Security
What a domain shows the world: its certificate, security headers, mail authentication (SPF, DMARC), CAA, registration, and every subdomain it has had a certificate for.
Passive: one HTTPS request and public DNS and RDAP lookups, which is what any browser sees. Only public names; addresses in private networks are refused. Check only domains you own or are entitled to assess.