Skip to main content
Hedwig can retrieve public information about domains, IP addresses, and web search results. The commands return provider data; they do not establish ownership, guarantee that a host is safe, or replace an authorized security assessment.

​
IP commands

/ip ports checks the common ports defined by Hedwig and reports reachable services; it is not a full port scan. /ip subnet calculates subnet details locally from the supplied address and mask.

​
Domain commands

​
Search and identity commands

Use lookup and scanning features only for systems and identities you are authorized to investigate. Provider responses may be incomplete, cached, or rate-limited. Do not treat a username hit from /sherlock or /lookup as proof that two accounts belong to the same person.