THE INTERNET, UNDER THE SURFACE

See what’s
behind a URL.

Explore the live DNS records and public networks
behind a website, with the evidence that connects them.

Public URLs only. No sign-in. No saved investigations. DNS and network run live in this browser.

GitHub source
+ A LOOK BENEATH THE SURFACECONCEPTUAL MAP
YOUR CURIOSITY STARTS HERERESOLVES TOREQUESTS A RESPONSETHE ADDRESSexample.comTHE DIRECTIONSDNS resolutionTHE INFRASTRUCTUREIP & networkTHE IDENTITYTLS certificateTHE CONVERSATIONHTTP responseKEEP GOINGFIG. 01THERE IS MORE THAN MEETS THE BROWSER.
One address. An entire architecture.Real findings appear only after you run an X-ray.
WHAT RUNS WHERE

Live here.
Complete on your machine.

This hosted page is a static site with no backend. It makes only the lookups a browser is allowed to make, and it never requests the site you are inspecting.

RUN URL X-RAY LOCALLY

Run every check on your machine.

This page keeps the live checks a browser can make. The project itself adds the certificate handshake, the redirect chain, response headers and response technologies, because those need a process that can connect to the target directly.

Download project ZIPGitHub source
  1. 01
    Install Node.js 22 or newer

    The project needs Node 22 or newer and npm, which ships with it.

  2. 02
    Extract the ZIP and open a terminal in the project folder

    Every command below runs from the folder that holds package.json.

  3. 03
    Install and start

    Two commands, no configuration.

    npm ci
npm run dev
  4. 04
    Open localhost port 3099

    The app serves at http://127.0.0.1:3099, on your machine only.

No API keys, no account, no card. Every check runs from your own machine.

Live in this browser

  • DNS recordsA, AAAA, CNAME, NS, MX, TXT, CAA and more, over DNS over HTTPS.
  • IP and networkASN and announcing organisation for each observed address.
  • Reverse DNSPTR names for the addresses DNS returned.

In the local app

  • TLS certificateIssuer, validity, names and chain from a real handshake.
  • Redirects and headersThe bounded request chain and the response headers along it.
  • Response technologiesHeader and HTML signatures, with the evidence behind each one.
A DIFFERENT WAY TO LOOK

Less lookup.
More understanding.

Follow the evidence from the address you can see to the infrastructure you can’t.

01

Take it apart.

A URL becomes its individual parts. DNS reveals the names and addresses behind the hostname.

02

Follow the connections.

Watch a living map assemble from public DNS records and the networks announcing their addresses.

03

See how we know.

Every finding has evidence. What we observe, what we infer, and what we don’t know stay separate.

Public information. Human understanding.
Explore a familiar hostname or discover the network behind it.

HOW THE INSTRUMENT WORKS

Understand the invisible.

URL X-Ray turns a URL into a map of its publicly observable infrastructure. Real evidence arrives independently, and the explanation grows with it.

01

An address, taken apart

We parse the scheme, hostname, port, and path. Query values and fragments are removed, and in this edition the target itself is never requested.

02

Independent observations

Public DNS queries reveal records over DNS over HTTPS, and public network sources add ASN and reverse DNS context for the addresses returned. The certificate handshake, the redirect chain and the response headers need a process that can connect to the target directly, so they arrive only in the local app.

03

A map, with receipts

Relationships connect the evidence. Live DNS and network records can suggest a network affiliation, and every hint links back to the records behind it. Technology signatures read from a response arrive only in the local app.

Observed

Directly obtained from a response or public data source at the time shown.

Inferred

An interpretation suggested by the evidence, not an independently verified fact.

Unknown

Not enough evidence to make a claim. This is a useful answer, too.

The graph is not a traceroute. A CDN can hide an origin, an ASN does not prove hosting, and a registry country does not locate a server. The interface does not fill in these gaps.

Want the full set of layers? The project runs on your machine with two commands and no keys.

Run every check on your machine 4 steps
Download project ZIPGitHub source
  1. 01
    Install Node.js 22 or newer

    The project needs Node 22 or newer and npm, which ships with it.

  2. 02
    Extract the ZIP and open a terminal in the project folder

    Every command below runs from the folder that holds package.json.

  3. 03
    Install and start

    Two commands, no configuration.

    npm ci
npm run dev
  4. 04
    Open localhost port 3099

    The app serves at http://127.0.0.1:3099, on your machine only.

No API keys, no account, no card. Every check runs from your own machine.

PRIVACY & SCOPE

Curiosity has boundaries.

URL X-Ray analyses publicly observable information. It does not attempt to access private systems or bypass security controls.

What leaves this browser

Only the hostname or IP address you are inspecting is sent out. DNS answers come from Cloudflare’s public DNS-over-HTTPS resolver. Network context comes from Team Cymru over the same DNS-over-HTTPS transport, with RIPEstat as a fallback. Those services may log requests. The site being inspected is never requested from this page, and there is no proxy and no backend of ours in the path.

What we don’t keep

There are no accounts, analytics, saved investigations, or URL history. Query values and fragments are discarded before any request. The URL path stays in this browser and in any report you export from it: nothing is uploaded and no server of ours sees it.

What we won’t do

No private or loopback addresses, nonstandard ports, credentials, cookies, authentication bypass, port scans, JavaScript execution, or subresource crawling. This edition never requests the site being inspected, so there is no redirect chain to follow here.

A smaller, honest view

Your resolver path, your network location, and the time of the lookup can change what we see. An incomplete layer stays incomplete, and a layer that belongs to the local app is not a finding about the site.

No hidden deeper scan

There is no urlscan.io submission or third-party screenshot scan. A shared hostname link never runs on its own: it waits for you to confirm. Exports may contain URL paths and public metadata; review them before sharing.

Browser edition. A static page with no backend, no proxy, and no accounts.