Discover a domain's subdomains, see which are alive, where they're hosted, what they run, and which look like Shadow IT — then get fix recommendations. No API keys. No sign-ups. One Windows app, click and run.
⬇️ Download · ✨ Features · 📖 Usage · ⚙️ How it works ·
Organizations lose track of what they expose on the internet. Forgotten
dev, staging, and old-api subdomains, dangling DNS records, and exposed
admin panels — collectively Shadow IT — are exactly what attackers look for
first. Professional discovery tools usually need paid API keys and a steep
learning curve.
Fathom maps a domain's external attack surface using only free, public sources and an offline database — wrapped in a clean desktop app that anyone can run. Type a domain, get an actionable intelligence report. Like a sailor's sounding line measuring the depths before sailing further, Fathom measures how deep and how wide a domain's exposed footprint really goes.
- 🔍 Subdomain discovery (no API key) — Certificate Transparency (crt.sh), Wayback Machine, and DNS brute force.
- 🧪 Wildcard-aware — detects wildcard DNS and filters out false positives.
- ⚡ Active host validation — alive/dead with precise statuses (timeout, TLS error, refused), status code, server, and page title.
- 🌐 Offline geolocation & ASN — country/city/org per IP, no network call.
- 🧬 Technology fingerprinting — WordPress, Next.js, Laravel, Nginx, Cloudflare, and more.
- 🕵️ Shadow IT, exposed-panel & subdomain-takeover detection with fix recommendations.
- 📊 Transparent risk score — every point is explained.
- 🌍 Bilingual — full Indonesian / English UI and reports.
- 📁 Reports — self-contained HTML, JSON, and CSV; reopen saved scans.
- 🎨 Modern GUI — dark/light themes, sortable/filterable table, helpful hints on every menu.
- 💻 Single
.exe— install nothing else.
| Minimum | |
|---|---|
| OS | Windows 10 or 11, 64-bit (Qt 6 dropped Windows 7/8) |
| RAM | 2 GB |
| Disk | ~150 MB free |
| Network | Internet connection for online sources (the app itself needs no install) |
Cross-platform note: the code also runs on Linux/macOS from source (
python main.py), but official binaries are Windows-only for now.
Two options — pick whichever suits you:
- Go to Releases.
- Installer — download
FathomSetup.exe, run it, get a Start Menu shortcut and a proper uninstaller. (Recommended for most people.) - Portable — download
Fathom.exeand double-click to run, no installation needed. Good for USB sticks / no-admin environments.
First launch on Windows may show SmartScreen ("Windows protected your PC") because the
.exeis not yet code-signed. Click More info → Run anyway. You can verify integrity with the published*.sha256.txtchecksum.
git clone https://github.com/n0xnull/Fathom.git
cd Fathom
python -m venv .venv && .venv\Scripts\activate # Windows
pip install -r requirements.txt
python main.py# Windows, one click:
build.bat
# or manually:
pip install -r requirements-dev.txt
pyinstaller fathom.spec --noconfirm
# -> dist\Fathom.exe# Requires Inno Setup 6 (https://jrsoftware.org/isdl.php)
installer\build-installer.bat
# -> installer\Output\FathomSetup.exe- Type a domain (e.g.
example.com) in the input box. - Pick a mode:
- Passive (safe) — public sources only; never touches the target server.
- Full (active) — adds DNS brute force + HTTP/HTTPS probing; asks you to confirm you're authorized.
- Click Start Scan. Watch progress + live log; Cancel any time.
- Browse the subdomain table (sort/filter), click a row for details.
- Review Shadow IT / findings and recommendations.
- Export an HTML report, JSON, or CSV — each export is saved with a unique
Fathom_[domain]_[timestamp]filename, so nothing gets overwritten. Saved scans can be reopened later.
Every menu item also shows a hint in the status bar when you hover it.
| Menu | What it does |
|---|---|
| File ▸ New Scan | Clear results and start a fresh domain. |
| File ▸ Open Result | Reopen a previously saved .json scan. |
| File ▸ Save Result | Save the full scan to reopen later. |
| File ▸ Export | HTML report (share/print), JSON (automation), CSV (Excel). |
| Scan ▸ Start / Cancel | Run or stop a scan. |
| Scan ▸ Mode | Switch between Passive (safe) and Full (active). |
| View ▸ Theme | Toggle dark/light. |
| View ▸ Language | Indonesian / English (also top-right). |
| Help ▸ Docs / Disclaimer / Updates / About | Guide, terms, latest version, credits. |
python -m fathom.cli example.com --mode passive --lang en --format allinput domain
→ apex intel (DNS records, SPF/DMARC, RDAP, TLS)
→ wildcard guard
→ enumeration (crt.sh + Wayback + brute force[Full])
→ DNS resolve → active probe[Full]
→ GeoIP/ASN (offline) → fingerprint + TLS
→ Shadow IT / takeover / posture analysis
→ transparent risk score
→ report (HTML / JSON / CSV)
Free, no-key data sources: Certificate Transparency (crt.sh), Wayback Machine
CDX, live DNS, RDAP, direct TLS handshakes, and an offline GeoIP database
(DB-IP Lite / GeoLite2 — see fathom/data/geoip/README.md).
Honest note: without paid intelligence APIs, subdomain coverage is smaller than tools like Amass + Shodan. In exchange, Fathom is offline-friendly, dependency-free for the user, and ideal as a trusted internal tool.
- v1.1 — Wayback link mining, HTML/JS crawling, AXFR, richer TLS analysis. ✅ (unique export filenames + installer)
- v1.2 — reverse DNS, PDF reports, expanded takeover signatures.
- v2.0 — multi-domain view, scan history & diffing, scheduling.
Issues and PRs welcome. Add a new subdomain source by subclassing BaseSource
and registering it in sources/registry.py — the engine needs no other change.
For authorized security testing and educational use only. Scan only domains you own or are permitted to test. See DISCLAIMER.md.
MIT © Abil Khosim. GeoIP data is provided under its respective license (DB-IP: CC-BY / MaxMind: GeoLite2 EULA).
Cybersecurity Specialist
Fathom is an original project by Abil Khosim, part of the NoxNull toolkit. Released under the MIT License — © 2026 Abil Khosim. Please keep this attribution when reusing or redistributing.
Know your depth before you're in over your head. 🌊