🌊 Fathom

Attack Surface Intelligence Engine — reveal everything exposed before attackers do.

Discover a domain's subdomains, see which are alive, where they're hosted, what they run, and which look like Shadow IT — then get fix recommendations. No API keys. No sign-ups. One Windows app, click and run.

⬇️ Download · ✨ Features · 📖 Usage · ⚙️ How it works · ⚠️ Disclaimer

Organizations lose track of what they expose on the internet. Forgotten dev, staging, and old-api subdomains, dangling DNS records, and exposed admin panels — collectively Shadow IT — are exactly what attackers look for first. Professional discovery tools usually need paid API keys and a steep learning curve.

Fathom maps a domain's external attack surface using only free, public sources and an offline database — wrapped in a clean desktop app that anyone can run. Type a domain, get an actionable intelligence report. Like a sailor's sounding line measuring the depths before sailing further, Fathom measures how deep and how wide a domain's exposed footprint really goes.

• 🔍 Subdomain discovery (no API key) — Certificate Transparency (crt.sh), Wayback Machine, and DNS brute force.
• 🧪 Wildcard-aware — detects wildcard DNS and filters out false positives.
• ⚡ Active host validation — alive/dead with precise statuses (timeout, TLS error, refused), status code, server, and page title.
• 🌐 Offline geolocation & ASN — country/city/org per IP, no network call.
• 🧬 Technology fingerprinting — WordPress, Next.js, Laravel, Nginx, Cloudflare, and more.
• 🕵️ Shadow IT, exposed-panel & subdomain-takeover detection with fix recommendations.
• 📊 Transparent risk score — every point is explained.
• 🌍 Bilingual — full Indonesian / English UI and reports.
• 📁 Reports — self-contained HTML, JSON, and CSV; reopen saved scans.
• 🎨 Modern GUI — dark/light themes, sortable/filterable table, helpful hints on every menu.
• 💻 Single .exe — install nothing else.

Cross-platform note: the code also runs on Linux/macOS from source (python main.py), but official binaries are Windows-only for now.

Two options — pick whichever suits you:

1. Go to Releases.
2. Installer — download FathomSetup.exe, run it, get a Start Menu shortcut and a proper uninstaller. (Recommended for most people.)
3. Portable — download Fathom.exe and double-click to run, no installation needed. Good for USB sticks / no-admin environments.

First launch on Windows may show SmartScreen ("Windows protected your PC") because the .exe is not yet code-signed. Click More info → Run anyway. You can verify integrity with the published *.sha256.txt checksum.

git clone https://github.com/n0xnull/Fathom.git
cd Fathom
python -m venv .venv && .venv\Scripts\activate     # Windows
pip install -r requirements.txt
python main.py

# Windows, one click:
build.bat
# or manually:
pip install -r requirements-dev.txt
pyinstaller fathom.spec --noconfirm
# -> dist\Fathom.exe

# Requires Inno Setup 6 (https://jrsoftware.org/isdl.php)
installer\build-installer.bat
# -> installer\Output\FathomSetup.exe

1. Type a domain (e.g. example.com) in the input box.
2. Pick a mode:
   • Passive (safe) — public sources only; never touches the target server.
   • Full (active) — adds DNS brute force + HTTP/HTTPS probing; asks you to confirm you're authorized.
3. Click Start Scan. Watch progress + live log; Cancel any time.
4. Browse the subdomain table (sort/filter), click a row for details.
5. Review Shadow IT / findings and recommendations.
6. Export an HTML report, JSON, or CSV — each export is saved with a unique Fathom_[domain]_[timestamp] filename, so nothing gets overwritten. Saved scans can be reopened later.

Every menu item also shows a hint in the status bar when you hover it.

python -m fathom.cli example.com --mode passive --lang en --format all

input domain
  → apex intel (DNS records, SPF/DMARC, RDAP, TLS)
  → wildcard guard
  → enumeration (crt.sh + Wayback + brute force[Full])
  → DNS resolve  → active probe[Full]
  → GeoIP/ASN (offline)  → fingerprint + TLS
  → Shadow IT / takeover / posture analysis
  → transparent risk score
  → report (HTML / JSON / CSV)

Free, no-key data sources: Certificate Transparency (crt.sh), Wayback Machine CDX, live DNS, RDAP, direct TLS handshakes, and an offline GeoIP database (DB-IP Lite / GeoLite2 — see fathom/data/geoip/README.md).

Honest note: without paid intelligence APIs, subdomain coverage is smaller than tools like Amass + Shodan. In exchange, Fathom is offline-friendly, dependency-free for the user, and ideal as a trusted internal tool.

• v1.1 — Wayback link mining, HTML/JS crawling, AXFR, richer TLS analysis. ✅ (unique export filenames + installer)
• v1.2 — reverse DNS, PDF reports, expanded takeover signatures.
• v2.0 — multi-domain view, scan history & diffing, scheduling.

Issues and PRs welcome. Add a new subdomain source by subclassing BaseSource and registering it in sources/registry.py — the engine needs no other change.

For authorized security testing and educational use only. Scan only domains you own or are permitted to test. See DISCLAIMER.md.

MIT © Abil Khosim. GeoIP data is provided under its respective license (DB-IP: CC-BY / MaxMind: GeoLite2 EULA).