How to use

The application does not accept direct access from the public internet. Both browser sessions and the daily Cron Worker must transit through the Cloudflare Access boundary before reaching the app.

• Identity-based access is limited to Entra ID accounts under @mkilabo.com (MFA required).
• Machine-to-machine traffic uses a dedicated Service Token, allowed only for the cron-check endpoint.
• Served only through the custom domain recon.mkilabo.com; direct access to pages.dev is kept out of the operational workflow.

Stored data is strictly OSINT / ASM material. Concretely: WHOIS records, DNS records, subdomain observations, and the change-detection log derived from them. No customer-confidential information and no secrets (API keys, Service Token client secrets, etc.) are persisted in KV or the detection log; credentials are kept in encrypted Cloudflare environment secrets.

A front-end to get the most out of the WhoisXML API. It supports both on-demand domain lookups and continuous monitoring.

The WhoisXML API offers several subscription plans. This tool primarily uses the following two paid plans:

• WHOIS API: retrieves domain registration data (WHOIS)
• Domain Research Suite (DRS): reverse WHOIS, subdomain discovery, WHOIS history, and other attack-surface research

These two have ample credits. All other APIs are Trial plans with limited credits, so they are not used except for verification purposes. The Trial APIs are isolated on the Trial page.

The remaining credits for the two paid plans (WHOIS API / DRS) are always shown at the bottom left. The remaining credits for Trial APIs are shown as a badge near each API's run button, with a warning color when low.

Each run consumes credits, so check the remaining balance before use, especially for Trial APIs.

Dashboard

Shows the monitoring status at a glance, plus two sections: Domain lookup and IP lookup. In Domain lookup you can run WHOIS, DNS, WHOIS history, reverse WHOIS, and subdomain discovery; in IP lookup, IP geolocation and IP netblocks. Pick which APIs to call with the checkboxes.

Domains

Register domains to monitor and detect changes. The first check records the current state as a baseline; subsequent checks detect differences from the previous state (registrar change, name server change, registrant change, DNS record changes, etc.). Detections also appear in Recent detections on the Dashboard.

Trial

11 tools backed by Trial credits (domain reputation, website categorization, SSL certificates, screenshot, email verification, threat intelligence, etc.). Because credits are limited, a confirmation popup appears before each run. Each card carries a one-line description.

Settings

Toggle the daily auto check on or off. See "Auto check" below for details.

How to use

This page.

The two toggles at the bottom-left of the sidebar switch between dark and light themes, and between Japanese and English. Your choice is persisted in a cookie.

On the Domains page, "Check now" or "Check all" retrieves the following for each domain and diffs it against the previous snapshot:

• WHOIS: registrar, name servers, registrant organisation, expiry date, status
• Apex DNS records: A / AAAA / MX / NS / TXT / CNAME (since v0.10 fetched via Cloudflare DoH 1.1.1.1, so no Trial credits are consumed)
• Subdomains list (added in v0.10): the set of subdomains observed by the Subdomains Discovery API (Certificate Transparency / Passive DNS based)
• Same-registrant domains via Reverse WHOIS (added in v0.10): other domains registered under the monitored domain's registrant organisation

The first check records this state as a baseline (no detection occurs at this point). From the second check onward, each difference is recorded as a change. List-typed fields (NS, DNS records, subdomains, reverse WHOIS list) carry both the added and removed entries so the Detections page can colour-code them.

Detections appear in Recent detections on the Dashboard and on the Detections page.

When auto check is turned on from the Settings page, all monitored domains are checked automatically every day at 08:00 JST. The logic is identical to the manual "Check all", and any detected changes are appended to Recent detections.

Auto check is driven by a separate Cloudflare Worker that posts to the app's scheduled endpoint. When the setting is off, the endpoint skips immediately even if the worker fires, so no credits are consumed.

While auto check is on, the Monitoring status KPI on the Dashboard shows a countdown to the next run and the timestamp of the most recent check. While auto check is off, it shows the elapsed time since the last manual check together with a note that auto check is disabled.

A single check of one domain performs two types of queries: a WHOIS lookup and a DNS lookup. Checking all of 5 domains results in 10 queries in total. Manual checks and auto checks consume the same credits.

These are consumed from the paid plans (WHOIS API / Domain Research Suite) and DNS credits. The paid plans have ample remaining credits, so there is little concern of exhaustion during routine monitoring.

Note that monitoring does not use credit-heavy APIs such as reverse WHOIS or subdomain discovery. It uses only the two query types needed for change detection: WHOIS and DNS.

Three options are available at the top-right of each result card:

• Copy: copy a clean, formatted summary to the clipboard
• Download CSV: download the response JSON flattened to two columns (key / value) as a CSV that Excel can open without garbling Japanese (UTF-8 BOM included)
• View raw JSON: inspect or copy the upstream response as-is

Domain lookup and IP lookup expose a "Download all as CSV" button that bundles every API result of the current run into one CSV with an extra api column.

• SSL certificate retrieval may fail for a root domain (e.g. example.com) but succeed with the www. prefix (e.g. www.example.com). This happens when the target server does not serve HTTPS on the root domain, and is not a bug in this tool.
• If you remove a monitored domain and add it again, its baseline is reset. The first check after re-adding will register a baseline again.
• Domain availability modes: on the Trial page, Domain availability offers three modes (Free DNS-only / Trial credit / WHOIS API credit). The WHOIS API credit mode draws from your paid contract pool, so prefer Trial credit in normal use.
• Credit balances are based on the WhoisXML Account Balance API. Each API's balance is matched by productId.