Document forensics & domain recon

X-Ray

Two lenses on things you don't fully trust. Document: drop in a PDF and see what it quietly carries — who made it and with what, how many times it was revised, whether it hides scripts, and the text still readable under any “redaction” drawn on top. Domain recon: type a domain and get its DNS, the subdomains its certificates reveal, the network it lives on, and its TLS & HTTP posture. All passive and public — nothing is stored.

◈

Drop a PDF here, or click to choose

Processed in your browser session and discarded — nothing is stored or sent onward. Max 25 MB.

How to read this

Redaction that isn't. A black box drawn over text is just a graphic — the words are still in the file. If the extractable text shows what should be hidden, the redaction failed.
Revision history. PDFs saved incrementally stack old versions; content “removed” in a later edit can often be pulled from an earlier layer.
Authorship fingerprints. Author, and the tool that produced the file, are leads recorded by the software — useful, but not proof on their own.
Active content is named, never run. JavaScript, auto-run actions, and embedded files are flagged so you know they're there.
Domain recon is passive. DNS, Certificate-Transparency subdomains, and the network/ASN come from third parties and never touch the target; TLS & HTTP probes connect only when the host resolves to public addresses (an SSRF guard).