From 1d96de849d5b5cb806eab0b89be47890140595fc Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 01:35:11 -0400 Subject: [PATCH 1/2] Enrich 25 Email Address tools with OSINT enrichment fields Populate enrichment metadata for Sylva Identity Discovery, ThatsThem, Hunter, VoilaNorbert, GHunt, OSINT Industries, Infoga, Skymem, Epieos, breach.vip, Holehe, Email Format, Email Permutator, Reacher (GitHub and Demo), MailScrap, Read Notify, Email Reputation, MailboxValidator, VerifyEmail, Hudson Rock, DeHashed, Vigilante.pw, and MxToolbox. Each tool now includes: description, status, pricing tier, best use case, input/output, OPSEC classification, local install availability, API support, registration requirements, and more. Co-Authored-By: Paperclip --- public/arf.json | 431 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 404 insertions(+), 27 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..55aee8f 100644 --- a/public/arf.json +++ b/public/arf.json @@ -371,37 +371,142 @@ { "name": "Sylva Identity Discovery (T)", "type": "url", - "url": "https://sylva.pfeister.dev/" + "url": "https://sylva.pfeister.dev/", + "description": "Identity discovery utility that searches GitHub and PGP key servers to link identities across platforms using email addresses, usernames, or PGP keys.", + "status": "live", + "pricing": "free", + "bestFor": "Identity correlation via GitHub and PGP", + "input": "Email, username, or PGP fingerprint", + "output": "Linked identities, GitHub profiles, PGP keys", + "opsec": "passive", + "opsecNote": "Queries public GitHub and PGP servers without direct target contact.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThatsThem", "type": "url", - "url": "https://thatsthem.com/reverse-email-lookup" + "url": "https://thatsthem.com/reverse-email-lookup", + "description": "Reverse email lookup tool that searches a database of hundreds of millions of emails to reveal name, address, phone number, and public records associated with an email address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse email lookup, person identification", + "input": "Email address", + "output": "Name, address, phone number, education", + "opsec": "passive", + "opsecNote": "Queries ThatsThem's public database without alerting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunter", "type": "url", - "url": "https://hunter.io/" + "url": "https://hunter.io/", + "description": "Email finder and verifier that discovers business email addresses from company domains, names, and social profiles with up to 98% accuracy rate.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, email verification", + "input": "Domain name, person name, or company info", + "output": "Verified business email addresses", + "opsec": "passive", + "opsecNote": "Queries Hunter's database of public emails; does not contact targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email to Address (R)", "type": "url", - "url": "https://www.melissa.com/" + "url": "https://www.melissa.com/", + "description": "Melissa.com's data quality and verification service that validates and enriches email addresses with supplementary contact information.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, address enrichment", + "input": "Email addresses, contact data", + "output": "Validated email, postal address, phone", + "opsec": "passive", + "opsecNote": "Data verification service; does not perform reconnaissance.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VoilaNorbert", "type": "url", - "url": "https://www.voilanorbert.com/" + "url": "https://www.voilanorbert.com/", + "description": "Email finder and verifier with 98% success rate that discovers business emails by company/domain, person name, or LinkedIn profile with bulk upload capability.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, bulk email finding", + "input": "Domain, name, or LinkedIn URL", + "output": "Business email addresses, verification status", + "opsec": "passive", + "opsecNote": "Searches public email database; does not contact targets directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "GHunt (T)", "type": "url", - "url": "https://github.com/mxrch/GHunt" + "url": "https://github.com/mxrch/GHunt", + "description": "Offensive Google framework that investigates Google accounts using email addresses to uncover YouTube channels, Google Photos, Maps reviews, and associated artifacts.", + "status": "live", + "pricing": "free", + "bestFor": "Google account investigation, YouTube/Google Photos OSINT", + "input": "Gmail address or GAIA ID", + "output": "YouTube channels, Google Photos, Maps reviews, device info", + "opsec": "active", + "opsecNote": "Requires Google login via browser extension; may be detected by Google.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OSINT Industries", "type": "url", - "url": "https://www.osint.industries/" + "url": "https://www.osint.industries/", + "description": "Account linking service that extracts all registered accounts tied to an email or phone across 500+ platforms including social media, messaging apps, and lifestyle services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Account enumeration, breach detection, digital footprint mapping", + "input": "Email address, phone number, username, or crypto wallet", + "output": "Linked accounts, breach information, geospatial data, timeline", + "opsec": "passive", + "opsecNote": "Scours public websites and databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", @@ -426,27 +531,102 @@ { "name": "Infoga (T)", "type": "url", - "url": "https://github.com/m4ll0k/infoga" + "url": "https://github.com/m4ll0k/infoga", + "description": "Python-based email OSINT tool that gathers email account information (IP, hostname, country) from search engines, PGP servers, and Shodan, with breach checking via haveibeenpwned.", + "status": "live", + "pricing": "free", + "bestFor": "Early-stage email reconnaissance, information gathering", + "input": "Email address", + "output": "IP addresses, hostnames, country, breach status", + "opsec": "passive", + "opsecNote": "Queries search engines and public APIs without direct target contact.", + "localInstall": true, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Skymem", "type": "url", - "url": "https://www.skymem.info/" + "url": "https://www.skymem.info/", + "description": "Email finder that discovers company and personal email addresses by domain or name, with bulk search, email list creation, and advanced filtering capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email discovery by domain, bulk email list creation", + "input": "Domain name or person name + domain", + "output": "Email addresses, bulk email lists", + "opsec": "passive", + "opsecNote": "Scrapes and aggregates public email data from websites and profiles.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Epieos Email Tool", "type": "url", - "url": "https://tools.epieos.com/email.php" + "url": "https://tools.epieos.com/email.php", + "description": "Freemium OSINT tool performing email reverse lookups to uncover associated social media profiles across 120+ websites and services with breach detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email reverse lookup, social media profile discovery", + "input": "Email address or phone number", + "output": "Associated social media profiles, forum posts, breach info", + "opsec": "passive", + "opsecNote": "Passive reconnaissance across 120+ websites; does not alert the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "breach.vip", "type": "url", - "url": "https://breach.vip/" + "url": "https://breach.vip/", + "description": "Free database search engine providing access to 1000+ breach databases for research, email searching, and analysis of compromised credentials.", + "status": "live", + "pricing": "free", + "bestFor": "Breach database search, credential lookup", + "input": "Email, domain, Discord ID, or phone number", + "output": "Breach records, leaked credentials", + "opsec": "passive", + "opsecNote": "Queries aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Holehe (T)", "type": "url", - "url": "https://github.com/megadose/holehe" + "url": "https://github.com/megadose/holehe", + "description": "Python-based email enumeration tool that checks if an email is registered across 120+ websites and services using password-reset mechanisms.", + "status": "live", + "pricing": "free", + "bestFor": "Email account enumeration, service detection", + "input": "Email address", + "output": "List of websites where email is registered", + "opsec": "passive", + "opsecNote": "Uses password-reset functionality without sending emails or alerting targets.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -457,12 +637,42 @@ { "name": "Email Format", "type": "url", - "url": "https://www.email-format.com/" + "url": "https://www.email-format.com/", + "description": "Tool for analyzing and discovering corporate email address patterns and formats to predict valid employee email addresses within an organization.", + "status": "live", + "pricing": "free", + "bestFor": "Corporate email pattern analysis, email format discovery", + "input": "Sample email addresses or company info", + "output": "Predicted email format patterns", + "opsec": "passive", + "opsecNote": "Statistical analysis of publicly known email patterns.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Permutator", "type": "url", - "url": "https://metricsparrow.com/toolkit/email-permutator/" + "url": "https://metricsparrow.com/toolkit/email-permutator/", + "description": "OSINT tool that generates all possible email address combinations from a person's name and domain(s) for reconnaissance and email guessing.", + "status": "live", + "pricing": "free", + "bestFor": "Email pattern generation, targeted email guessing", + "input": "Person name, nickname, domain(s)", + "output": "List of possible email address variations", + "opsec": "passive", + "opsecNote": "Generates permutations without any network contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -473,37 +683,142 @@ { "name": "Reacher Github (T)", "type": "url", - "url": "https://github.com/reacherhq/check-if-email-exists" + "url": "https://github.com/reacherhq/check-if-email-exists", + "description": "Open-source Rust-based email verification API that checks email deliverability without sending messages, detecting catch-all and disposable addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification, bounce detection, list cleaning", + "input": "Email address", + "output": "Deliverability status, MX records, bounce type", + "opsec": "passive", + "opsecNote": "Verifies email existence through MTA queries without sending mail.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Reacher Demo", "type": "url", - "url": "https://reacher.email" + "url": "https://reacher.email", + "description": "Hosted demo of the Reacher email verification API allowing free testing of email validation and deliverability checks online.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification testing, demonstration", + "input": "Email address", + "output": "Deliverability status, bounce information", + "opsec": "passive", + "opsecNote": "Passive MTA-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MailScrap", "type": "url", - "url": "https://mailscrap.com/" + "url": "https://mailscrap.com/", + "description": "Email verification tool that connects to mail servers to verify mailbox existence and removes disposable email addresses from lists.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email validation, list cleaning, disposable email detection", + "input": "Email addresses or email lists", + "output": "Validation status, mailbox existence", + "opsec": "passive", + "opsecNote": "Connects to mail servers for verification without sending messages.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Read Notify", "type": "url", - "url": "https://www.readnotify.com/" + "url": "https://www.readnotify.com/", + "description": "Email tracking and read receipt service that monitors email opens and engagement, useful for confirming email validity through delivery.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email delivery confirmation, read receipt tracking", + "input": "Email address", + "output": "Delivery and read status", + "opsec": "active", + "opsecNote": "Sends tracking pixels; may alert targets to monitoring.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Reputation", "type": "url", - "url": "https://emailrep.io/" + "url": "https://emailrep.io/", + "description": "Tool that checks email reputation, risk scoring, and breach history to identify phishing emails, compromised accounts, and risky addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email reputation checking, risk assessment", + "input": "Email address", + "output": "Reputation score, risk level, breach history", + "opsec": "passive", + "opsecNote": "Passive database lookup without target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MailboxValidator", "type": "url", - "url": "https://www.mailboxvalidator.com/demo" + "url": "https://www.mailboxvalidator.com/demo", + "description": "Email verification API that validates email deliverability, detects catch-all addresses, and provides risk scoring for bulk email list cleaning.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, list cleaning, bounce prevention", + "input": "Email addresses or bulk lists", + "output": "Validation status, risk score, catch-all detection", + "opsec": "passive", + "opsecNote": "Server-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VerifyEmail (R$)", "type": "url", - "url": "https://emailable.com/" + "url": "https://emailable.com/", + "description": "Email verification service offering both free and premium tiers for validating email addresses and maintaining clean mailing lists.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email validation, list cleaning", + "input": "Email addresses", + "output": "Validation status, deliverability info", + "opsec": "passive", + "opsecNote": "Passive email verification without sending messages.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -534,17 +849,62 @@ { "name": "Hudson Rock", "type": "url", - "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" + "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools", + "description": "Infostealer threat intelligence platform that searches a database of compromised devices and stolen credentials to identify if emails have been exposed via malware infections.", + "status": "live", + "pricing": "freemium", + "bestFor": "Infostealer detection, breach assessment, device compromise verification", + "input": "Email address, domain, username, or IP", + "output": "Infostealer hits, compromised account data, breach details", + "opsec": "passive", + "opsecNote": "Queries public infostealer database compiled from malware captures.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DeHashed (R)", "type": "url", - "url": "https://dehashed.com/" + "url": "https://dehashed.com/", + "description": "Modern breach search engine indexing historical breach data over a decade old, enabling searches by email, username, password, domain, phone, and IP address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Breach searching, credential lookup, historical breach analysis", + "input": "Email, username, password, domain, phone, or IP", + "output": "Breach records, exposed credentials, breach dates", + "opsec": "passive", + "opsecNote": "Searches aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Vigilante.pw", "type": "url", - "url": "https://www.vigilante.pw/" + "url": "https://www.vigilante.pw/", + "description": "Breach database directory and search platform raising awareness of data breaches by aggregating publicly leaked database information and breach details.", + "status": "live", + "pricing": "free", + "bestFor": "Breach research, public breach database navigation", + "input": "Email, username, domain", + "output": "Breach records, exposed data information", + "opsec": "passive", + "opsecNote": "Aggregates and indexes publicly disclosed breach data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -555,7 +915,22 @@ { "name": "MxToolbox", "type": "url", - "url": "https://mxtoolbox.com/" + "url": "https://mxtoolbox.com/", + "description": "Email deliverability diagnostics tool that checks MX records, SPF, DKIM, DMARC configuration, and server health to prevent email delivery issues.", + "status": "live", + "pricing": "free", + "bestFor": "Email server diagnostics, deliverability testing, DNS validation", + "input": "Domain name or email address", + "output": "MX records, SPF/DKIM/DMARC status, blacklist info", + "opsec": "passive", + "opsecNote": "Public DNS lookups and SMTP diagnostics without target alerting.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -5596,7 +5971,9 @@ { "name": "Videos", "type": "folder", - "children": [] + "children": [ + + ] }, { "name": "Analysis", @@ -7909,4 +8286,4 @@ ] } ] -} +} \ No newline at end of file From b746e2f38ed95379c0ddff3dfbcf1d98bf980516 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 01:42:01 -0400 Subject: [PATCH 2/2] Fix trailing newline and Videos array formatting (THE-126) CTO cleanup: restore trailing newline removed by json serialization, and revert spurious whitespace change to Videos empty children array. Co-Authored-By: Paperclip --- public/arf.json | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/public/arf.json b/public/arf.json index 55aee8f..5f0ab28 100644 --- a/public/arf.json +++ b/public/arf.json @@ -5971,9 +5971,7 @@ { "name": "Videos", "type": "folder", - "children": [ - - ] + "children": [] }, { "name": "Analysis", @@ -8286,4 +8284,4 @@ ] } ] -} \ No newline at end of file +}