Driftnet

Driftnet operates an internet-wide scanning and data platform that provides visibility into internet-connected devices, services and infrastructure for security and research purposes. The platform performs deep internet scans covering more than 3,500 ports using port-agnostic collection methods designed to detect services regardless of the port they run on. It supports IPv6 alongside IPv4 and accounts for virtual and cloud hosting environments, tracking billions of IP, host and port combinations. Driftnet aggregates IP and domain registration data, including Regional Internet Registry and RWHOIS records, and monitors over 650 million domain names. Its DNS coverage includes over a billion hostnames gathered through forward DNS, MX and TXT record collection, as well as reverse lookups across the IPv4 address space. The platform also continuously monitors certificate transparency logs. Data enrichment features include product and device fingerprinting using datasets such as nmap, recog, webappanalyzer and nuclei, along with vulnerability data pulled from the NIST National Vulnerability Database, including CPE/CVE mappings, CVSS and EPSS scores, and tagging of CISA Known Exploited Vulnerabilities. The platform fingerprints favicons, and includes JARM, JA4X and JA4TScan fingerprinting for TLS services and TCP stacks. Geolocation and entity data are tagged with ASN numbers and derived using a combination of large language model analysis of IP registration data and geo-feeds from hosting providers. Reverse search functionality allows users to search domain and IP registration data by name, address or phone number, intended to support asset enumeration tasks common in security assessments. Access to the platform is provided via an API, with on-demand IP scans, domain scans and WHOIS collection available. Free non-commercial access is offered to network administrators and independent researchers.