Driftnet is **“Discover & Defend”** — **Internet-Wide Intelligence** built for defenders. “Defenders need facts. We show you exactly what we see.”

Driftnet provides **Deep Internet Scans** with **3,500+ ports covered**, “refined by continuous survey sampling.” Its **Port-Agnostic Collection** uses “bespoke algorithms [to] detect any service on any port,” with **IPv6 fully supported** and “multi-source hitlist generation.” It also states that **virtual & cloud hosting** are handled, with “over three billion IP / host / port combinations matched & monitored.”

Coverage includes **IP & Domain Registrations** with “complete Regional Internet Registry and RWHOIS data,” “over 650 Million Domain Names,” **Extensive DNS Coverage** with “over a Billion Hostnames,” “complete reverse lookups” across IPv4, and **Certificate Transparency**: “Every Usable CT Log” is “continuously monitored, fully searchable.”

For **Enrichments & Fingerprints**, Driftnet says its “proprietary product tagging incorporates the industry standard nmap, recog, webappanalyzer and nuclei datasets for maximal device identification.” It includes “vulnerability reporting with CPE/CVE enrichment from NIST NVD, with CVSS & EPSS scoring,” and CISA **Known Exploited Vulnerabilities** are “called out and tagged for easy identification.” It also pulls and fingerprints favicons, includes **JARM** and **JA4X** fingerprints for TLS services and certificates, and **JA4TScan** fingerprints for TCP stacks.

Driftnet data is “fully tagged with ASN numbers, entity names and geolocations.” For asset enumeration, “Driftnet makes it a piece of cake”: domain and IP registration data is “reverse-searchable by name, domain, address & phone.” If users know what they want, “on-demand IP scans, domain scans and domain WHOIS collection is available via our API.”

The source material does not show a self-hosted version, deployment documentation, or hardware requirements. The pricing page shown in the source returns “Not Found.”