Sonar documentation

Sonar organizes authorized infrastructure into workspaces. Each domain or public IP becomes its own workspace with its own scans, findings, members and webhook. Your account holds every workspace you belong to; workspaces can be renamed, merged, or deleted at any time, and a domain counts as a single asset no matter how many subdomains are observed beneath it.

Add and verify an asset

1. Sign in with Discord. New accounts start in account mode; open Workspaces.
2. Name the workspace and paste one or more domains or public IPs — one per line. Each becomes an asset in the new workspace.
3. For domains, publish the displayed TXT value at the displayed challenge name. For IPs, serve the challenge at the displayed HTTP URL without a redirect.
4. Select Verify ownership for each asset. Once verified, the challenge is hidden — the card keeps a Remove action only. Scans recheck ownership every run, so leave records in place.
5. Add more assets at any time from the workspace's asset panel, and set a scan schedule on the Scans page.

How a run works

One run covers every verified asset in the workspace and consumes one unit of the workspace's daily run allowance (resetting at midnight UTC). Each asset passes through: subdomain discovery (certificate transparency feeds, the live certificate's SANs, public web archives and a curated name list — resolver-side only), a stealth-paced TCP sweep across roughly two hundred common service ports, a low-intensity version fingerprint pass on ports found open, single UDP probes to DNS, NTP and SNMP, HTTP(S) analysis, TLS certificate and cipher analysis, DNS hygiene checks (SPF, DMARC, CAA, DNSSEC), exposure checks for accidentally published files, subdomain-takeover confirmation against the hosting provider's own response, and one latest screenshot of the web surface. A safe activity log records each milestone; open View log on any scan.

Risk and history

Every asset carries a 0–100 posture score and letter grade derived from its open findings, and the workspace Overview shows the daily score trend. Asset search lists the score per host. The asset drawer tracks history: first seen in certificate logs, first observed by Sonar, changed states over time, and historical URLs recovered from public archives.

Investigate

Asset search matches hostnames and collected evidence. Select an asset to open its drawer with three tabs — Overview (evidence, services, UDP, screenshot, history), Findings, and Advanced (software inventory and authenticated read-only checks). Findings include severity, evidence and remediation. Resolved findings reopen if observed again.

Search syntax

Combine terms with spaces to require every condition. Supported fields are host, ip, port, udp, http.status, cert.issuer, service, severity and excluded. Quote phrases containing spaces. Ports and IPs match exactly; hostnames, service fingerprints and issuers use text matching. Severity matches open findings.

port:443 http.status:200 cert.issuer:"Example Authority"
udp:161
service:nginx severity:high
host:api excluded:false

Public passive search — the Tohou Index

Public record search is its own product at search.tohou.io, signed in with the same account as this console. Index API keys (created on the Index page) call it programmatically at https://api.tohou.io/v1/index?q=example.com with an Authorization: Bearer tix_… header, sharing the account's daily lookup budget. Domain searches return public certificate-transparency names and certificate inventories, current DNS records, public web observations and WHOIS/RDAP registration (registrar, key dates, nameservers and status). Address searches return open-port records with service details, hostname and reverse-DNS records, network and ASN data, registry and geolocation information, and WHOIS registration. ASN searches return announced prefixes. Resolved addresses, observed hostnames, and related names are selectable so an investigation can continue with one click. Index lookups are stateless — no search history is stored and nothing is added to workspace inventory — and no packets are sent to the queried target.

Authenticated read-only checks

Configure exact HTTPS paths with a dedicated low-privilege bearer token or session cookie. HEAD checks collect headers. GET checks require you to confirm the path is read-only, compare anonymous and authenticated status codes, and discard the response body after at most 16 KiB. An anonymous 2xx result is a review signal, not proof of an access-control vulnerability. Sonar follows no redirects.

Scheduling and notifications

Each workspace chooses Manual, Daily, Weekly or Monthly runs with a count per period; gaps are spread evenly across UTC periods and shown before saving. Scheduled and manual runs share the same daily allowance, and a workspace runs one scan at a time. Add a Discord or Slack webhook when creating or editing a workspace to receive formatted finding and scan updates; delivery failures retry with increasing delays and are reported in console notifications.

Roles

Owners manage all workspace settings, members and deletion. Administrators manage assets, keys and analyst invitations. Analysts investigate findings, export reports and run scans. Only the platform operator can change capacity, suspend accounts or ban users.

API authentication

Create a scoped key in each workspace's Settings (account and Index keys live on the Index page). Send it in the Authorization header. The API hostname is api.tohou.io; endpoints use the /v1 prefix. The console also exposes the same endpoints under /api. Requests return JSON unless an export format is selected.

curl https://api.tohou.io/v1/assets -H "Authorization: Bearer $TOHOU_API_KEY"
curl "https://api.tohou.io/v1/index?q=8.8.8.8" -H "Authorization: Bearer tix_…"

Never include API keys in browser URLs or public repositories. Invalid keys return HTTP 401. Missing permissions return HTTP 403. Limits return HTTP 429.

Queue a scan

curl https://api.tohou.io/v1/scans -H "Authorization: Bearer $TOHOU_API_KEY" -H "Content-Type: application/json" --data '{"scopeId":"your-verified-scope-id"}'

Omit the scope ID to queue one run covering every verified asset in the workspace. A queued scan is not a completed scan; poll the scan list to inspect status, progress and the activity log.

Coverage and boundaries

Sonar performs real-time, bounded observation of verified scope only — by design, not a worldwide pre-built search index. It performs no exploitation, credential attacks, denial-of-service testing, decoy or spoofed-source scanning, and does not yet include cloud-account connectors or UDP coverage beyond DNS, NTP and SNMP. Exact behavior is defined by the scanning policy.

Support

Contact [email protected] for account and product support. Report unexpected scanning to [email protected] with the target and UTC timestamp.