From d77d93aa12d20d59d976765cd7e3df67f151e829 Mon Sep 17 00:00:00 2001 From: user Date: Sat, 20 Jun 2026 12:30:34 +0000 Subject: [PATCH] add: ip.thc.org to external recon methodology --- .../external-recon-methodology/README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/src/generic-methodologies-and-resources/external-recon-methodology/README.md b/src/generic-methodologies-and-resources/external-recon-methodology/README.md index d2620458e17..72f13599e16 100644 --- a/src/generic-methodologies-and-resources/external-recon-methodology/README.md +++ b/src/generic-methodologies-and-resources/external-recon-methodology/README.md @@ -95,6 +95,7 @@ For large ranges, tools like [**massdns**](https://github.com/blechschmidt/massd Inside a **whois** you can find a lot of interesting **information** like **organisation name**, **address**, **emails**, phone numbers... But which is even more interesting is that you can find **more assets related to the company** if you perform **reverse whois lookups by any of those fields** (for example other whois registries where the same email appears).\ You can use online tools like: +- [https://ip.thc.org/](https://ip.thc.org/) - **Free** (Web and API) - [https://viewdns.info/reversewhois/](https://viewdns.info/reversewhois/) - **Free** - [https://domaineye.com/reverse-whois](https://domaineye.com/reverse-whois) - **Free** - [https://www.reversewhois.io/](https://www.reversewhois.io) - **Free** @@ -312,6 +313,12 @@ theHarvester -d tesla.com -b "anubis, baidu, bing, binaryedge, bingapi, bufferov There are **other interesting tools/APIs** that even if not directly specialised in finding subdomains could be useful to find subdomains, like: +- [**IP.THC.ORG**](https://ip.thc.org) free API + +```bash +curl https://ip.thc.org/tesla.com +``` + - [**Crobat**](https://github.com/cgboal/sonarsearch)**:** Uses the API [https://sonar.omnisint.io](https://sonar.omnisint.io) to obtain subdomains ```bash