OSIRIS RECON Tools: Nmap Scans, DNS, WHOIS and SSL Checks Explained

The globe gets the screenshots, but the RECON toolbox is the part of OSIRIS that working admins and security students keep open. It bundles four classic lookups — port scans, DNS, WHOIS, and SSL analysis — into the browser, under one label. Here is what each one does, a sensible way to use it, and the line you should not cross.

Nmap-style port scans

Every server listens for connections on numbered ports: 443 for secure web traffic, 22 for SSH, 25 for mail, and thousands more. A port scan asks a host, politely and quickly, which ports answer. OSIRIS includes an Nmap-style scanner so you can check a host from the browser instead of installing the classic Nmap tool.

The everyday use is checking your own kit. You set up a server, you think you closed everything except the web ports, and a scan tells you whether that is true. Finding your own forgotten open port is a good day. Finding one on a system you do not own is where you stop — scanning other people's systems without permission is treated as hostile in many places and can be illegal. Permission first, always. That rule shapes this whole toolbox, and it is one we repeat on the disclaimer page too.

DNS lookups

DNS is the internet's phone book: it turns a name like a website's domain into the addresses and records behind it. A DNS lookup shows you A and AAAA records (the servers), MX records (where mail goes), TXT records (often used for verification and mail security), and more.

Useful moments: a site you run moved servers and you want to confirm the records updated; an email keeps bouncing and the MX records look wrong; you are learning how the web fits together and want to see real records instead of a diagram. DNS data is public by design — publishing it is how the internet works — so lookups are the least sensitive tool in the box.

WHOIS

WHOIS answers "who registered this domain, and when?" You get the registrar, the creation and expiry dates, and whatever contact details the owner has left public — many owners use privacy protection, so records are often thin, and that is normal.

It is handy for checking whether a lookalike domain is brand new (a classic scam sign), confirming a domain you own is not about to expire, or tracing which registrar to contact about abuse. Like DNS, WHOIS is public registration data.

SSL analysis

The SSL check inspects a website's certificate: who issued it, which names it covers, and when it expires. Expired or mismatched certificates are why browsers show those full-page warnings, so if your own site suddenly scares visitors off, this is the first tool to reach for. It is also a quick sanity check on a site you are about to trust with a login.

Running your first checks

Start with lookups on things you control. Run DNS and WHOIS on your own domain, check its SSL expiry, then scan your own server and compare the open ports with what you meant to open. That ten-minute routine teaches you more than any tutorial — and it is exactly the workflow the toolbox was built for. The tools live inside the live demo, which our access page links to, and the homepage guide explains how RECON fits with the tracking layers on the globe.

Used on your own systems, these four tools are routine maintenance. Used carelessly on other people's, they are trouble. OSIRIS makes them easy to reach; what you point them at is on you.

How RECON fits the rest of OSIRIS

The toolbox makes more sense next to the globe. Say a story mentions a service outage or a suspicious site. The map shows you the public picture — traffic, weather, events — while RECON lets you check the domain itself: when it was registered, where its DNS points, whether its certificate is valid. That pairing of "what is happening in the world" with "what is true about this domain" is the workflow OSINT analysts use every day, shrunk into a browser tab. Keep it pointed at your own projects while you learn, and the habits you build — verify, check the dates, read the records — are the real skill the toolbox teaches.