Peer into any domain.

Periscope is a sophisticated DNS and Network diagnostic tool. It combines a beautiful web interface https://periscope.run with a Local Bridge running on your machine. This allows the web UI to securely execute local system tools like dig, whois, and curl to gather deep intelligence on domains without rate limits or proxy restrictions.

To start Periscope, simply run the bootstrapper. This will set up the environment, start the local bridge, and open the interface in your browser.

curl -sL https://periscope.run/boot.sh | bash

This command installs necessary dependencies (PHP, dig, whois) if missing, sets up the local API engine, and connects it to the web UI.

• Email Health Grading: Automatic scoring (A-F) of email infrastructure security. Analyzes MX redundancy, SPF strictness, DKIM presence, and DMARC policies with actionable recommendations.
• SPF Visualizer: Visualizes SPF record structure, identifies third-party providers, and counts DNS lookups against the RFC limit of 10.
• Portable Reports: Export full domain scans as standalone, single-file HTML reports—perfect for sharing with clients or archiving.
• Deep DNS Scanning: Checks A, AAAA, MX, NS, SOA, TXT, SRV, CNAME, CAA, HTTPS, SVCB, and TLSA records.
• Intelligent Analysis: Automatically flattens CNAME chains and detects modern email security standards (MTA-STS, BIMI, DKIM).
• Zone File Generation: Exports discovered records into a valid BIND Zone file.
• Network Coordinates: Resolves IP addresses to their hosting providers/organizations with Reverse DNS (PTR) verification.
• SSL Certificate Info: Displays expiration date, days remaining, and certificate issuer.
• Security Headers: Analyzes and scores headers including HSTS, CSP, X-Frame-Options, and Permissions-Policy.
• CMS/Platform Detection: Identifies WordPress (including Plugins/Themes), Shopify, Squarespace, Wix, Drupal, Joomla, Webflow, and Ghost.
• Technology Detection: Detects JavaScript frameworks (React, Vue, Next.js, Alpine.js), analytics, e-commerce platforms, and CSS frameworks (Tailwind).
• Infrastructure Detection: Detects 35+ hosting providers and 15+ CDNs via HTTP header fingerprinting.
• Metadata Analysis: Checks robots.txt, sitemap.xml, security.txt, Open Graph tags, and favicon hashes.
• History & Snapshots: Uses a hybrid storage engine (SQLite + flat files) to save every lookup. Compare current DNS states against previous versions.
• Deep Linking: Link directly to domain scans via URL parameters.
• CLI Mode: Run quick diagnostics directly from your terminal.

Right-click on IP addresses or Domain values in the UI to access context menus for "Dig" and "Whois".

Periscope checks for the presence and configuration of important security headers, providing a score out of 7.

Additionally, Periscope checks for:

• /.well-known/security.txt - Security contact information
• /security.txt - Fallback location

• Counts Disallow rules (potential hidden paths)
• Extracts Sitemap references
• Shows first 20 disallowed paths

The favicon MD5 hash can be used to identify sites using the same favicon, useful for:

• Identifying related sites
• Detecting default CMS favicons
• Tracking site infrastructure changes

Periscope uses a Local Bridge architecture:

1. The Interface: Hosted at https://periscope.run. It provides the visualization and user experience.
2. The Engine: A lightweight PHP script running locally on your machine (default port 8989).
3. The Connection: The Interface sends requests to http://127.0.0.1:8989. The Engine executes system commands (dig, whois) and returns structured JSON.

Data Privacy: All history and metadata are stored in a local SQLite database (~/.periscope/history.db), while heavy raw scan data (HTML, Headers, Images) is stored as flat files in ~/.periscope/scans/. No scan data is sent to external servers.

If you prefer not to use the auto-bootstrapper, you can run Periscope manually.

• OS: macOS, Linux, or Windows (via WSL).
• PHP: 8.0+ (with php-curl, php-sqlite3, php-cli).
• Tools: dig (dnsutils/bind), whois, curl, unzip.

# 1. Clone the repository
git clone https://github.com/austinginder/periscope.git
cd periscope

# 2. Run the boot script
./boot.sh

For local development, use the --local flag. This serves the index.html from your local directory instead of downloading from GitHub releases:

./boot.sh --local

This opens http://127.0.0.1:8989/?local=true with your local changes.

You can link directly to a domain scan using URL parameters:

http://127.0.0.1:8989/?local=true&domain=example.com

• If the domain exists in history, the cached result is displayed immediately
• If not found, a fresh scan is triggered automatically
• The local=true parameter is required for domain lookups to work

Once installed, you can use the underlying engine directly from your terminal for quick, headless scans.

# Standard lookup
php ~/.periscope/engine.php google.com

# Upgrade scan history to new storage format
php ~/.periscope/engine.php action=bulk_upgrade

Periscope uses Semantic Versioning (MAJOR.MINOR.PATCH):

• MAJOR: Breaking changes
• MINOR: New features, scan format changes
• PATCH: Bug fixes, minor improvements

Cached scan data is considered valid if the major.minor version matches. This means:

When loading a cached scan with an outdated version, Periscope automatically regenerates the response data from the stored raw files (HTML, headers, DNS records, etc.) using the current engine logic.

To upgrade all historical scans to the current version:

php ~/.periscope/engine.php action=bulk_upgrade

This reprocesses scans that have raw files available, applying any new detection logic or data transformations from newer versions.

Website Overview

Domain, SPF Analysis and Email Health

DNS Records

Periscope is open source. Pull requests are welcome for new DNS record types, UI improvements, or better OS compatibility for the bootstrapper.

MIT