Neevsight is a free, high-performance passive website security scanner and OSINT (Open Source Intelligence) reconnaissance platform designed for cybersecurity analysts, DevOps engineers, and webmasters. By concurrently inspecting 45+ security vectors—including SSL/TLS certificate chain validity, modern cipher suites, HTTP security headers, DNSSEC zones, open ports, exposed sensitive endpoints, and email security protocols—Neevsight maps your entire external attack surface in real-time. Because scanning is completely non-intrusive and passive, you can safely audit any public domain, IPv4, or IPv6 address without sending harmful exploit payloads or impacting server availability. Scan results are automatically summarized by Google Gemini AI with prioritized risk scores and 1-click production remediation templates for Nginx, Apache, Cloudflare, and Express.js.
Validates full SSL certificate trust chains, checks expiration timelines, verifies TLS 1.2 and TLS 1.3 support, detects weak cipher suites, and scans for known SSL/TLS vulnerabilities including POODLE, BEAST, and SWEET32.
Audits crucial HTTP security headers for OWASP compliance: HTTP Strict Transport Security (HSTS with preload), Content Security Policy (CSP), X-Frame-Options (clickjacking defense), X-Content-Type-Options, Referrer-Policy, and CORS rules.
Queries complete DNS zone records (A, AAAA, MX, TXT, NS, SOA, CAA), checks DNSSEC cryptographic signing validity (RFC 4033), and resolves registrar WHOIS registration information.
Passively checks standard network service ports (21 FTP, 22 SSH, 80 HTTP, 443 HTTPS, 3306 MySQL, 5432 PostgreSQL, 8080 HTTP-Alt, 27017 MongoDB) without sending aggressive penetration payloads.
Fingerprints web servers, programming languages, CMS frameworks (WordPress, Drupal, Next.js), and correlates identified technologies against National Vulnerability Database (NVD) CVE entries.
Cross-references target IP addresses and domains across AbuseIPDB threat reports, Google Safe Browsing malware lists, PhishTank databases, and 17 global DNS Real-time Blackhole Lists (RBLs).
Audits domain email authentication standards: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), Domain-based Message Authentication (DMARC) policy enforcement, MTA-STS, and BIMI records.
Discovers public subdomains and hidden infrastructure assets using Certificate Transparency (CT) log indexes (crt.sh) without generating noisy network scans.
Synthesizes raw scanner telemetry using Google Gemini 2.5 Flash into an explainable executive threat assessment with prioritized risk scores and 1-click Nginx, Apache, and Cloudflare configuration fixes.
| Audit Vector | Technical Inspection Scope | Governing Security Standards | Intrusion Level |
|---|---|---|---|
| SSL/TLS Health | Chain verification, expiry alerts, TLS 1.3, weak cipher suites | NIST SP 800-52r2, RFC 8446 | Passive / Zero Impact |
| Security Headers | HSTS Preload, CSP directives, X-Frame-Options, CORS origin | OWASP Secure Headers Project | Passive / Zero Impact |
| Domain Security | DNSSEC keys, CAA records, SPF/DMARC email validation | RFC 4033, RFC 7489, RFC 6844 | Passive / Zero Impact |
| Open Ports | Web, database, remote access ports (21, 22, 80, 443, 3306, etc.) | CIS Security Benchmarks | Passive / Non-Exploitative |
| Threat Intelligence | AbuseIPDB reputation, Google Safe Browsing, PhishTank, 17 RBLs | SANS Top 25, MITRE ATT&CK | Passive / Third-Party Feed |
| Remediation Generator | Production configs for Nginx, Apache, Express, Cloudflare | CIS & Mozilla SSL Configuration | Instant Automated Fix |
Simply enter any target domain or IP address into the search input above and click "Start Free Security Scan". Neevsight immediately initiates 45+ passive audits in parallel, presenting a real-time visual dashboard with SSL grades, header scores, open ports, tech stack signatures, and an AI-generated risk report.
Passive OSINT (Open Source Intelligence) scanning collects security telemetry exclusively from publicly published resources—such as DNS servers, Certificate Transparency logs, HTTP response headers, and public threat blocklists. Because it does not inject exploit payloads or attempt brute force attacks, it is completely non-intrusive, safe for production servers, and standard cybersecurity reconnaissance practice.
HTTP security headers like HSTS, Content-Security-Policy (CSP), and X-Frame-Options instruct modern web browsers to block malicious attacks like Cross-Site Scripting (XSS), clickjacking, and man-in-the-middle SSL stripping. Search engines like Google prioritize secure sites with robust HTTPS and security postures in organic rankings.
Neevsight features a built-in 1-Click Server Remediation generator. When a missing security header or misconfiguration is discovered, Neevsight produces ready-to-copy configuration code tailored specifically for Nginx, Apache, Cloudflare, Express.js, Caddy, or Vercel.
Yes. Neevsight is 100% free and open-source software distributed under the MIT license. You can audit unlimited personal or enterprise domains, export PDF and CSV reports, and deploy your own self-hosted scanner using Docker.
Neevsight was created and architected by Harshit Sharma, an open-source cybersecurity and web intelligence researcher. Built with modern React, TypeScript, Express, and Google Gemini AI, Neevsight empowers developers, system administrators, and security analysts to proactively discover and remediate attack surface weaknesses before malicious actors exploit them.
Contribute, audit the source code, or deploy your own private scanner instance via GitHub (harshitsharma2024mtech/NeevSight).