module.
Eight new keyless Profiler sources — XposedOrNot breaches (no HIBP key), a GitHub commit-email harvester, GitLab, Wikidata, WebFinger, offline phone metadata, openFEC, and OpenCorporates. Every Profiler run is now saved as a scan with history, summary, and export.
A @register_module / @register_api registry — new recon modules and intel sources join the pipeline by registering, each declaring its OPSEC posture up front so the attribution report always grades a run honestly.
Six intelligence modules. One unified platform.
Deep crawler that runs through the stealth layer. Technology fingerprinting across 50+ stacks — CMS, frameworks, CDNs, WAFs. API endpoint discovery, security header analysis, email and link harvesting.
Full DNS enumeration — A, MX, NS, TXT, SOA, CAA. Zone transfer attempts on direct scans. Subdomain brute-force plus certificate transparency via crt.sh. SPF/DMARC spoofing analysis.
nmap-powered service & OS detection (-sV -O) with transparent pure-Python async fallback. 99 ports by default, 1 000+ or full 65 535 on demand. Risk-based assessment flags databases, admin panels, and exposed dev services.
50+ integrations: Shodan, VirusTotal, AbuseIPDB, GreyNoise, AlienVault OTX, Intelligence X, and dozens of social/people sources — many keyless. Plugin architecture for custom sources. Keyed providers connect directly unless Tor is on, and the report says so.
People intelligence from public records — eight keyless sources (breaches, commit-email harvesting, Wikidata, WebFinger, offline phone, and more) cross-correlating emails, phones, socials, and aliases. Every run is saved as a scan; outputs a Risk Score.
JSON, CSV, HTML, PDF, XLSX, STIX 2.1, XML, Markdown. All formats support ZIP compression and AES-256-GCM encryption. Share client-ready reports or feed results into your SIEM.
Three stealth profiles (off / quiet / paranoid) drive per-host adaptive pacing, sticky browser identity, and JA3/JA4 impersonation over a rotating proxy pool — seed it in one click from curated free feeds or an uploaded list. One-click Tor. And every run reports exactly what it leaked.
# CLI — set the OPSEC posture per scan deadrecon scan target.com \ --opsec paranoid \ --format json # Web UI — Settings → Scan Settings Stealth profile : paranoid Proxy pool : Fetch & Add ✓ (curated free feeds) Rotation : sticky · burned egresses auto-benched # Tor — one click on 🧅 in the console, or: deadrecon scan example.com --tor # Navbar chip shows live posture: 🕶 PARANOID · pool 42 · JA3 on
Every scan produces a Risk Score (0–100) — a weighted composite of open ports, vulnerability findings, missing security controls, and threat intelligence flags.
# Install from PyPI pip install deadrecon # Initialize database deadrecon init # Launch web UI deadrecon web --open-browser # → http://127.0.0.1:5000 # The first run prints a setup token; use it to create your account # Or scan straight from the CLI deadrecon scan example.com
git clone https://github.com/getdeadrecon/deadrecon cd deadrecon docker-compose up -d docker logs deadrecon # copy the first-run setup token # Open http://localhost:5000 and create your account
git clone https://github.com/getdeadrecon/deadrecon cd deadrecon python -m venv .venv source .venv/bin/activate # Windows: .venv\Scripts\activate pip install -e . deadrecon web --open-browser # Open http://127.0.0.1:5000 and use the setup token it prints
# IP recon — nmap version + OS detection, GeoIP, panels deadrecon scan 192.168.1.1 --type ip_recon # Domain recon, quiet OPSEC posture, HTML report deadrecon scan example.com \ --profile standard --opsec quiet \ --format html --output ./reports # Over Tor: starts it for you, and stops if it can't confirm it deadrecon scan example.com --tor # People intelligence deadrecon profile \ --email target@example.com \ --first-name John --last-name Doe # See which API sources are configured deadrecon status
⚠ For authorized use only. See the Legal & Ethics section before running any scan.
A whole tier works with zero API keys — add your own in Integrations to go deeper. Under Tor, every source uses Tor.
Open-source. MIT licensed. No telemetry. No phone-home. Your recon stays on your machine.