A reconnaissance engine that watches a domain's edge from every angle at once: Forward DNS, Reverse PTR, certificate fingerprinting and a live sweep across 100 ports. No API key. No quota. No cost.
PARALLAX is an open, free emulator built for ethical reconnaissance: feed it a single domain and it rebuilds the entire network footprint by cross-referencing passive sources with live probes — never asking for a token or a subscription.
The name comes from parallax — the principle that an object changes appearance when observed from two viewpoints. Here the two viewpoints are Forward DNS (domain → IP) and Reverse DNS (IP → the hidden domains parked on the same host). Cross them and co-tenancy, shared CDNs and forgotten subdomains surface — things a one-directional scan would never see.
Resolves every discovered subdomain into its addresses, filtering loopback and non-routable ranges, building the first layer of the map: the domain → host graph.
For each IP it queries the PTR records and reveals the native hostname configured on the host — the pointer the forward lookup never shows.
Pulls Subject Alternative Names from public certificates via crt.sh, mapping logical nodes never linked by DNS.
Discovers every domain that co-tenants the same address through passive sources, with intelligent caching.
A 50-worker thread pool probes the most exposed ports in parallel — from SSH and RDP to databases, MQTT brokers, Elastic, Kubernetes and admin panels — returning open / closed state in real time.
Enriches each IP with historical ports, tags and known CVEs from global passive databases.
Resolves organization, Autonomous System and extended reverse lookup — zero keys — to give every node full context.
Every source is public and free. No sign-up, no quota that stalls the flow: launch and map immediately.
Logical nodes are pulled from certificate transparency and fallback engines without ever touching the target directly.
Each host resolves to an IP (forward) and each IP is queried back in reverse (PTR + co-tenancy), merging into one graph.
On surfaced IPs, a concurrent 100-port scan runs, enriched with vulnerability intel and ASN geo metadata.
One Python file, zero exotic dependencies, no key to request. Clone the repo, point it at an authorized domain and watch the map assemble in real time.