Passive OSINT — Zero Scan Packets

See what attackers see.
Using only passive OSINT.

DNS, certificates, and public records reveal your entire external attack surface. No agents. No scanning. No credits. Just facts.

Join the Waitlist Try the Scanner Free
intelfunnel scan --passive
$ intelfunnel discover acme-corp.com
# No packets sent. No firewalls triggered.
Found 47 subdomains via CT logs
Email: Google Workspace (SPF strict, DMARC reject)
Cloud: AWS (14 hosts), Azure (3 hosts), Cloudflare (8 hosts)
UC: Microsoft Teams, Zoom (high confidence)
# Total time: 4.2 seconds
Zero scan packets
Results in seconds
No credits. Flat pricing.
DNS-first discovery
Why IntelFunnel

No scanning. No credits. No aggression.

Your attack surface is already public. We just organize it.

Passive Discovery

DNS records, certificate transparency logs, WHOIS, and MX analysis. We never send a single probe packet to your infrastructure. No firewall alerts. No IDS triggers. No opt-out complaints.

Zero Footprint

Org Attribution

Automatically links discovered assets to your organization. Subdomains, cloud providers, email infrastructure, UC services — all mapped to who owns what.

Auto-Mapped

Transparent Pricing

No per-query credits. No contact-sales gates. No surprise invoices. Flat monthly pricing that scales with your needs. Every plan includes unlimited scans.

No Credits
How It Works

From domain to full picture in seconds

Four layers of passive reconnaissance, zero packets sent.

01

Enter a Domain

Type any domain. We start with DNS — the foundation of every organization's digital presence.

02

Subdomain Discovery

DNS enumeration + Certificate Transparency logs reveal every subdomain and certificate ever issued.

03

Infrastructure Mapping

MX records identify email providers. CNAME chains reveal cloud hosting. SPF/DMARC show security posture.

04

Organized Report

Everything attributed to your org — cloud providers, email stack, UC services, and security gaps.

Comparison

The mid-market deserves better

Enterprise tools price you out. Research tools leave you guessing. IntelFunnel fills the gap.

IntelFunnel Censys Shodan CyCognito
Pricing model Flat monthly Credits + tiers Credits Custom ($100K+/yr)
Starting price $99/mo $99/mo (limited) $69/mo (limited) ~$25K/yr
Scanning method 100% passive Active scanning Active scanning OSINT + active
Org attribution ✓ Automatic Manual None ✓ Automatic
Self-serve signup ✓ Yes ✓ Yes ✓ Yes Sales only
Unlimited scans ✓ All plans Credit-based Credit-based ✓ Continuous
Target market Mid-market Researchers Researchers Enterprise only
Pricing

Transparent. No credits. No surprises.

Every plan includes unlimited scans. Pick what fits your team.

Starter
For small security teams getting visibility into their external surface.
$ 99 /mo
$1,188/year billed monthly
  • Up to 5 monitored domains
  • Unlimited passive scans
  • Subdomain enumeration
  • Email provider detection
  • Cloud stack discovery
  • UC service fingerprinting
  • Export to CSV/JSON
Join Waitlist
Most Popular
Growth
For growing security teams that need full visibility and API access.
$ 499 /mo
$5,988/year billed monthly
  • Unlimited monitored domains
  • Everything in Starter
  • REST API access
  • Continuous monitoring
  • Change detection alerts
  • Team members (up to 10)
  • Priority support
Join Waitlist
Enterprise
For organizations that need custom integrations and dedicated support.
$ 2,500 +/mo
Custom annual contracts available
  • Everything in Growth
  • Custom integrations (SIEM, SOAR)
  • Dedicated account manager
  • SLA guarantees
  • SSO / SAML
  • Unlimited team members
  • M&A diligence workflows
Contact Us

All plans include unlimited scans. No per-query credits. Cancel anytime.

Get Early Access

We're onboarding teams now. Drop your email and we'll reach out when your slot opens.