What is exposed?
Discover internet-facing services,
software, ports, and protocols.
Find exposures beforeattackers do.
The internet changes. Stay ahead with continuous visibility into exposed infrastructure,
threat activity, external attack surface, and the context needed to investigate quickly.
Who owns this
infrastructure?
Connect domains, networks,
certificates, and organizations
across the public internet.
What is changing?
Track newly exposed services,
assets, and infrastructure shifts.
Where are the
risks?
Investigate suspicious infrastructure,
external exposure, and emerging
threats.
How is it all
connected?
Follow relationships across hosts,
domains, certificates, networks,
and ownership.
TOHOUINTERNET INTELLIGENCE
Open SearchINTELLIGENCE FOR DEFENDERS
Understand what the internet exposes.
Tohou connects hosts, services, software, certificates, domains, and network ownership into investigation-ready context for security teams.
See your organization from the outside.
Discover unknown assets, exposed administration interfaces, risky services, and infrastructure drift before they become an incident. Follow relationships across hosts, domains, certificates, and networks to understand what belongs together.
Asset discoveryExposure monitoringOwnership mappingChange detection
Know what is listening
Inspect ports, protocols, software, banners, and service metadata across public infrastructure.
Connect suspicious activity
Pivot across certificates, domains, networks, and reused infrastructure during an investigation.
Follow infrastructure relationships
Link names to hosts and certificates to deployments, issuers, fingerprints, and organizations.
Bring context into your stack
Enrich alerts, automate investigations, and build security products with structured internet data.
Monitor external assets and exposure as public infrastructure changes.
Move from one indicator to the infrastructure and ownership around it.
Turn internet observations into context defenders can search, monitor, and automate.
Security intelligenceacross the internet
Discover attack surface, investigate hostile infrastructure, enrich detections, and monitor meaningful changes across the public internet.
Security workflows
built on intelligence
Bring internet search, exposure monitoring, structured APIs, and research-ready datasets into the systems your defenders already use.
Internet Search
Query hosts, services, software, certificates, domains, networks, and exposed products.
Exposure Monitor
Track new assets, changed services, certificate events, and external infrastructure drift.
APIs and datasets
Enrich alerts, automate investigations, and build security products with structured internet data.
How teams use Tohou
$ tohou search 'service.http.response.html_title:"login"' Tohou CLI · workspace/security-research ● Querying the latest internet index… ✓ matched services --port 443 --protocol https HOST 203.0.113.42 HTTPS certificate observed ASN example network · last seen recently
Find public login services exposed over HTTPS.
▣ Internet index + DNS
Tohou for security teams
Discover exposed assets, investigate infrastructure, monitor external risk, and move from signal to action.
Explore platform