🌊 Fathom

Attack Surface Intelligence Engine — reveal everything exposed before attackers do.

Discover a domain's subdomains, see which are alive, where they're hosted, what they run, and which look like Shadow IT — then get fix recommendations. No API keys. No sign-ups. One Windows app, click and run.

⬇️ Download · ✨ Features · 📖 Usage · ⚙️ How it works · ⚠️ Disclaimer

---

Important

Educational & Defensive Security Research Disclaimer
This project is developed strictly for educational purposes, defensive security research, and authorized security auditing. The developer (@n0xnull) does not condone or support unauthorized testing or malicious use. Users are solely responsible for complying with all applicable local, national, and international laws. See DISCLAIMER.md for full terms.

🇮🇩 Baca dalam Bahasa Indonesia

Fathom — Mesin Intelijen Attack Surface

Fathom adalah aplikasi Windows desktop yang membantu tim keamanan memetakan permukaan serangan (attack surface) domain mereka — gratis, tanpa API key.

Ketik sebuah domain, Fathom akan menemukan subdomain tersembunyi, memvalidasi mana yang aktif, mendeteksi teknologi yang berjalan, dan mengidentifikasi Shadow IT (subdomain terlupakan, panel admin terbuka, potensi subdomain takeover) — lengkap dengan rekomendasi perbaikan dan skor risiko transparan.

Mode: Pasif (hanya sumber publik) dan Penuh/aktif (DNS brute force + HTTP probing). Output: Laporan HTML, JSON, dan CSV. Antarmuka & laporan bilingual ID/EN.

⚠️ Gunakan hanya pada domain milik Anda atau yang telah memberikan izin tertulis. Lihat DISCLAIMER.md.

🎬 Demo

Scanning a domain: subdomain discovery, live validation, and per-asset findings.

▶️ Watch the full walkthrough (85s, with audio) — attached to the latest release.

---

🧩 The Problem

Organizations lose track of what they expose on the internet. Forgotten dev, staging, and old-api subdomains, dangling DNS records, and exposed admin panels — collectively Shadow IT — are exactly what attackers look for first. Professional discovery tools usually need paid API keys and a steep learning curve.

Fathom maps a domain's external attack surface using only free, public sources and an offline database — wrapped in a clean desktop app that anyone can run. Type a domain, get an actionable intelligence report. Like a sailor's sounding line measuring the depths before sailing further, Fathom measures how deep and how wide a domain's exposed footprint really goes.

✨ Key Features

• 🔍 Subdomain discovery (no API key) — Certificate Transparency (crt.sh), Wayback Machine, and DNS brute force.
• 🧪 Wildcard-aware — detects wildcard DNS and filters out false positives.
• ⚡ Active host validation — alive/dead with precise statuses (timeout, TLS error, refused), status code, server, and page title.
• 🌐 Offline geolocation & ASN — country/city/org per IP, no network call.
• 🧬 Technology fingerprinting — WordPress, Next.js, Laravel, Nginx, Cloudflare, and more.
• 🕵️ Shadow IT, exposed-panel & subdomain-takeover detection with fix recommendations.
• 📊 Transparent risk score — every point is explained.
• 🌍 Bilingual — full Indonesian / English UI and reports.
• 📁 Reports — self-contained HTML, JSON, and CSV; reopen saved scans.
• 🎨 Modern GUI — dark/light themes, sortable/filterable table, helpful hints on every menu.
• 💻 Single .exe — install nothing else.

🖼️ Screenshots

💻 System Requirements

	Minimum
OS	Windows 10 or 11, 64-bit (Qt 6 dropped Windows 7/8)
RAM	2 GB
Disk	~150 MB free
Network	Internet connection for online sources (the app itself needs no install)

Cross-platform note: the code also runs on Linux/macOS from source (python main.py), but official binaries are Windows-only for now.

⬇️ Installation

For users (recommended)

Two options — pick whichever suits you:

1. Go to Releases.
2. Installer — download FathomSetup.exe, run it, get a Start Menu shortcut and a proper uninstaller. (Recommended for most people.)
3. Portable — download Fathom.exe and double-click to run, no installation needed. Good for USB sticks / no-admin environments.

First launch on Windows may show SmartScreen ("Windows protected your PC") because the .exe is not yet code-signed. Click More info → Run anyway. You can verify integrity with the published *.sha256.txt checksum.

For developers (run from source)

git clone https://github.com/n0xnull/Fathom.git
cd Fathom
python -m venv .venv && .venv\Scripts\activate     # Windows
pip install -r requirements.txt
python main.py

Build the .exe yourself

# Windows, one click:
build.bat
# or manually:
pip install -r requirements-dev.txt
pyinstaller fathom.spec --noconfirm
# -> dist\Fathom.exe

Build the installer yourself

# Requires Inno Setup 6 (https://jrsoftware.org/isdl.php)
installer\build-installer.bat
# -> installer\Output\FathomSetup.exe

📖 How to Use

1. Type a domain (e.g. example.com) in the input box.
2. Pick a mode:
   • Passive (safe) — public sources only; never touches the target server.
   • Full (active) — adds DNS brute force + HTTP/HTTPS probing; asks you to confirm you're authorized.
3. Click Start Scan. Watch progress + live log; Cancel any time.
4. Browse the subdomain table (sort/filter), click a row for details.
5. Review Shadow IT / findings and recommendations.
6. Export an HTML report, JSON, or CSV — each export is saved with a unique Fathom_[domain]_[timestamp] filename, so nothing gets overwritten. Saved scans can be reopened later.

What each menu does (beginner hints)

Every menu item also shows a hint in the status bar when you hover it.

Menu	What it does
File ▸ New Scan	Clear results and start a fresh domain.
File ▸ Open Result	Reopen a previously saved .json scan.
File ▸ Save Result	Save the full scan to reopen later.
File ▸ Export	HTML report (share/print), JSON (automation), CSV (Excel).
Scan ▸ Start / Cancel	Run or stop a scan.
Scan ▸ Mode	Switch between Passive (safe) and Full (active).
View ▸ Theme	Toggle dark/light.
View ▸ Language	Indonesian / English (also top-right).
Help ▸ Docs / Disclaimer / Updates / About	Guide, terms, latest version, credits.

Command line (optional)

python -m fathom.cli example.com --mode passive --lang en --format all

⚙️ How it Works

input domain
  → apex intel (DNS records, SPF/DMARC, RDAP, TLS)
  → wildcard guard
  → enumeration (crt.sh + Wayback + brute force[Full])
  → DNS resolve  → active probe[Full]
  → GeoIP/ASN (offline)  → fingerprint + TLS
  → Shadow IT / takeover / posture analysis
  → transparent risk score
  → report (HTML / JSON / CSV)

Free, no-key data sources: Certificate Transparency (crt.sh), Wayback Machine CDX, live DNS, RDAP, direct TLS handshakes, and an offline GeoIP database (DB-IP Lite / GeoLite2 — see fathom/data/geoip/README.md).

Honest note: without paid intelligence APIs, subdomain coverage is smaller than tools like Amass + Shodan. In exchange, Fathom is offline-friendly, dependency-free for the user, and ideal as a trusted internal tool.

🗺️ Roadmap

• v1.1 — Wayback link mining, HTML/JS crawling, AXFR, richer TLS analysis. ✅ (unique export filenames + installer)
• v1.2 — reverse DNS, PDF reports, expanded takeover signatures.
• v2.0 — multi-domain view, scan history & diffing, scheduling.

🤝 Contributing

Issues and PRs welcome. Add a new subdomain source by subclassing BaseSource and registering it in sources/registry.py — the engine needs no other change.

📄 License

MIT © Abil Khosim. GeoIP data is provided under its respective license (DB-IP: CC-BY / MaxMind: GeoLite2 EULA).

---

---

👤 Developed by Abil Khosim

Cybersecurity Specialist

Fathom is an original project by Abil Khosim, an independent security tool by Abil Khosim (NoxNull). Released under the MIT License — © 2026 Abil Khosim. Please keep this attribution when reusing or redistributing.

_{Know your depth before you're in over your head. 🌊}