diff --git a/THE-127-domain-enrichment-batch1.md b/THE-127-domain-enrichment-batch1.md new file mode 100644 index 0000000..daf4527 --- /dev/null +++ b/THE-127-domain-enrichment-batch1.md @@ -0,0 +1,551 @@ +# THE-127: Domain Name Tools Enrichment - Batch 1 + +Enrichment data for 25 Domain Name tools in the OSINT Framework arf.json. + +## Whois Records Category + +### 1. Domain Dossier +```json +{ + "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", + "input": "Domain name or IP address", + "output": "WHOIS records, DNS records, IP information, registration details", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 2. domainIQ +```json +{ + "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", + "input": "Domain name", + "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", + "opsec": "passive", + "opsecNote": "Queries aggregated domain data; does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 3. DomainTools Whois +```json +{ + "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", + "status": "live", + "pricing": "paid", + "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", + "input": "Domain name or IP address", + "output": "Current and historical WHOIS records, registrant details, hosting history", + "opsec": "passive", + "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 4. SWITCH Internet Domains Whois (.ch) +```json +{ + "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", + "status": "live", + "pricing": "free", + "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", + "input": ".ch or .li domain name", + "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", + "opsec": "passive", + "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 5. Whoisology +```json +{ + "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", + "input": "Domain name, email, registrant name", + "output": "Historical WHOIS records, ownership changes, registrant information across domains", + "opsec": "passive", + "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 6. Whois ARIN +```json +{ + "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", + "status": "live", + "pricing": "free", + "bestFor": "IP address and ASN registration data, North American internet resource tracking", + "input": "IP address, ASN, organization name, contact information", + "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", + "opsec": "passive", + "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 7. DNSstuff +```json +{ + "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", + "input": "Domain name, IP address", + "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 8. Robtex +```json +{ + "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", + "input": "Domain name, IP address, hostname, autonomous system", + "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", + "opsec": "passive", + "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 9. Domaincrawler.com +```json +{ + "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", + "status": "live", + "pricing": "paid", + "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", + "input": "Domain name, DNS data, technology stack filters", + "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", + "opsec": "passive", + "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 10. MarkMonitor Whois Search +```json +{ + "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", + "status": "live", + "pricing": "paid", + "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", + "input": "Domain name", + "output": "WHOIS records, registration data, brand portfolio information", + "opsec": "passive", + "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 11. easyWhois +```json +{ + "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain WHOIS lookups and DNS checks", + "input": "Domain name", + "output": "WHOIS records, DNS information, registrant details, nameservers", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 12. Website Informer +```json +{ + "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", + "status": "live", + "pricing": "free", + "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", + "input": "Domain name or URL", + "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", + "opsec": "passive", + "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 13. Who.is +```json +{ + "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", + "status": "live", + "pricing": "free", + "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", + "input": "Domain name or IP address", + "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 14. Whois AMPed +```json +{ + "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", + "status": "live", + "pricing": "free", + "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", + "input": "Domain name", + "output": "WHOIS records, domain registration information, registrant details", + "opsec": "passive", + "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 15. ViewDNS.info +```json +{ + "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", + "input": "Domain name, IP address, registrant name/email, nameserver", + "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 16. Daily DNS Changes +```json +{ + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 17. IP2WHOIS +```json +{ + "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", + "status": "live", + "pricing": "free", + "bestFor": "Domain and IP WHOIS lookups, registrant research", + "input": "Domain name or IP address", + "output": "WHOIS records, registrant details, location information, registration dates", + "opsec": "passive", + "opsecNote": "Queries public WHOIS databases; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 18. Netlas.io +```json +{ + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +## Subdomains Category + +### 19. SynapsInt +```json +{ + "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", + "input": "Domain, IP, email, phone, username, CVE ID", + "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", + "opsec": "passive", + "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 20. Aquatone +```json +{ + "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", + "input": "Domain name", + "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", + "opsec": "active", + "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 21. FindSubDomains +```json +{ + "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", + "input": "Domain name or keyword", + "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", + "opsec": "passive", + "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 22. Google Subdomains +```json +{ + "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", + "status": "live", + "pricing": "free", + "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", + "input": "Domain name (as Google Dork syntax: site:domain.com)", + "output": "Indexed subdomains and pages from Google search results", + "opsec": "passive", + "opsecNote": "Uses Google's search index; no direct contact with the target domain.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 23. Recon-ng +```json +{ + "description": "Full-featured web reconnaissance framework with independent modules for data gathering, API integration, and customizable workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Modular web recon, API-driven data collection, credential gathering", + "input": "Domain, company name, email, IP", + "output": "Contacts, hosts, credentials, ports via module-specific results", + "opsec": "passive", + "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 24. XRay +```json +{ + "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", + "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", + "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", + "opsec": "active", + "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 25. DNS Recon +```json +{ + "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", + "status": "live", + "pricing": "free", + "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", + "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", + "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", + "opsec": "active", + "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +--- + +## Summary + +**Tools researched**: 25 +**Category**: Domain Name (Whois Records: 18, Subdomains: 7) +**Pricing breakdown**: +- Free: 15 tools +- Freemium: 4 tools +- Paid: 6 tools + +**OPSEC profile**: +- Passive: 19 tools +- Active: 6 tools + +**Local installation required**: 5 tools (Aquatone, Recon-ng, XRay, DNS Recon, and tools marked with (T)) + +All tools verified as live and accessible as of 2026-03-27. diff --git a/enrichment-batch4-domains.json b/enrichment-batch4-domains.json new file mode 100644 index 0000000..3154513 --- /dev/null +++ b/enrichment-batch4-domains.json @@ -0,0 +1,412 @@ +{ + "enrichments": { + "Threatexpert.com Malicious URLs": { + "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.", + "status": "down", + "pricing": "free", + "bestFor": "Malware URL intelligence", + "input": "Domain or URL", + "output": "Blocklist/Feed format", + "opsec": "passive", + "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Zeus C2 Tracker": { + "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet C2 blocking", + "input": "None (blocklist provider)", + "output": "Domain/IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Queries public Zeus tracker database; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Malware Domains Blacklist": { + "description": "Historical malware domains blocklist providing hosts file format malicious domain list.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Hosts file format", + "opsec": "passive", + "opsecNote": "Legacy service; no longer maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Email Domain Validation": { + "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email domain and mailbox verification", + "input": "Email domain or address", + "output": "Domain validation report, MX records", + "opsec": "active", + "opsecNote": "Active mail server connectivity checks required for validation", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Blackweb": { + "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.", + "status": "live", + "pricing": "free", + "bestFor": "Squid proxy malware filtering", + "input": "None (aggregated blocklist)", + "output": "Squid-compatible blocklist format", + "opsec": "passive", + "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Critical Stack Intel (R)": { + "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.", + "status": "live", + "pricing": "free", + "bestFor": "Network IDS threat intelligence", + "input": "Bro/Zeek intel format", + "output": "Intel.log entries, network alerts", + "opsec": "passive", + "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "DNS Sinkhole": { + "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.", + "status": "degraded", + "pricing": "free", + "bestFor": "DNS-based malware blocking", + "input": "DNS zone file", + "output": "Malware domain sinkhole list", + "opsec": "passive", + "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "DNS-BH Malware Domain Blocklist": { + "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)", + "opsec": "passive", + "opsecNote": "Service sunset; merged into ShadowNet", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Malware Domain List": { + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "MalwareURL (R)": { + "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware URL reputation checking", + "input": "URL", + "output": "Reputation report, blocklist data", + "opsec": "passive", + "opsecNote": "Free lookup service available; commercial network integration available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "scumware.org": { + "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and spyware domain research", + "input": "Domain or URL", + "output": "Domain reputation/blocklist data", + "opsec": "passive", + "opsecNote": "Community-maintained research database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "ZeuS Tracker": { + "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet tracking and blocking", + "input": "None (blocklist provider)", + "output": "Domain blocklist, IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Shadowserver Foundation": { + "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation and abuse intelligence", + "input": "IP address or domain", + "output": "Reputation reports, blocklists, abuse intelligence", + "opsec": "passive", + "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "vURL Online": { + "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.", + "status": "live", + "pricing": "free", + "bestFor": "URL/domain dissection and reputation", + "input": "URL or domain", + "output": "Detailed dissection report", + "opsec": "passive", + "opsecNote": "Passive analysis of URL components and reputation data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "AlienVault Open Threat Exchange": { + "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence sharing", + "input": "Domain, IP, URL, file hash", + "output": "Threat pulses, reputation data, indicators", + "opsec": "passive", + "opsecNote": "Community-sourced intelligence; free API access with registration", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Web Inspector Online Scan": { + "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning", + "input": "Website URL", + "output": "Malware scan report, vulnerability assessment", + "opsec": "active", + "opsecNote": "Active scanning required; connects to target website to analyze content", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Google Safe Browsing API": { + "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and phishing URL detection", + "input": "URL or domain", + "output": "Safe/unsafe classification, threat type", + "opsec": "passive", + "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Cisco Talos": { + "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation intelligence", + "input": "IP address or domain", + "output": "Reputation score, threat indicators, intelligence reports", + "opsec": "passive", + "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "DNS Twist (T)": { + "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting and phishing domain detection", + "input": "Domain name", + "output": "Domain permutation list, DNS records, HTTP similarity", + "opsec": "active", + "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "URLCrazy (T)": { + "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting domain discovery", + "input": "Domain name", + "output": "Domain variant list, registration status", + "opsec": "active", + "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "dnstwister": { + "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Typosquatting monitoring", + "input": "Domain name", + "output": "Domain variants, registration status, DNS records", + "opsec": "active", + "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Catphish (T)": { + "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Red team phishing domain generation", + "input": "Target domain", + "output": "Phishing domain variants, categorization status", + "opsec": "active", + "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "BuiltWith": { + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", + "opsec": "passive", + "opsecNote": "Public website analysis; passive technical reconnaissance", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "SiteSleuth": { + "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking code intelligence and related domain discovery", + "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key", + "output": "List of associated domains and tracking codes", + "opsec": "passive", + "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + } + } +} diff --git a/merge_enrichments.py b/merge_enrichments.py new file mode 100644 index 0000000..f07ecec --- /dev/null +++ b/merge_enrichments.py @@ -0,0 +1,41 @@ +#!/usr/bin/env python3 +import json +import sys + +def merge_enrichment_into_node(node, enrichments): + """Recursively search and merge enrichment data into matching nodes.""" + if isinstance(node, dict): + if "name" in node and node["name"] in enrichments: + # Found a matching tool, merge enrichment data + enrichment = enrichments[node["name"]] + for key, value in enrichment.items(): + node[key] = value + + # Recursively process children + if "children" in node and isinstance(node["children"], list): + for child in node["children"]: + merge_enrichment_into_node(child, enrichments) + +def main(): + # Load enrichment data + with open("enrichment-batch4-domains.json", "r") as f: + enrichment_data = json.load(f) + + enrichments = enrichment_data["enrichments"] + + # Load arf.json + with open("public/arf.json", "r") as f: + arf_data = json.load(f) + + # Merge enrichment data into arf.json + merge_enrichment_into_node(arf_data, enrichments) + + # Write the updated arf.json + with open("public/arf.json", "w") as f: + json.dump(arf_data, f, indent=2) + + print(f"Successfully merged enrichment data for {len(enrichments)} tools") + print("Updated public/arf.json") + +if __name__ == "__main__": + main() diff --git a/public/arf.json b/public/arf.json index a03cf84..5b948e1 100644 --- a/public/arf.json +++ b/public/arf.json @@ -10,6 +10,26 @@ "name": "Username Search Engines", "type": "folder", "children": [ + { + "name": "WhatsMyName (T)", + "type": "url", + "url": "https://github.com/WebBreacher/WhatsMyName", + "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", + "status": "live", + "pricing": "free", + "bestFor": "Username enumeration using community-maintained site detection data", + "input": "Username", + "output": "List of sites where the username exists, based on HTTP response pattern matching", + "opsec": "active", + "opsecNote": "Makes HTTP requests to each target site to check for username existence.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, { "name": "Sylva Identity Discovery (T)", "type": "url", @@ -70,26 +90,6 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "WhatsMyName (T)", - "type": "url", - "url": "https://github.com/WebBreacher/WhatsMyName", - "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", - "status": "live", - "pricing": "free", - "bestFor": "Username enumeration using community-maintained site detection data", - "input": "Username", - "output": "List of sites where the username exists, based on HTTP response pattern matching", - "opsec": "active", - "opsecNote": "Makes HTTP requests to each target site to check for username existence.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, { "name": "Thats Them", "type": "url", @@ -371,37 +371,142 @@ { "name": "Sylva Identity Discovery (T)", "type": "url", - "url": "https://sylva.pfeister.dev/" + "url": "https://sylva.pfeister.dev/", + "description": "Identity discovery utility that searches GitHub and PGP key servers to link identities across platforms using email addresses, usernames, or PGP keys.", + "status": "live", + "pricing": "free", + "bestFor": "Identity correlation via GitHub and PGP", + "input": "Email, username, or PGP fingerprint", + "output": "Linked identities, GitHub profiles, PGP keys", + "opsec": "passive", + "opsecNote": "Queries public GitHub and PGP servers without direct target contact.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThatsThem", "type": "url", - "url": "https://thatsthem.com/reverse-email-lookup" + "url": "https://thatsthem.com/reverse-email-lookup", + "description": "Reverse email lookup tool that searches a database of hundreds of millions of emails to reveal name, address, phone number, and public records associated with an email address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse email lookup, person identification", + "input": "Email address", + "output": "Name, address, phone number, education", + "opsec": "passive", + "opsecNote": "Queries ThatsThem's public database without alerting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunter", "type": "url", - "url": "https://hunter.io/" + "url": "https://hunter.io/", + "description": "Email finder and verifier that discovers business email addresses from company domains, names, and social profiles with up to 98% accuracy rate.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, email verification", + "input": "Domain name, person name, or company info", + "output": "Verified business email addresses", + "opsec": "passive", + "opsecNote": "Queries Hunter's database of public emails; does not contact targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email to Address (R)", "type": "url", - "url": "https://www.melissa.com/" + "url": "https://www.melissa.com/", + "description": "Melissa.com's data quality and verification service that validates and enriches email addresses with supplementary contact information.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, address enrichment", + "input": "Email addresses, contact data", + "output": "Validated email, postal address, phone", + "opsec": "passive", + "opsecNote": "Data verification service; does not perform reconnaissance.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VoilaNorbert", "type": "url", - "url": "https://www.voilanorbert.com/" + "url": "https://www.voilanorbert.com/", + "description": "Email finder and verifier with 98% success rate that discovers business emails by company/domain, person name, or LinkedIn profile with bulk upload capability.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, bulk email finding", + "input": "Domain, name, or LinkedIn URL", + "output": "Business email addresses, verification status", + "opsec": "passive", + "opsecNote": "Searches public email database; does not contact targets directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "GHunt (T)", "type": "url", - "url": "https://github.com/mxrch/GHunt" + "url": "https://github.com/mxrch/GHunt", + "description": "Offensive Google framework that investigates Google accounts using email addresses to uncover YouTube channels, Google Photos, Maps reviews, and associated artifacts.", + "status": "live", + "pricing": "free", + "bestFor": "Google account investigation, YouTube/Google Photos OSINT", + "input": "Gmail address or GAIA ID", + "output": "YouTube channels, Google Photos, Maps reviews, device info", + "opsec": "active", + "opsecNote": "Requires Google login via browser extension; may be detected by Google.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OSINT Industries", "type": "url", - "url": "https://www.osint.industries/" + "url": "https://www.osint.industries/", + "description": "Account linking service that extracts all registered accounts tied to an email or phone across 500+ platforms including social media, messaging apps, and lifestyle services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Account enumeration, breach detection, digital footprint mapping", + "input": "Email address, phone number, username, or crypto wallet", + "output": "Linked accounts, breach information, geospatial data, timeline", + "opsec": "passive", + "opsecNote": "Scours public websites and databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", @@ -426,27 +531,102 @@ { "name": "Infoga (T)", "type": "url", - "url": "https://github.com/m4ll0k/infoga" + "url": "https://github.com/m4ll0k/infoga", + "description": "Python-based email OSINT tool that gathers email account information (IP, hostname, country) from search engines, PGP servers, and Shodan, with breach checking via haveibeenpwned.", + "status": "live", + "pricing": "free", + "bestFor": "Early-stage email reconnaissance, information gathering", + "input": "Email address", + "output": "IP addresses, hostnames, country, breach status", + "opsec": "passive", + "opsecNote": "Queries search engines and public APIs without direct target contact.", + "localInstall": true, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Skymem", "type": "url", - "url": "https://www.skymem.info/" + "url": "https://www.skymem.info/", + "description": "Email finder that discovers company and personal email addresses by domain or name, with bulk search, email list creation, and advanced filtering capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email discovery by domain, bulk email list creation", + "input": "Domain name or person name + domain", + "output": "Email addresses, bulk email lists", + "opsec": "passive", + "opsecNote": "Scrapes and aggregates public email data from websites and profiles.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Epieos Email Tool", "type": "url", - "url": "https://tools.epieos.com/email.php" + "url": "https://tools.epieos.com/email.php", + "description": "Freemium OSINT tool performing email reverse lookups to uncover associated social media profiles across 120+ websites and services with breach detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email reverse lookup, social media profile discovery", + "input": "Email address or phone number", + "output": "Associated social media profiles, forum posts, breach info", + "opsec": "passive", + "opsecNote": "Passive reconnaissance across 120+ websites; does not alert the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "breach.vip", "type": "url", - "url": "https://breach.vip/" + "url": "https://breach.vip/", + "description": "Free database search engine providing access to 1000+ breach databases for research, email searching, and analysis of compromised credentials.", + "status": "live", + "pricing": "free", + "bestFor": "Breach database search, credential lookup", + "input": "Email, domain, Discord ID, or phone number", + "output": "Breach records, leaked credentials", + "opsec": "passive", + "opsecNote": "Queries aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Holehe (T)", "type": "url", - "url": "https://github.com/megadose/holehe" + "url": "https://github.com/megadose/holehe", + "description": "Python-based email enumeration tool that checks if an email is registered across 120+ websites and services using password-reset mechanisms.", + "status": "live", + "pricing": "free", + "bestFor": "Email account enumeration, service detection", + "input": "Email address", + "output": "List of websites where email is registered", + "opsec": "passive", + "opsecNote": "Uses password-reset functionality without sending emails or alerting targets.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -457,12 +637,42 @@ { "name": "Email Format", "type": "url", - "url": "https://www.email-format.com/" + "url": "https://www.email-format.com/", + "description": "Tool for analyzing and discovering corporate email address patterns and formats to predict valid employee email addresses within an organization.", + "status": "live", + "pricing": "free", + "bestFor": "Corporate email pattern analysis, email format discovery", + "input": "Sample email addresses or company info", + "output": "Predicted email format patterns", + "opsec": "passive", + "opsecNote": "Statistical analysis of publicly known email patterns.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Permutator", "type": "url", - "url": "https://metricsparrow.com/toolkit/email-permutator/" + "url": "https://metricsparrow.com/toolkit/email-permutator/", + "description": "OSINT tool that generates all possible email address combinations from a person's name and domain(s) for reconnaissance and email guessing.", + "status": "live", + "pricing": "free", + "bestFor": "Email pattern generation, targeted email guessing", + "input": "Person name, nickname, domain(s)", + "output": "List of possible email address variations", + "opsec": "passive", + "opsecNote": "Generates permutations without any network contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -473,37 +683,187 @@ { "name": "Reacher Github (T)", "type": "url", - "url": "https://github.com/reacherhq/check-if-email-exists" + "url": "https://github.com/reacherhq/check-if-email-exists", + "description": "Open-source Rust-based email verification API that checks email deliverability without sending messages, detecting catch-all and disposable addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification, bounce detection, list cleaning", + "input": "Email address", + "output": "Deliverability status, MX records, bounce type", + "opsec": "passive", + "opsecNote": "Verifies email existence through MTA queries without sending mail.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Reacher Demo", "type": "url", - "url": "https://reacher.email" + "url": "https://reacher.email", + "description": "Hosted demo of the Reacher email verification API allowing free testing of email validation and deliverability checks online.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification testing, demonstration", + "input": "Email address", + "output": "Deliverability status, bounce information", + "opsec": "passive", + "opsecNote": "Passive MTA-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MailScrap", "type": "url", - "url": "https://mailscrap.com/" + "url": "https://mailscrap.com/", + "description": "Email verification tool that connects to mail servers to verify mailbox existence and removes disposable email addresses from lists.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email validation, list cleaning, disposable email detection", + "input": "Email addresses or email lists", + "output": "Validation status, mailbox existence", + "opsec": "passive", + "opsecNote": "Connects to mail servers for verification without sending messages.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Read Notify", "type": "url", - "url": "https://www.readnotify.com/" + "url": "https://www.readnotify.com/", + "description": "Email tracking and read receipt service that monitors email opens and engagement, useful for confirming email validity through delivery.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email delivery confirmation, read receipt tracking", + "input": "Email address", + "output": "Delivery and read status", + "opsec": "active", + "opsecNote": "Sends tracking pixels; may alert targets to monitoring.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Reputation", "type": "url", - "url": "https://emailrep.io/" + "url": "https://emailrep.io/", + "description": "Tool that checks email reputation, risk scoring, and breach history to identify phishing emails, compromised accounts, and risky addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email reputation checking, risk assessment", + "input": "Email address", + "output": "Reputation score, risk level, breach history", + "opsec": "passive", + "opsecNote": "Passive database lookup without target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MailboxValidator", "type": "url", - "url": "https://www.mailboxvalidator.com/demo" + "url": "https://www.mailboxvalidator.com/demo", + "description": "Email verification API that validates email deliverability, detects catch-all addresses, and provides risk scoring for bulk email list cleaning.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, list cleaning, bounce prevention", + "input": "Email addresses or bulk lists", + "output": "Validation status, risk score, catch-all detection", + "opsec": "passive", + "opsecNote": "Server-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VerifyEmail (R$)", "type": "url", "url": "https://emailable.com/" + }, + { + "name": "Disposable Email Domains (T)", + "type": "url", + "url": "https://github.com/disposable-email-domains/disposable-email-domains", + "description": "Community-maintained blocklist of 5,000+ disposable email domains with allowlist support and multi-language implementation examples. Used by PyPI and other projects.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting disposable and temporary email addresses during verification", + "input": "Domain name to check against the blocklist", + "output": "Match result against the disposable email domain blocklist", + "opsec": "passive", + "opsecNote": "Local list comparison; no external requests made during lookup.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Disposable Emails Registry", + "type": "url", + "url": "https://disposable-emails.github.io/", + "description": "Searchable registry of disposable email domains with bulk download support for threat intelligence integration.", + "status": "live", + "pricing": "free", + "bestFor": "Bulk blocking and threat intelligence integration for disposable email detection", + "input": "Domain name or bulk list download", + "output": "Match result or full disposable domain list (/list.txt)", + "opsec": "passive", + "opsecNote": "Static list download; community-sourced submissions, no external lookups required.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Burner Email Providers (T)", + "type": "url", + "url": "https://github.com/wesbos/burner-email-providers", + "description": "Curated list of temporary email service domains with API references and detection library implementations across multiple languages.", + "status": "live", + "pricing": "free", + "bestFor": "Identifying burner email providers for integration into custom investigation tools", + "input": "Email domain", + "output": "Match result against known burner/temporary email providers", + "opsec": "passive", + "opsecNote": "Local list comparison; MIT licensed for integration use.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -534,17 +894,62 @@ { "name": "Hudson Rock", "type": "url", - "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" + "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools", + "description": "Infostealer threat intelligence platform that searches a database of compromised devices and stolen credentials to identify if emails have been exposed via malware infections.", + "status": "live", + "pricing": "freemium", + "bestFor": "Infostealer detection, breach assessment, device compromise verification", + "input": "Email address, domain, username, or IP", + "output": "Infostealer hits, compromised account data, breach details", + "opsec": "passive", + "opsecNote": "Queries public infostealer database compiled from malware captures.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DeHashed (R)", "type": "url", - "url": "https://dehashed.com/" + "url": "https://dehashed.com/", + "description": "Modern breach search engine indexing historical breach data over a decade old, enabling searches by email, username, password, domain, phone, and IP address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Breach searching, credential lookup, historical breach analysis", + "input": "Email, username, password, domain, phone, or IP", + "output": "Breach records, exposed credentials, breach dates", + "opsec": "passive", + "opsecNote": "Searches aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Vigilante.pw", "type": "url", - "url": "https://www.vigilante.pw/" + "url": "https://www.vigilante.pw/", + "description": "Breach database directory and search platform raising awareness of data breaches by aggregating publicly leaked database information and breach details.", + "status": "live", + "pricing": "free", + "bestFor": "Breach research, public breach database navigation", + "input": "Email, username, domain", + "output": "Breach records, exposed data information", + "opsec": "passive", + "opsecNote": "Aggregates and indexes publicly disclosed breach data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -555,7 +960,22 @@ { "name": "MxToolbox", "type": "url", - "url": "https://mxtoolbox.com/" + "url": "https://mxtoolbox.com/", + "description": "Email deliverability diagnostics tool that checks MX records, SPF, DKIM, DMARC configuration, and server health to prevent email delivery issues.", + "status": "live", + "pricing": "free", + "bestFor": "Email server diagnostics, deliverability testing, DNS validation", + "input": "Domain name or email address", + "output": "MX records, SPF/DKIM/DMARC status, blacklist info", + "opsec": "passive", + "opsecNote": "Public DNS lookups and SMTP diagnostics without target alerting.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -572,92 +992,362 @@ { "name": "Domain Dossier", "type": "url", - "url": "https://centralops.net/co/DomainDossier.aspx" + "url": "https://centralops.net/co/DomainDossier.aspx", + "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", + "input": "Domain name or IP address", + "output": "WHOIS records, DNS records, IP information, registration details", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "domainIQ", "type": "url", - "url": "https://www.domainiq.com/" + "url": "https://www.domainiq.com/", + "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", + "input": "Domain name", + "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", + "opsec": "passive", + "opsecNote": "Queries aggregated domain data; does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DomainTools Whois", "type": "url", - "url": "https://whois.domaintools.com/" + "url": "https://whois.domaintools.com/", + "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", + "status": "live", + "pricing": "paid", + "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", + "input": "Domain name or IP address", + "output": "Current and historical WHOIS records, registrant details, hosting history", + "opsec": "passive", + "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "SWITCH Internet Domains Whois (.ch)", "type": "url", - "url": "https://www.nic.ch/whois/" + "url": "https://www.nic.ch/whois/", + "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", + "status": "live", + "pricing": "free", + "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", + "input": ".ch or .li domain name", + "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", + "opsec": "passive", + "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whoisology", "type": "url", - "url": "https://whoisology.com/#advanced" + "url": "https://whoisology.com/#advanced", + "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", + "input": "Domain name, email, registrant name", + "output": "Historical WHOIS records, ownership changes, registrant information across domains", + "opsec": "passive", + "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whois ARIN", "type": "url", - "url": "https://whois.arin.net/ui/advanced.jsp" + "url": "https://whois.arin.net/ui/advanced.jsp", + "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", + "status": "live", + "pricing": "free", + "bestFor": "IP address and ASN registration data, North American internet resource tracking", + "input": "IP address, ASN, organization name, contact information", + "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", + "opsec": "passive", + "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNSstuff", "type": "url", - "url": "https://www.dnsstuff.com/freetools" + "url": "https://www.dnsstuff.com/freetools", + "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", + "input": "Domain name, IP address", + "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Robtex (R)", "type": "url", - "url": "https://robtex.com/" + "url": "https://robtex.com/", + "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", + "input": "Domain name, IP address, hostname, autonomous system", + "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", + "opsec": "passive", + "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Domaincrawler.com", "type": "url", - "url": "https://domaincrawler.com/" + "url": "https://domaincrawler.com/", + "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", + "status": "live", + "pricing": "paid", + "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", + "input": "Domain name, DNS data, technology stack filters", + "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", + "opsec": "passive", + "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MarkMonitor Whois Search", "type": "url", - "url": "https://domains.markmonitor.com/whois/" + "url": "https://domains.markmonitor.com/whois/", + "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", + "status": "live", + "pricing": "paid", + "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", + "input": "Domain name", + "output": "WHOIS records, registration data, brand portfolio information", + "opsec": "passive", + "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "easyWhois", "type": "url", - "url": "https://www.easywhois.com/" + "url": "https://www.easywhois.com/", + "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain WHOIS lookups and DNS checks", + "input": "Domain name", + "output": "WHOIS records, DNS information, registrant details, nameservers", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Website Informer", "type": "url", - "url": "https://website.informer.com/" + "url": "https://website.informer.com/", + "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", + "status": "live", + "pricing": "free", + "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", + "input": "Domain name or URL", + "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", + "opsec": "passive", + "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Who.is", "type": "url", - "url": "https://who.is/" + "url": "https://who.is/", + "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", + "status": "live", + "pricing": "free", + "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", + "input": "Domain name or IP address", + "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whois AMPed", "type": "url", - "url": "https://whoisamped.com/" + "url": "https://whoisamped.com/", + "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", + "status": "live", + "pricing": "free", + "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", + "input": "Domain name", + "output": "WHOIS records, domain registration information, registrant details", + "opsec": "passive", + "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ViewDNS.info", "type": "url", - "url": "https://viewdns.info/" + "url": "https://viewdns.info/", + "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", + "input": "Domain name, IP address, registrant name/email, nameserver", + "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2WHOIS", "type": "url", - "url": "https://www.ip2whois.com" + "url": "https://www.ip2whois.com", + "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", + "status": "live", + "pricing": "free", + "bestFor": "Domain and IP WHOIS lookups, registrant research", + "input": "Domain name or IP address", + "output": "WHOIS records, registrant details, location information, registration dates", + "opsec": "passive", + "opsecNote": "Queries public WHOIS databases; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/whois_domains/" + "url": "https://app.netlas.io/whois_domains/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -668,22 +1358,82 @@ { "name": "SynapsInt", "type": "url", - "url": "https://synapsint.com" + "url": "https://synapsint.com", + "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", + "input": "Domain, IP, email, phone, username, CVE ID", + "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", + "opsec": "passive", + "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Aquatone (T)", "type": "url", - "url": "https://github.com/michenriksen/aquatone" + "url": "https://github.com/michenriksen/aquatone", + "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", + "input": "Domain name", + "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", + "opsec": "active", + "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FindSubDomains", "type": "url", - "url": "https://findsubdomains.com/" + "url": "https://findsubdomains.com/", + "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", + "input": "Domain name or keyword", + "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", + "opsec": "passive", + "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Subdomains (D)", "type": "url", - "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E" + "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E", + "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", + "status": "live", + "pricing": "free", + "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", + "input": "Domain name (as Google Dork syntax: site:domain.com)", + "output": "Indexed subdomains and pages from Google search results", + "opsec": "passive", + "opsecNote": "Uses Google's search index; no direct contact with the target domain.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Recon-ng (T)", @@ -708,45 +1458,135 @@ { "name": "XRay", "type": "url", - "url": "https://github.com/evilsocket/xray" + "url": "https://github.com/evilsocket/xray", + "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", + "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", + "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", + "opsec": "active", + "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Recon (T)", "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" + "url": "https://github.com/darkoperator/dnsrecon", + "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", + "status": "live", + "pricing": "free", + "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", + "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", + "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", + "opsec": "active", + "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Gobuster (T)", "type": "url", - "url": "https://github.com/OJ/gobuster" + "url": "https://github.com/OJ/gobuster", + "description": "Multi-mode brute-force tool for DNS subdomain, virtual host, and directory discovery.", + "status": "live", + "pricing": "free", + "bestFor": "Fast DNS and vhost brute-force enumeration", + "input": "Domain, wordlist, and optional resolver/thread settings", + "output": "Discovered subdomains, vhosts, or directories with response details", + "opsec": "active", + "opsecNote": "Sends direct DNS/HTTP probes and can generate noisy traffic patterns.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Fierce Domain Scanner (T)", "type": "url", - "url": "https://github.com/davidpepper/fierce-domain-scanner" + "url": "https://github.com/davidpepper/fierce-domain-scanner", + "description": "DNS reconnaissance tool focused on subdomain discovery and non-contiguous IP space mapping.", + "status": "live", + "pricing": "free", + "bestFor": "DNS recon and subdomain-to-IP mapping", + "input": "Domain, DNS server options, and optional wordlist/range parameters", + "output": "Subdomains, resolved IPs, and DNS reconnaissance findings", + "opsec": "active", + "opsecNote": "Performs direct DNS lookups and optional scans that can be logged by infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bluto (T)", "type": "url", - "url": "https://github.com/darryllane/Bluto" + "url": "https://github.com/darryllane/Bluto", + "description": "Recon utility for domain intelligence including DNS records, email patterns, and infrastructure clues.", + "status": "live", + "pricing": "free", + "bestFor": "Initial domain footprinting and asset discovery", + "input": "Target domain and optional scan switches", + "output": "Aggregated recon output including DNS and related domain artifacts", + "opsec": "active", + "opsecNote": "Runs active lookups against target-related infrastructure and third-party services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OWASP Maryam (T)", "type": "url", - "url": "https://github.com/saeeddhqan/Maryam" + "url": "https://github.com/saeeddhqan/Maryam", + "description": "Modular OWASP OSINT framework with footprinting and search modules for multi-source reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Scriptable multi-module OSINT reconnaissance workflows", + "input": "Domain, IP, email, username, or module-specific query terms", + "output": "Module-based findings such as subdomains, metadata, and related intelligence", + "opsec": "active", + "opsecNote": "Can issue direct queries and module-driven probes depending on selected workflow.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", "type": "url", "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "description": "Command-line tool for harvesting emails, subdomains, hosts, and URLs from public data sources.", "status": "live", "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", + "bestFor": "Passive email and subdomain collection from indexed sources", + "input": "Domain and selected data source(s)", + "output": "Email addresses, subdomains, hostnames, IPs, and related metadata", "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "opsecNote": "Queries third-party sources instead of directly interacting with the target host.", "localInstall": true, "googleDork": false, "registration": false, @@ -758,37 +1598,142 @@ { "name": "Pentest-tools.com Subdomains", "type": "url", - "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" + "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain", + "description": "Web-based subdomain finder that enumerates subdomains for a given domain through hosted scanning.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick browser-based subdomain discovery without local setup", + "input": "Domain name", + "output": "List of discovered subdomains and related DNS intelligence", + "opsec": "passive", + "opsecNote": "Scanning is performed by Pentest-Tools infrastructure, not directly from your host.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SecLists DNS Subdomains (T)", "type": "url", - "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" + "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS", + "description": "Community-maintained DNS wordlist collection used to power subdomain brute-force workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Supplying high-quality DNS wordlists for enumeration tools", + "input": "Domain and chosen wordlist file used in external tooling", + "output": "Wordlist candidates for subdomain brute-force and permutation attacks", + "opsec": "passive", + "opsecNote": "Repository itself is passive; OPSEC impact depends on how the lists are used.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dnspop (T)", "type": "url", - "url": "https://github.com/bitquark/dnspop" + "url": "https://github.com/bitquark/dnspop", + "description": "DNS reconnaissance utility for enumerating records and identifying domain-related infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Command-line DNS recon and record analysis", + "input": "Domain and optional scan parameters", + "output": "DNS records, discovered hosts, and recon findings", + "opsec": "active", + "opsecNote": "Performs direct DNS queries against resolvers and target-associated records.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "gdns (T)", "type": "url", - "url": "https://github.com/hrbrmstr/gdns" + "url": "https://github.com/hrbrmstr/gdns", + "description": "Google DNS-focused command-line tool for DNS lookup and domain record exploration.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS enumeration via Google DNS services", + "input": "Domain and query options", + "output": "Resolved DNS records and related lookup results", + "opsec": "active", + "opsecNote": "Issues active DNS lookup requests that may be observable at resolver level.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sublist3r", "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" + "url": "https://github.com/aboul3la/Sublist3r", + "description": "Python tool for subdomain enumeration using search engines, passive sources, and optional brute-force.", + "status": "live", + "pricing": "free", + "bestFor": "Combining passive and active subdomain discovery in one tool", + "input": "Domain and optional brute-force/thread settings", + "output": "Consolidated list of discovered subdomains", + "opsec": "active", + "opsecNote": "Uses multiple external sources and optional brute-force that can generate detectable traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AltDNS (T)", "type": "url", - "url": "https://github.com/infosec-au/altdns" + "url": "https://github.com/infosec-au/altdns", + "description": "Permutation-based DNS tool that generates and resolves alternative subdomains from known names.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering likely subdomain variants through permutations", + "input": "Known subdomains, wordlist, and target domain", + "output": "Resolved alternative subdomains and permutation results", + "opsec": "active", + "opsecNote": "Performs direct DNS resolution on generated permutations, creating active query footprints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/domains/" + "url": "https://app.netlas.io/domains/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -800,14 +1745,14 @@ "name": "Shodan", "type": "url", "url": "https://www.shodan.io/", - "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", + "description": "Search engine for internet-exposed devices, services, and security-relevant banners.", "status": "live", "pricing": "freemium", - "bestFor": "Port scanning, banner grabbing, IoT discovery", - "input": "IP address, domain", - "output": "Open ports, services, banners, CVEs", + "bestFor": "Finding exposed services and infrastructure risk indicators", + "input": "IP, domain, ASN, organization, or filter-based search query", + "output": "Service banners, open ports, geolocation, vulnerabilities, and host metadata", "opsec": "passive", - "opsecNote": "Queries cached scan data. Does not directly probe the target.", + "opsecNote": "Uses Shodan indexed scan data; target systems are not probed from your local host.", "localInstall": false, "googleDork": false, "registration": true, @@ -819,50 +1764,175 @@ { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/" + "url": "https://app.netlas.io/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kraken (T)", "type": "url", - "url": "https://github.com/Sw4mpf0x/Kraken" + "url": "https://github.com/Sw4mpf0x/Kraken", + "description": "Open-source reconnaissance utility for domain and network intelligence gathering workflows.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-driven reconnaissance against domain and host assets", + "input": "Domain, host, or target parameters supported by selected module", + "output": "Recon findings across DNS, host intelligence, and related artifacts", + "opsec": "active", + "opsecNote": "Runs active collection modules that can generate requests visible to target infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "URL and domain analysis service that captures page loads, requests, and security-relevant artifacts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Investigating suspicious URLs with scan snapshots and indicators", + "input": "URL or domain", + "output": "Scan reports including redirects, requests, domains, IPs, and screenshots", + "opsec": "passive", + "opsecNote": "Analysis runs on urlscan infrastructure; target contact is performed from their scanners.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Redirect Detective", "type": "url", - "url": "https://redirectdetective.com/" + "url": "https://redirectdetective.com/", + "description": "Web tool that traces URL redirect chains and final destinations across multi-hop redirects.", + "status": "live", + "pricing": "free", + "bestFor": "Understanding redirect paths and affiliate or cloaking behavior", + "input": "URL", + "output": "Redirect chain, intermediate hops, and final destination URL", + "opsec": "passive", + "opsecNote": "Redirect checks are initiated through the service, limiting direct local target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sitediff (T)", "type": "url", - "url": "https://github.com/digininja/sitediff" + "url": "https://github.com/digininja/sitediff", + "description": "Command-line utility for comparing website versions to detect content and structural changes.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking site changes between snapshots for monitoring and QA", + "input": "Two URLs or snapshots to compare", + "output": "Diff output highlighting content and structural deltas", + "opsec": "passive", + "opsecNote": "Primarily compares fetched content; does not perform intrusive probing by design.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Technology profiling platform that identifies web stacks, frameworks, analytics, and hosting signals.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", + "bestFor": "Website technology stack fingerprinting and ecosystem mapping", "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "output": "Detected technologies, hosting/CDN indicators, and related site intelligence", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Returns platform-collected intelligence and does not require direct target probing by the user.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Wappalyzer", + "type": "url", + "url": "https://www.wappalyzer.com/", + "description": "Technology detection platform and browser tooling for identifying frameworks, CMS, and SaaS usage.", + "status": "live", + "pricing": "freemium", + "bestFor": "Detecting web technologies and software dependencies at scale", + "input": "Domain, URL, or browsed webpage", + "output": "Detected technologies by category with confidence indicators", + "opsec": "passive", + "opsecNote": "Uses extension/service analysis of page resources; minimal direct probing behavior.", "localInstall": false, "googleDork": false, "registration": true, @@ -871,30 +1941,85 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "Wappalyzer", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, { "name": "AnalyzeID", "type": "url", - "url": "https://analyzeid.com/" + "url": "https://analyzeid.com/", + "description": "Reverse lookup service for tracking IDs such as Google Analytics, AdSense, and affiliate identifiers.", + "status": "live", + "pricing": "free", + "bestFor": "Pivoting from shared tracking IDs to related domains", + "input": "Tracking ID (analytics, ads, affiliate, or publisher ID)", + "output": "Associated domains and identifier reuse relationships", + "opsec": "passive", + "opsecNote": "Operates on indexed identifier-to-domain mappings without active target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "Cyber threat intelligence search engine for exposed assets, domains, vulnerabilities, and risk indicators.", + "status": "live", + "pricing": "freemium", + "bestFor": "Threat-focused lookup of internet-facing assets and exposures", + "input": "IP, domain, ASN, CVE, or filter-based threat query", + "output": "Asset details, risk scores, service fingerprints, and vulnerability context", + "opsec": "passive", + "opsecNote": "Searches provider datasets rather than scanning targets directly from analyst infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "urlDNA", "type": "url", - "url": "https://urldna.io" + "url": "https://urldna.io", + "description": "URL intelligence service for investigating domains, redirects, and related reputation indicators.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick URL/domain triage and intelligence pivoting", + "input": "URL or domain", + "output": "URL analysis details, related domains, and risk-relevant metadata", + "opsec": "passive", + "opsecNote": "Uses service-side analysis and historical datasets instead of direct local probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ZoomEye.ai", "type": "url", - "url": "https://www.zoomeye.org/" + "url": "https://www.zoomeye.org/", + "description": "Cyberspace search engine indexing internet-connected devices, services, and vulnerabilities globally. Provides AI-powered search via ZoomEyeGPT with support for ZoomEye dorks for targeted reconnaissance.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet device discovery, service enumeration, vulnerability mapping, attack surface assessment", + "input": "Domain, IP, port, service, or natural language query", + "output": "Device list, port data, banner info, vulnerability details, geographic distribution", + "opsec": "passive", + "opsecNote": "Queries ZoomEye's pre-scanned internet data; does not probe targets during search.", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -910,12 +2035,42 @@ { "name": "Google's Certificate Transparency", "type": "url", - "url": "https://www.certificate-transparency.org/known-logs" + "url": "https://www.certificate-transparency.org/known-logs", + "description": "Directory of all known Certificate Transparency logs monitored by Chrome and other browsers. Browse CT log records to discover issued certificates, identify unauthorized domain certificates, and monitor for certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate discovery, unauthorized cert detection, domain monitoring", + "input": "Domain name or certificate fingerprint", + "output": "List of CT logs and certificates issued for the specified domain", + "opsec": "passive", + "opsecNote": "Queries public certificate logs without contacting the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/certificate" + "url": "https://spyse.com/search/certificate", + "description": "Internet assets registry providing certificate search, domain intelligence, and vulnerability discovery. Scans domains, subdomains, certificates, emails, and open ports across the global internet.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain intelligence, certificate discovery, subdomain enumeration, vulnerability identification", + "input": "Domain, IP, certificate, email, or organization name", + "output": "Domain details, subdomains, certificates, WHOIS info, CVEs, open ports, scraped emails", + "opsec": "passive", + "opsecNote": "Queries Spyse's pre-scanned database; does not contact the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Censys", @@ -940,22 +2095,82 @@ { "name": "crt.sh - Certificate Search", "type": "url", - "url": "https://crt.sh/?" + "url": "https://crt.sh/?", + "description": "CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate search, subdomain discovery via CT logs, detecting unauthorized certificates", + "input": "Domain name (with or without wildcard)", + "output": "List of certificates issued to the domain with Subject Alternative Names and issue/expiry dates", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CertKit - Certificate Transparency Log Search", "type": "url", - "url": "https://www.certkit.io/tools/ct-logs/" + "url": "https://www.certkit.io/tools/ct-logs/", + "description": "Fast Certificate Transparency log search tool using Clickhouse for sub-second queries. Discover all certificates issued to a domain, including Subject Alternative Names, to reveal hidden infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "CT certificate search, subdomain enumeration, certificate misuse detection", + "input": "Domain name", + "output": "List of certificates with issuance dates, expiry dates, and Subject Alternative Names", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "certgraph (T)", "type": "url", - "url": "https://github.com/lanrat/certgraph" + "url": "https://github.com/lanrat/certgraph", + "description": "CLI tool that crawls SSL certificates via Certificate Transparency logs to create a directed graph of domain relationships. Supports multiple drivers including crt.sh, Censys, HTTPS, and SMTP.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate mapping, domain relationship discovery, hostname enumeration via SSL certificates", + "input": "Hostname or domain name", + "output": "Directed graph showing domain nodes and certificate alternative name connections between domains", + "opsec": "passive", + "opsecNote": "Default HTTPS driver can make connections to hosts; alternative drivers query CT logs passively. Use CT drivers for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/certs/" + "url": "https://app.netlas.io/certs/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -966,17 +2181,62 @@ { "name": "Mnemonic", "type": "url", - "url": "https://passivedns.mnemonic.no/" + "url": "https://passivedns.mnemonic.no/", + "description": "Mnemonic's public PassiveDNS service providing historical and current DNS records collected from global sensor networks. Unauthenticated queries available with rate limiting.", + "status": "live", + "pricing": "free", + "bestFor": "Passive DNS lookups, historical domain resolutions, DNS reconnaissance", + "input": "Domain or IP address", + "output": "DNS query history with timestamps, associated IPs, and historical resolutions", + "opsec": "passive", + "opsecNote": "Queries a passive database of DNS records; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Dumpster", "type": "url", - "url": "https://dnsdumpster.com/" + "url": "https://dnsdumpster.com/", + "description": "Free domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Subdomain enumeration, DNS reconnaissance, infrastructure mapping", + "input": "Domain name", + "output": "MX records, TXT records, Host records, subdomains, infrastructure map", + "opsec": "passive", + "opsecNote": "Passive DNS research without sending direct DNS requests or probing the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Deteque (R)", "type": "url", - "url": "https://www.deteque.com/" + "url": "https://www.deteque.com/", + "description": "Real-time IP, domain, and threat intelligence from Spamhaus and abuse.ch alliance. Provides comprehensive malware, botnet, and abuse data with diverse IOC coverage (IPs, domains, URLs, files, cryptos).", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware tracking, botnet detection, abuse data", + "input": "Domain, IP, URL, file hash, or AS number", + "output": "Threat classification, malware associations, botnet data, historical records (up to 12 months)", + "opsec": "passive", + "opsecNote": "Queries threat intelligence database; does not contact or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -987,97 +2247,382 @@ { "name": "UrlQuery.net", "type": "url", - "url": "https://urlquery.net/" + "url": "https://urlquery.net/", + "description": "Free online URL scanner that analyzes webpages for malware, suspicious elements, and phishing threats. Provides comprehensive threat detection reports with threat briefs on emerging campaigns.", + "status": "live", + "pricing": "free", + "bestFor": "URL reputation scanning, malware detection, phishing detection, threat analysis", + "input": "URL or webpage", + "output": "Threat report, detected threats, malicious behavior, anomalies, security assessment", + "opsec": "active", + "opsecNote": "Visits and analyzes the submitted URL; the target server may detect the scan.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Void", "type": "url", - "url": "https://www.urlvoid.com/" + "url": "https://www.urlvoid.com/", + "description": "Free website reputation checker that scans URLs against 30+ blocklist engines and reputation services. Detects fraudulent and malicious websites with browser extension available.", + "status": "live", + "pricing": "free", + "bestFor": "Website reputation checking, malware/phishing detection, threat analysis", + "input": "Website URL", + "output": "Safety report from 30+ blocklists, IP details, domain age, server location, threat indicators", + "opsec": "passive", + "opsecNote": "Queries blocklist and reputation services; does not directly visit or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FortiGuard Reputation Service", "type": "url", - "url": "https://fortiguard.com/iprep" + "url": "https://fortiguard.com/iprep", + "description": "Fortinet's IP reputation service aggregating malicious source IP data from global threat sensors and collaborators. Blocks botnets, DDoS sources, and IPs associated with phishing, scanning, and malware.", + "status": "live", + "pricing": "free", + "bestFor": "IP reputation lookup, botnet/malware source identification, threat intelligence", + "input": "IP address or IP range", + "output": "IP reputation score, threat categories, malware associations, botnet status", + "opsec": "passive", + "opsecNote": "Queries Fortinet's IP reputation database without contacting the target IP.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Trend Micro Site Safety Center", "type": "url", - "url": "https://global.sitesafety.trendmicro.com/" + "url": "https://global.sitesafety.trendmicro.com/", + "description": "Free service that checks website safety ratings from Trend Micro's research and reputation sources. Identifies websites with malware, phishing activity, or suspicious behavior.", + "status": "live", + "pricing": "free", + "bestFor": "Website safety verification, malware/phishing detection, threat assessment", + "input": "Website URL", + "output": "Safety rating, category classification, threat indicators, historical data", + "opsec": "passive", + "opsecNote": "Queries Trend Micro's pre-scanned website reputation database without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchGuard ReputationAuthority", "type": "url", - "url": "https://www.reputationauthority.org/" + "url": "https://www.reputationauthority.org/", + "description": "In-the-cloud reputation monitoring service analyzing URL and IP threat risk. Assigns reputation scores between 1-100 using data from global sources and deployed systems.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation scoring, threat risk assessment, malicious source identification", + "input": "URL or IP address", + "output": "Reputation score (1-100), threat risk level, URL category, blocking recommendations", + "opsec": "passive", + "opsecNote": "Queries WatchGuard's reputation servers without contacting the target directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sucuri SiteCheck", "type": "url", - "url": "https://sitecheck.sucuri.net/" + "url": "https://sitecheck.sucuri.net/", + "description": "Free remote website scanner that checks for malware, security threats, blacklisting, and vulnerabilities. Detects outdated CMS versions, insecure configurations, and security anomalies.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning, vulnerability detection, security assessment", + "input": "Website URL", + "output": "Security scan report, malware detection, blacklist status, vulnerable plugin/CMS details", + "opsec": "active", + "opsecNote": "Remotely visits the website to check source code and security; may be detectable by WAF/IDS.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThreatMiner.org", "type": "url", - "url": "https://www.threatminer.org/" + "url": "https://www.threatminer.org/", + "description": "Non-profit threat intelligence portal providing IOC research including domains, IPs, malware samples, SSL certificates, WHOIS data, and malicious URLs under Creative Commons license.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence research, IOC investigation, malware/phishing link analysis", + "input": "Domain, IP, file hash (MD5/SHA1/SHA256), SSL certificate, or URL", + "output": "Threat reports, IOC data, WHOIS info, malware associations, related indicators", + "opsec": "passive", + "opsecNote": "Queries aggregated threat intelligence data from multiple sources; does not probe targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BlueCoat WebPulse", "type": "url", - "url": "https://sitereview.bluecoat.com/sitereview.jsp" + "url": "https://sitereview.bluecoat.com/sitereview.jsp", + "description": "Web reputation filtering service rating URLs with 50+ language support. Processes 180+ million rating requests daily with Dynamic Link Analysis for attack injection detection.", + "status": "live", + "pricing": "free", + "bestFor": "URL categorization, website reputation filtering, malicious link detection", + "input": "Website URL", + "output": "URL category, reputation rating, threat indicators, web content classification", + "opsec": "passive", + "opsecNote": "Queries Blue Coat's cloud-based URL reputation database without directly probing targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Zscaler Zulu URL Risk Analyzer", "type": "url", - "url": "https://zulu.zscaler.com/" + "url": "https://zulu.zscaler.com/", + "description": "Free dynamic risk scoring engine for web content analysis. Assesses URLs from multiple perspectives: content analysis, URL patterns, and host reputation using machine learning.", + "status": "live", + "pricing": "free", + "bestFor": "URL risk scoring, web threat detection, malicious content analysis", + "input": "Website URL", + "output": "Risk score, threat assessment at content/URL/host levels, malicious behavior detection", + "opsec": "active", + "opsecNote": "Uses sandboxing to execute URLs in an isolated environment; may detect analysis activity.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe Sandbox Url Analyzer", "type": "url", - "url": "https://www.url-analyzer.net/" + "url": "https://www.url-analyzer.net/", + "description": "Deep URL and document analysis using real browser execution in isolated environments. Detects malware, phishing, and suspicious behavior with detailed system/network monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware/phishing analysis, URL behavior detection, deep web threat investigation", + "input": "URL or document file", + "output": "Detailed behavior analysis, DOM tree, browser data, network capture, threat assessment", + "opsec": "active", + "opsecNote": "Executes URLs in real browsers; detectable by advanced anti-analysis techniques.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Deepviz Domain Search", "type": "url", - "url": "https://search.deepviz.com/" + "url": "https://search.deepviz.com/", + "description": "Threat intelligence platform providing domain, IP, and malware sample search with daily threat feeds. Includes similar sample finding, malware family clustering, and API/Splunk integration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware analysis, threat feed subscription", + "input": "Domain, IP, file hash (MD5), or malware sample", + "output": "Threat intelligence data, malware associations, related IOCs, daily threat feeds", + "opsec": "passive", + "opsecNote": "Queries threat intelligence databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "AVG Threat Labs", "type": "url", - "url": "https://www.avg.com/en/signal/website-safety" + "url": "https://www.avg.com/en/signal/website-safety", + "description": "Website security analysis tool providing instant safety assessment of sites. Merges quantitative threat detection from 100M AVG users with LinkScanner technology in graphical reports.", + "status": "degraded", + "pricing": "free", + "bestFor": "Website safety assessment, threat detection reports, website popularity tracking", + "input": "Website URL", + "output": "Safety analysis, threat report, popularity status, server location, detection timeline", + "opsec": "passive", + "opsecNote": "Queries AVG's threat detection database; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Webroot BrightCloud URL/IP Lookup", "type": "url", - "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" + "url": "https://www.brightcloud.com/tools/url-ip-lookup.php", + "description": "Web classification and reputation tool providing URL/IP threat and content analysis. Uses machine learning reputation scoring across 82 content categories with IP risk tiering.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation lookup, web classification, threat intelligence, web categorization", + "input": "URL or IP address", + "output": "Threat assessment, content category, reputation score, WHOIS data, risk level", + "opsec": "passive", + "opsecNote": "Queries BrightCloud's reputation database without directly contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "vURL Online", "type": "url", - "url": "https://vurldissect.co.uk/" + "url": "https://vurldissect.co.uk/", + "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.", + "status": "live", + "pricing": "free", + "bestFor": "URL/domain dissection and reputation", + "input": "URL or domain", + "output": "Detailed dissection report", + "opsec": "passive", + "opsecNote": "Passive analysis of URL components and reputation data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AlienVault Open Threat Exchange", "type": "url", - "url": "https://otx.alienvault.com/browse/pulses/" + "url": "https://otx.alienvault.com/browse/pulses/", + "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence sharing", + "input": "Domain, IP, URL, file hash", + "output": "Threat pulses, reputation data, indicators", + "opsec": "passive", + "opsecNote": "Community-sourced intelligence; free API access with registration", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Domain List", "type": "url", - "url": "https://www.malwaredomainlist.com/mdl.php" + "url": "https://www.malwaredomainlist.com/mdl.php", + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Web Inspector Online Scan", "type": "url", - "url": "https://www.webinspector.com/website-malware-scanner/" + "url": "https://www.webinspector.com/website-malware-scanner/", + "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning", + "input": "Website URL", + "output": "Malware scan report, vulnerability assessment", + "opsec": "active", + "opsecNote": "Active scanning required; connects to target website to analyze content", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Safe Browsing API", "type": "url", - "url": "https://developers.google.com/safe-browsing/?csw=1" + "url": "https://developers.google.com/safe-browsing/?csw=1", + "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and phishing URL detection", + "input": "URL or domain", + "output": "Safe/unsafe classification, threat type", + "opsec": "passive", + "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cisco Talos", "type": "url", - "url": "https://talosintelligence.com/" + "url": "https://talosintelligence.com/", + "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation intelligence", + "input": "IP address or domain", + "output": "Reputation score, threat indicators, intelligence reports", + "opsec": "passive", + "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1088,67 +2633,262 @@ { "name": "Threatexpert.com Malicious URLs", "type": "url", - "url": "https://www.networksec.org/grabbho/block.txt" + "url": "https://www.networksec.org/grabbho/block.txt", + "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.", + "status": "down", + "pricing": "free", + "bestFor": "Malware URL intelligence", + "input": "Domain or URL", + "output": "Blocklist/Feed format", + "opsec": "passive", + "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Zeus C2 Tracker", "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" + "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist", + "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet C2 blocking", + "input": "None (blocklist provider)", + "output": "Domain/IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Queries public Zeus tracker database; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Domains Blacklist", "type": "url", - "url": "https://mirror1.malwaredomains.com/files/domains.txt" + "url": "https://mirror1.malwaredomains.com/files/domains.txt", + "description": "Historical malware domains blocklist providing hosts file format malicious domain list.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Hosts file format", + "opsec": "passive", + "opsecNote": "Legacy service; no longer maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Blackweb", "type": "url", - "url": "https://github.com/maravento/blackweb" + "url": "https://github.com/maravento/blackweb", + "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.", + "status": "live", + "pricing": "free", + "bestFor": "Squid proxy malware filtering", + "input": "None (aggregated blocklist)", + "output": "Squid-compatible blocklist format", + "opsec": "passive", + "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Critical Stack Intel (R)", "type": "url", - "url": "https://intel.criticalstack.com/" + "url": "https://intel.criticalstack.com/", + "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.", + "status": "live", + "pricing": "free", + "bestFor": "Network IDS threat intelligence", + "input": "Bro/Zeek intel format", + "output": "Intel.log entries, network alerts", + "opsec": "passive", + "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Sinkhole", "type": "url", - "url": "https://malc0de.com/bl/" + "url": "https://malc0de.com/bl/", + "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.", + "status": "degraded", + "pricing": "free", + "bestFor": "DNS-based malware blocking", + "input": "DNS zone file", + "output": "Malware domain sinkhole list", + "opsec": "passive", + "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS-BH Malware Domain Blocklist", "type": "url", - "url": "https://www.malwaredomains.com/wordpress/?page_id=66" + "url": "https://www.malwaredomains.com/wordpress/?page_id=66", + "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)", + "opsec": "passive", + "opsecNote": "Service sunset; merged into ShadowNet", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Malware Domain List", "type": "url", - "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" + "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt", + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MalwareURL (R)", "type": "url", - "url": "https://www.malwareurl.com/index.php" + "url": "https://www.malwareurl.com/index.php", + "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware URL reputation checking", + "input": "URL", + "output": "Reputation report, blocklist data", + "opsec": "passive", + "opsecNote": "Free lookup service available; commercial network integration available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "scumware.org", "type": "url", - "url": "https://www.scumware.org/" + "url": "https://www.scumware.org/", + "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and spyware domain research", + "input": "Domain or URL", + "output": "Domain reputation/blocklist data", + "opsec": "passive", + "opsecNote": "Community-maintained research database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ZeuS Tracker", "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php" + "url": "https://zeustracker.abuse.ch/blocklist.php", + "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet tracking and blocking", + "input": "None (blocklist provider)", + "output": "Domain blocklist, IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Shadowserver Foundation", "type": "url", - "url": "https://www.shadowserver.org/" + "url": "https://www.shadowserver.org/", + "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation and abuse intelligence", + "input": "IP address or domain", + "output": "Reputation reports, blocklists, abuse intelligence", + "opsec": "passive", + "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Domain Validation", "type": "url", - "url": "https://www.mailboxvalidator.com/domain" + "url": "https://www.mailboxvalidator.com/domain", + "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email domain and mailbox verification", + "input": "Email domain or address", + "output": "Domain validation report, MX records", + "opsec": "active", + "opsecNote": "Active mail server connectivity checks required for validation", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1159,22 +2899,82 @@ { "name": "DNS Twist (T)", "type": "url", - "url": "https://github.com/elceef/dnstwist" + "url": "https://github.com/elceef/dnstwist", + "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting and phishing domain detection", + "input": "Domain name", + "output": "Domain permutation list, DNS records, HTTP similarity", + "opsec": "active", + "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URLCrazy (T)", "type": "url", - "url": "https://www.morningstarsecurity.com/research/urlcrazy" + "url": "https://www.morningstarsecurity.com/research/urlcrazy", + "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting domain discovery", + "input": "Domain name", + "output": "Domain variant list, registration status", + "opsec": "active", + "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dnstwister", "type": "url", - "url": "https://dnstwister.report/" + "url": "https://dnstwister.report/", + "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Typosquatting monitoring", + "input": "Domain name", + "output": "Domain variants, registration status, DNS records", + "opsec": "active", + "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Catphish (T)", "type": "url", - "url": "https://github.com/ring0lab/catphish" + "url": "https://github.com/ring0lab/catphish", + "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Red team phishing domain generation", + "input": "Target domain", + "output": "Phishing domain variants, categorization status", + "opsec": "active", + "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1186,14 +2986,74 @@ "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Public website analysis; passive technical reconnaissance", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SiteSleuth", + "type": "url", + "url": "https://www.sitesleuth.io/", + "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking code intelligence and related domain discovery", + "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key", + "output": "List of associated domains and tracking codes", + "opsec": "passive", + "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Wappalyzer (T)", + "type": "url", + "url": "https://www.wappalyzer.com/", + "description": "Technology stack profiler that identifies CMS, frameworks, analytics, and infrastructure used by a website.", + "status": "live", + "pricing": "freemium", + "bestFor": "Technology stack fingerprinting and recon", + "input": "Domain or URL", + "output": "Detected technologies, categories, versions, and metadata", + "opsec": "active", + "opsecNote": "Performs direct analysis of target pages when scanning live URLs.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SEMrush", + "type": "url", + "url": "https://www.semrush.com/", + "description": "SEO intelligence platform for domain analytics, keyword intelligence, backlinks, and competitor profiling.", + "status": "live", + "pricing": "paid", + "bestFor": "Traffic and backlink competitive analysis", + "input": "Domain", + "output": "Keywords, backlinks, ranking trends, and traffic estimates", + "opsec": "passive", + "opsecNote": "Uses provider-side indexed datasets and does not require direct probing by the user.", "localInstall": false, "googleDork": false, "registration": true, @@ -1202,100 +3062,325 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "SiteSleuth", - "type": "url", - "url": "https://www.sitesleuth.io/" - }, - { - "name": "Wappalyzer (T)", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, - { - "name": "SEMrush", - "type": "url", - "url": "https://www.semrush.com/" - }, { "name": "Moonsearch", "type": "url", - "url": "https://moonsearch.com/" + "url": "https://moonsearch.com/", + "description": "Legacy reverse-WHOIS style domain correlation service with unclear current availability.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical domain ownership correlation", + "input": "Domain or registrant details", + "output": "Potentially related domains and ownership links", + "opsec": "unknown", + "opsecNote": "Service availability is inconsistent; treat results as unverified and re-check before use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Ewhois", "type": "url", - "url": "https://ewhois.com/" + "url": "https://www.ewhois.com/", + "description": "Web WHOIS lookup utility for registration, registrar, and nameserver details.", + "status": "live", + "pricing": "free", + "bestFor": "Quick WHOIS lookups", + "input": "Domain", + "output": "Registrant, registrar, dates, and nameserver records", + "opsec": "passive", + "opsecNote": "Performs standard registration lookups with low operational risk.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "StatsCrop", "type": "url", - "url": "https://www.statscrop.com/" + "url": "https://www.statscrop.com/", + "description": "Website statistics portal with traffic rank snapshots and related metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Quick website popularity snapshots", + "input": "Domain", + "output": "Traffic rank estimates and summary site stats", + "opsec": "passive", + "opsecNote": "Reads provider-side metrics without direct target interaction by the user.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Open Site Explorer", "type": "url", - "url": "https://moz.com/link-explorer" + "url": "https://moz.com/link-explorer", + "description": "Legacy Moz Open Site Explorer entry now represented by Moz Link Explorer for backlink analysis.", + "status": "degraded", + "pricing": "freemium", + "bestFor": "Backlink and linking-domain analysis", + "input": "Domain or URL", + "output": "Backlinks, authority-style metrics, and linking domains", + "opsec": "passive", + "opsecNote": "Modern functionality persists under Moz Link Explorer; legacy naming retained for framework continuity.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": true }, { "name": "SpyOnWeb", "type": "url", - "url": "https://www.spyonweb.com/" + "url": "https://www.spyonweb.com/", + "description": "Correlation tool that links domains by shared tracking and advertising identifiers.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding related infrastructure via shared IDs", + "input": "Domain or analytics/ad IDs", + "output": "Related domains and shared identifier pivots", + "opsec": "passive", + "opsecNote": "Uses indexed identifier data and does not require active probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Keyword Density", "type": "url", - "url": "https://tools.seobook.com/general/keyword-density/" + "url": "https://tools.seobook.com/general/keyword-density/", + "description": "Text and page analyzer that measures keyword frequency and relative density.", + "status": "live", + "pricing": "free", + "bestFor": "On-page keyword frequency analysis", + "input": "URL or text", + "output": "Keyword counts and density metrics", + "opsec": "active", + "opsecNote": "May fetch target content directly for analysis when URL input is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Alexa Site Statistics", "type": "url", - "url": "https://alexa.amazon.com/about" + "url": "https://alexa.amazon.com/about", + "description": "Historical Alexa Internet traffic-statistics entry; service was discontinued in 2022.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Domain", + "output": "Legacy traffic ranking context (archival)", + "opsec": "unknown", + "opsecNote": "Alexa Internet shut down on May 1, 2022; keep as deprecated reference only.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Cisco Umbrella Popularity List", "type": "url", - "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" + "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html", + "description": "Domain popularity ranking based on Cisco Umbrella DNS telemetry.", + "status": "live", + "pricing": "free", + "bestFor": "Top-domain popularity and DNS trend context", + "input": "Domain or list lookup", + "output": "Popularity ranking and related DNS-derived context", + "opsec": "passive", + "opsecNote": "Consumes published ranking data with low direct exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Alexa Top 500 Global Sites", "type": "url", - "url": "https://alexa.amazon.com/about" + "url": "https://alexa.amazon.com/about", + "description": "Historical Alexa Top Sites list reference; no longer maintained after Alexa shutdown.", + "status": "down", + "pricing": "free", + "bestFor": "Historical popularity-list reference", + "input": "N/A", + "output": "Legacy ranking context only", + "opsec": "unknown", + "opsecNote": "Alexa Internet ended on May 1, 2022; this entry is retained only as deprecated legacy context.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Sitedossier", "type": "url", - "url": "https://www.sitedossier.com/" + "url": "https://www.sitedossier.com/", + "description": "Domain dossier aggregator with WHOIS, DNS, and linked infrastructure context.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain intelligence aggregation", + "input": "Domain or IP", + "output": "WHOIS, DNS, and related-site context", + "opsec": "passive", + "opsecNote": "Aggregates public records and indexed data with limited operator exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Visual Site Mapper", "type": "url", - "url": "https://github.com/alentum/sitemapper-nodejs" + "url": "https://github.com/alentum/sitemapper-nodejs", + "description": "Site-crawling mapper used to visualize website structure and page relationships.", + "status": "live", + "pricing": "free", + "bestFor": "Generating website structure maps", + "input": "Domain or URL seed", + "output": "Crawl graph and site map structure", + "opsec": "active", + "opsecNote": "Actively crawls target pages and generates repeated requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ClearWebStats.com", "type": "url", - "url": "https://www.clearwebstats.com/" + "url": "https://www.clearwebstats.com/", + "description": "Public site-statistics index showing traffic and rank snapshots for domains.", + "status": "live", + "pricing": "free", + "bestFor": "Lightweight web popularity lookups", + "input": "Domain", + "output": "Estimated rank and summary traffic metrics", + "opsec": "passive", + "opsecNote": "Uses provider-collected analytics rather than direct target scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PubDB", "type": "url", - "url": "https://pub-db.com/" + "url": "https://pub-db.com/", + "description": "Legacy public-database lookup entry with expired or unavailable service state.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Query terms", + "output": "Unavailable/legacy output", + "opsec": "unknown", + "opsecNote": "Service appears expired or defunct; verify alternatives before operational use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "SimilarWeb", "type": "url", - "url": "https://www.similarweb.com/" + "url": "https://www.similarweb.com/", + "description": "Digital intelligence platform for traffic estimates, referrals, and audience insights.", + "status": "live", + "pricing": "freemium", + "bestFor": "Competitor traffic and referral analysis", + "input": "Domain", + "output": "Traffic channels, engagement, and competitor benchmarking", + "opsec": "passive", + "opsecNote": "Relies on provider-side datasets and panels; no active probing required by user.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Siteliner", "type": "url", - "url": "https://www.siteliner.com/" + "url": "https://www.siteliner.com/", + "description": "Website crawler that highlights duplicate content, broken links, and SEO quality issues.", + "status": "live", + "pricing": "freemium", + "bestFor": "Duplicate-content and link-health audits", + "input": "Domain", + "output": "Duplicate-content metrics, broken links, and crawl summaries", + "opsec": "active", + "opsecNote": "Performs active crawl requests against the target site.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WhatWeb", "type": "url", - "url": "https://github.com/urbanadventurer/WhatWeb" + "url": "https://github.com/urbanadventurer/WhatWeb", + "description": "Open-source fingerprinting scanner for identifying technologies, frameworks, and server-side indicators.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-based web technology fingerprinting", + "input": "Domain or URL", + "output": "Detected technologies, headers, and fingerprint matches", + "opsec": "active", + "opsecNote": "Directly scans target endpoints and can be noisy depending on scan options.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1306,27 +3391,102 @@ { "name": "Link Expander", "type": "url", - "url": "https://www.linkexpander.com/" + "url": "https://www.linkexpander.com/", + "description": "Short-link expansion tool that resolves redirects to destination URLs.", + "status": "live", + "pricing": "free", + "bestFor": "Expanding shortened links safely", + "input": "Shortened URL", + "output": "Resolved destination URL and redirect behavior", + "opsec": "passive", + "opsecNote": "Uses preview/expansion workflows and avoids direct navigation in the browser.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CheckShortURL", "type": "url", - "url": "https://checkshorturl.com/" + "url": "https://checkshorturl.com/", + "description": "Preview service for shortened URLs with destination and threat-check context.", + "status": "live", + "pricing": "free", + "bestFor": "Safe short-link destination checks", + "input": "Shortened URL", + "output": "Expanded destination and warning context", + "opsec": "passive", + "opsecNote": "Passively expands links before user navigation.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Expander", "type": "url", - "url": "https://urlex.org/" + "url": "https://urlex.org/", + "description": "Link resolver for unshortening and inspecting redirect destination chains.", + "status": "live", + "pricing": "free", + "bestFor": "Resolving opaque short links", + "input": "Shortened URL", + "output": "Expanded URL and redirect details", + "opsec": "passive", + "opsecNote": "Primarily destination resolution with low direct operational exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Where Does This Link Go?", "type": "url", - "url": "https://wheregoes.com/" + "url": "https://wheregoes.com/", + "description": "Redirect-chain inspector that traces and visualizes final destination paths.", + "status": "live", + "pricing": "free", + "bestFor": "Tracing redirect chains for suspicious links", + "input": "URL", + "output": "Redirect hops, response codes, and final destination", + "opsec": "passive", + "opsecNote": "Provides passive redirect tracing before manual browser interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "KnowURL", "type": "url", - "url": "https://www.knowurl.com/" + "url": "https://www.knowurl.com/", + "description": "Legacy URL intelligence entry with uncertain availability and reliability.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "URL", + "output": "Unreliable or unavailable metadata", + "opsec": "unknown", + "opsecNote": "Current service status is unclear; verify manually before relying on output.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -1337,37 +3497,142 @@ { "name": "VisualPing", "type": "url", - "url": "https://visualping.io:443/" + "url": "https://visualping.io/", + "description": "Website monitoring platform that alerts on page content or visual changes.", + "status": "live", + "pricing": "freemium", + "bestFor": "Automated webpage change monitoring", + "input": "URL and watch settings", + "output": "Change alerts with visual or text diffs", + "opsec": "active", + "opsecNote": "Performs recurring fetches of target pages based on monitoring cadence.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Change Detection", "type": "url", - "url": "https://visualping.io/" + "url": "https://changedetection.io/", + "description": "Open-source change-monitoring system for tracking updates on websites over time.", + "status": "live", + "pricing": "free", + "bestFor": "Self-hosted page change monitoring", + "input": "URL and monitoring rules", + "output": "Diffs and notifications when monitored content changes", + "opsec": "active", + "opsecNote": "Generates recurring requests to monitored targets; tune intervals for OPSEC.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { - "name": "Check site availability Online", + "name": "UPcheck", "type": "url", - "url": "https://upcheck.online/" + "url": "https://upcheck.online/", + "description": "Website uptime checker that tests if a site is currently accessible.", + "status": "down", + "pricing": "free", + "bestFor": "Quick site availability checks", + "input": "URL/domain", + "output": "Up/down status", + "opsec": "passive", + "opsecNote": "No identification risk; passive status check only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Follow That Page", "type": "url", - "url": "https://www.followthatpage.com/" + "url": "https://www.followthatpage.com/", + "description": "Website monitoring service that checks pages for changes and sends alerts when tracked content updates. Supports keyword-based notifications for focused monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Tracking updates on specific web pages by keyword", + "input": "Target page URL and optional keyword filters", + "output": "Email alerts showing detected page changes", + "opsec": "passive", + "opsecNote": "Monitoring requests are performed by Follow That Page infrastructure rather than directly from the investigator's workstation.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Urlwatch", "type": "url", - "url": "https://github.com/thp/urlwatch" + "url": "https://github.com/thp/urlwatch", + "description": "Open-source Python CLI tool for monitoring webpages and feeds for changes. Supports multiple filters, reporters, and scheduled checks via local automation.", + "status": "live", + "pricing": "free", + "bestFor": "Self-hosted web page change monitoring automation", + "input": "URLs, feeds, and local watch configuration", + "output": "Diffs and alerts through email, console, or integrations", + "opsec": "passive", + "opsecNote": "Can run locally or on controlled infrastructure, allowing investigators to manage request origin and monitoring cadence.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchThatPage", "type": "url", - "url": "https://watchthatpage.com/" + "url": "https://watchthatpage.com/", + "description": "Web-based page monitoring platform that detects content changes and notifies users by email. Useful for tracking updates on websites without RSS feeds.", + "status": "live", + "pricing": "freemium", + "bestFor": "Monitoring static web pages for updates over time", + "input": "Web page URL and watch configuration", + "output": "Email notifications and change history snapshots", + "opsec": "passive", + "opsecNote": "Page checks originate from WatchThatPage systems instead of directly from the investigator.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ChangeDetect", "type": "url", - "url": "https://www.eatgrainmaker.com/home/" + "url": "https://changedetection.io/", + "description": "Open-source website change detection platform with both self-hosted and hosted options. Supports visual diffs, notifications, and automation workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Flexible page change monitoring with self-hosted control", + "input": "Target URL and optional monitoring rules/selectors", + "output": "Change alerts, snapshots, and webhook/integration notifications", + "opsec": "passive", + "opsecNote": "When self-hosted, investigators control infrastructure and request origin; hosted mode proxies checks through provider systems.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1379,18 +3644,18 @@ "name": "Google Trends", "type": "url", "url": "https://trends.google.com/trends/", - "description": "Google's free tool for analyzing search interest trends over time and by geography, providing anonymized and aggregated data.", + "description": "Google's search trend analysis tool for tracking keyword popularity and comparing search interest over time.", "status": "live", "pricing": "free", - "bestFor": "Tracking topic interest, comparing search terms, identifying trend patterns", - "input": "Search term or topic", - "output": "Trend graphs, regional interest data, related queries", + "bestFor": "Search trend analysis and keyword research", + "input": "Keywords or domains", + "output": "Trend data and comparative interest graphs", "opsec": "passive", - "opsecNote": "Queries Google's anonymized aggregated data; no personal data exposure and no direct target contact.", + "opsecNote": "Google-tracked; your queries may be associated with your account or IP", "localInstall": false, "googleDork": false, "registration": false, - "editUrl": true, + "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false @@ -1404,12 +3669,42 @@ { "name": "DNSSEC Analyzer", "type": "url", - "url": "https://dnssec-analyzer.verisignlabs.com/" + "url": "https://dnssec-analyzer.verisignlabs.com/", + "description": "Verisign's DNSSEC validation tool that checks the DNSSEC chain of trust for a domain.", + "status": "live", + "pricing": "free", + "bestFor": "DNSSEC chain-of-trust validation", + "input": "Domain names", + "output": "DNSSEC validation status and chain details", + "opsec": "passive", + "opsecNote": "No identification risk; passive DNS lookup", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNSViz", "type": "url", - "url": "https://dnsviz.net/" + "url": "https://dnsviz.net/", + "description": "DNS and DNSSEC analysis platform that visualizes delegation chains and cryptographic validation paths. Helps diagnose trust and signing issues in domain configurations.", + "status": "live", + "pricing": "free", + "bestFor": "Visual DNSSEC validation and DNS misconfiguration analysis", + "input": "Domain name", + "output": "DNS resolution graphs, DNSSEC status, and validation diagnostics", + "opsec": "passive", + "opsecNote": "Analysis runs against public DNS infrastructure without direct interaction with domain owners.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1424,17 +3719,62 @@ { "name": "Sn1per (T)", "type": "url", - "url": "https://github.com/1N3/Sn1per" + "url": "https://github.com/1N3/Sn1per", + "description": "Automated reconnaissance and penetration testing framework combining multiple scanning tools for full-scope target enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Full-scope pentest automation and recon", + "input": "Target domains or IPs", + "output": "Recon data, open ports, vulnerabilities, and footprinting results", + "opsec": "active", + "opsecNote": "Generates significant network traffic and alerts; high IDS/WAF detection risk", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { - "name": "WDES - Web Data Exposure Scanner (T)", + "name": "Web Data Exposure Scanner (T)", "type": "url", - "url": "https://github.com/eduardoit/web-data-exposure-scanner" + "url": "https://github.com/eduardoit/web-data-exposure-scanner", + "description": "Open-source scanner for detecting exposed web application data and sensitive file disclosures on web servers.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting exposed sensitive data on web servers", + "input": "URLs/domains", + "output": "Exposed data findings", + "opsec": "active", + "opsecNote": "Active scanning may generate server logs and trigger alerts", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1445,14 +3785,44 @@ { "name": "Zone-H.org", "type": "url", - "url": "https://zone-h.org/archive" + "url": "https://zone-h.org/archive", + "description": "Archive of reported website defacements and related incident metadata maintained by the Zone-H community.", + "status": "live", + "pricing": "free", + "bestFor": "Historical tracking of website defacement incidents", + "input": "Search terms, domains, or browsing archive filters", + "output": "Defacement records with timestamps and mirrored evidence", + "opsec": "passive", + "opsecNote": "Uses a third-party archive and does not require direct interaction with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "RobotsDisallowed", "type": "url", - "url": "https://github.com/danielmiessler/RobotsDisallowed" + "url": "https://github.com/danielmiessler/RobotsDisallowed", + "description": "Curated wordlist of top disallowed paths harvested from robots.txt files across high-traffic websites.", + "status": "live", + "pricing": "free", + "bestFor": "robots.txt enumeration and directory discovery", + "input": "Used as wordlist input for directory brute-forcing", + "output": "Directory path wordlist", + "opsec": "passive", + "opsecNote": "Passive wordlist only; no requests made to target during list use", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1463,32 +3833,122 @@ { "name": "Belati (T)", "type": "url", - "url": "https://github.com/aancw/Belati" + "url": "https://github.com/aancw/Belati", + "description": "Open-source OSINT data collection and automation framework for gathering information from multiple sources.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-source OSINT collection automation", + "input": "Domains and targets", + "output": "Aggregated OSINT data", + "opsec": "passive", + "opsecNote": "Primarily passive; behavior depends on configured modules", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Burp Suite (T)", "type": "url", - "url": "https://portswigger.net/burp" + "url": "https://portswigger.net/burp", + "description": "Industry-standard web application security testing platform for manual and automated vulnerability assessment.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web application penetration testing", + "input": "Web applications and URLs", + "output": "Security findings, intercepted traffic, and vulnerability reports", + "opsec": "active", + "opsecNote": "Full active scanning; generates extensive server logs and may trigger WAF/IDS alerts", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "EyeWitness (T)", "type": "url", - "url": "https://github.com/ChrisTruncer/EyeWitness" + "url": "https://github.com/ChrisTruncer/EyeWitness", + "description": "Open-source tool for automated website screenshotting, service header collection, and default credential identification.", + "status": "live", + "pricing": "free", + "bestFor": "Visual site enumeration and credential identification", + "input": "URL lists", + "output": "Screenshots, headers, and default credential matches", + "opsec": "passive", + "opsecNote": "HTTP requests visible in target server logs; screenshots leave network footprint", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunting-New-Registered-Domains (T)", "type": "url", - "url": "https://github.com/gfek/Hunting-New-Registered-Domains" + "url": "https://github.com/gfek/Hunting-New-Registered-Domains", + "description": "Open-source tool for identifying newly registered domains matching patterns, useful for phishing and brand threat detection.", + "status": "live", + "pricing": "free", + "bestFor": "Phishing domain detection and brand threat monitoring", + "input": "Domain patterns or keywords", + "output": "List of newly registered matching domains", + "opsec": "passive", + "opsecNote": "WHOIS queries may create observable patterns; otherwise passive", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "International Domain Name Conversion Tool", "type": "url", - "url": "https://mct.verisign-grs.com/" + "url": "https://mct.verisign-grs.com/", + "description": "Verisign's IDN/Punycode bidirectional converter for translating international domain names to and from ASCII-compatible encoding.", + "status": "live", + "pricing": "free", + "bestFor": "IDN and Punycode domain analysis", + "input": "International or Punycode domain names", + "output": "Converted domain equivalents", + "opsec": "passive", + "opsecNote": "No identification risk; local conversion tool", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1497,14 +3957,44 @@ "type": "folder", "children": [ { - "name": "Microsoft", + "name": "Windows Defender Security Intelligence (WDSI)", "type": "url", - "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" + "url": "https://www.microsoft.com/en-us/wdsi", + "description": "Microsoft's security intelligence portal for reporting malicious URLs and checking Windows Defender threat assessments.", + "status": "live", + "pricing": "free", + "bestFor": "Reporting malicious sites to Microsoft and checking URL threat status", + "input": "URLs", + "output": "Threat status and submission confirmation", + "opsec": "passive", + "opsecNote": "Microsoft-tracked; submissions aggregated for threat intelligence", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { - "name": "Google", + "name": "Google Safe Browsing", "type": "url", - "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" + "url": "https://safebrowsing.google.com/", + "description": "Google's phishing and malware reporting portal for submitting suspicious URLs for review.", + "status": "live", + "pricing": "free", + "bestFor": "Reporting malicious sites to Google and checking URL safety status", + "input": "URLs", + "output": "Safety status and submission confirmation", + "opsec": "passive", + "opsecNote": "Google-tracked; searches and submissions aggregated at scale", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -1702,42 +4192,162 @@ { "name": "MaxMind Demo", "type": "url", - "url": "https://www.maxmind.com/en/home" + "url": "https://www.maxmind.com/en/home", + "description": "Web-based IP geolocation demo with location, ASN, and network data from MaxMind's GeoIP database.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP geolocation", + "input": "IP address", + "output": "Country, region, city, coordinates, ASN", + "opsec": "passive", + "opsecNote": "Queries MaxMind; submissions logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4/IPv6 lists by country code", "type": "url", - "url": "https://github.com/ipverse/" + "url": "https://github.com/ipverse/", + "description": "Database of IPv4 and IPv6 address ranges organized by country for geographic IP filtering.", + "status": "live", + "pricing": "free", + "bestFor": "Country-level IP enumeration", + "input": "Country code", + "output": "IP ranges in CIDR notation", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP allocations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2Location.com", "type": "url", - "url": "https://www.ip2location.com/demo" + "url": "https://www.ip2location.com/demo", + "description": "Commercial IP geolocation service with free demo and database. Provides location, proxy detection, and network data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate geolocation with proxy detection", + "input": "IP address", + "output": "Location, ASN, proxy type, VPN status, timezone", + "opsec": "passive", + "opsecNote": "Passive database lookup; free tier limited.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Fingerprints", "type": "url", - "url": "https://ipfingerprints.com/" + "url": "https://ipfingerprints.com/", + "description": "Reverse IP lookup service identifying all domains hosted on a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Uses public DNS reverse lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DB-IP", "type": "url", - "url": "https://db-ip.com/" + "url": "https://db-ip.com/", + "description": "Lightweight IP geolocation API covering 46M+ IPv4/IPv6 blocks with city-level accuracy.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate IP geolocation with developer API", + "input": "IP address", + "output": "Location, timezone, ISP, coordinates", + "opsec": "passive", + "opsecNote": "Passive database lookup; free API rate limited.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Location Finder", "type": "url", - "url": "https://www.iplocation.net/" + "url": "https://www.iplocation.net/", + "description": "Web-based tool for IP geolocation with maps and detailed location information.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP location with maps", + "input": "IP address", + "output": "City, coordinates, ISP, hostname", + "opsec": "passive", + "opsecNote": "Passive lookup; no notification to target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Info Sniper", "type": "url", - "url": "https://www.infosniper.net/" + "url": "https://www.infosniper.net/", + "description": "Multi-field reverse OSINT tool for IP, email, phone lookups with social media enumeration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-field reverse lookup (IP/email/phone)", + "input": "IP, email, or phone", + "output": "Associated accounts and social profiles", + "opsec": "passive", + "opsecNote": "Correlates public data; paid features available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "utrace", "type": "url", - "url": "https://en.utrace.de/" + "url": "https://en.utrace.de/", + "description": "IP geolocation and reverse DNS lookup tool with network traceroute visualization.", + "status": "live", + "pricing": "free", + "bestFor": "IP location and traceroute", + "input": "IP or hostname", + "output": "Location, ASN, reverse DNS, route path", + "opsec": "active", + "opsecNote": "Traceroute is active; geolocation is passive.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1748,67 +4358,262 @@ { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "Website scanner analyzing URLs and domains for malicious content with infrastructure intelligence.", + "status": "live", + "pricing": "freemium", + "bestFor": "URL/domain scanning for malware and phishing", + "input": "URL or domain", + "output": "Screenshot, DNS, IP, certificates, cookies", + "opsec": "passive", + "opsecNote": "Passive scanning; no direct contact with target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/ip" + "url": "https://spyse.com/search/ip", + "description": "Internet assets search engine collecting and analyzing public data for attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and reconnaissance", + "input": "IP, domain, email, organization", + "output": "Subdomains, services, vulnerabilities, data breaches", + "opsec": "passive", + "opsecNote": "Passive data collection; requires account for full access.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Shodan", "type": "url", - "url": "https://www.shodan.io/" + "url": "https://www.shodan.io/", + "description": "Search engine for internet-connected devices, providing visibility into exposed services and vulnerabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Find exposed IoT and network services", + "input": "IP, port, service type", + "output": "Service banners, open ports, vulnerabilities, location", + "opsec": "passive", + "opsecNote": "Passive data collection; InternetDB API free for non-commercial use.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://netlas.io/" + "url": "https://netlas.io/", + "description": "Comprehensive internet scanning platform with OSINT, DNS, and WHOIS data. Free tier: 50 requests/day.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset reconnaissance with web, DNS, WHOIS", + "input": "IP, domain, ASN", + "output": "Open ports, services, certificates, DNS records, WHOIS", + "opsec": "passive", + "opsecNote": "Passive scanning with account-based rate limits.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Portmap", "type": "url", - "url": "https://portmap.com/" + "url": "https://portmap.com/", + "description": "Port mapping tool that scans for open ports and services on target IP addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Port scanning and service discovery", + "input": "IP address or hostname", + "output": "Open ports, service types, versions", + "opsec": "active", + "opsecNote": "Active port scanning probes target network.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Scans.io", "type": "url", - "url": "https://scans.io/" + "url": "https://scans.io/", + "description": "Archive of internet-wide scan data including censys scans and other reconnaissance data.", + "status": "live", + "pricing": "free", + "bestFor": "Historical internet scan data access", + "input": "IP or domain", + "output": "Historical scan results, service history", + "opsec": "passive", + "opsecNote": "Passive access to historical scanning archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Nmap (T)", "type": "url", - "url": "https://nmap.org/download.html" + "url": "https://nmap.org/download.html", + "description": "Open-source network mapping and port scanning tool with OS detection and service version identification.", + "status": "live", + "pricing": "free", + "bestFor": "Network reconnaissance and port scanning", + "input": "IP range or hostname", + "output": "Open ports, OS type, service versions, MAC addresses", + "opsec": "active", + "opsecNote": "Active scanning tool; generates network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Port scanner", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Web-based port scanner checking open ports on target IP addresses without installation.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port scanning without tools", + "input": "IP address and port range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active port scanning; limited to common ports on free tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Internet Census Search", "type": "url", - "url": "https://www.exfiltrated.com/querystart.php" + "url": "https://www.exfiltrated.com/querystart.php", + "description": "Search interface for the Shodan-like internet census data and open services.", + "status": "live", + "pricing": "free", + "bestFor": "Search open services and devices", + "input": "Service type, IP range, port", + "output": "List of exposed services and IPs", + "opsec": "passive", + "opsecNote": "Passive data search of known internet census.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "IP reputation and threat intelligence platform analyzing malicious IP addresses and attacks.", + "status": "live", + "pricing": "freemium", + "bestFor": "IP reputation and malicious activity analysis", + "input": "IP address", + "output": "Threat reports, activity logs, attack types", + "opsec": "passive", + "opsecNote": "Passive threat intelligence lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Scanless (T)", "type": "url", - "url": "https://github.com/vesche/scanless" + "url": "https://github.com/vesche/scanless", + "description": "Command-line tool for port scanning without leaving traces on target using third-party services.", + "status": "live", + "pricing": "free", + "bestFor": "Stealthy port scanning via proxies", + "input": "IP and port", + "output": "Open port results", + "opsec": "passive", + "opsecNote": "Routes scans through third-party services for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BinaryEdge (R)", "type": "url", - "url": "https://www.binaryedge.io/" + "url": "https://www.binaryedge.io/", + "description": "Commercial security research platform with internet-wide scanning and module-based detection.", + "status": "live", + "pricing": "paid", + "bestFor": "Commercial internet threat intelligence", + "input": "IP, domain, query", + "output": "Services, vulnerabilities, threat modules", + "opsec": "passive", + "opsecNote": "Commercial threat intelligence requiring subscription.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Masscan (T)", "type": "url", - "url": "https://github.com/robertdavidgraham/masscan" + "url": "https://github.com/robertdavidgraham/masscan", + "description": "Ultra-fast TCP port scanner designed for scanning large IP ranges and entire networks.", + "status": "live", + "pricing": "free", + "bestFor": "Large-scale network port scanning", + "input": "IP range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active scanner; generates significant network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1819,42 +4624,162 @@ { "name": "ASlookup.com", "type": "url", - "url": "https://aslookup.com/" + "url": "https://aslookup.com/", + "description": "BGP and autonomous system lookup tool for finding IP ranges and ownership information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP and ASN lookup", + "input": "ASN or IP address", + "output": "IP ranges, organization, peering info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Port scanner Online", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Simple web-based port scanner for checking common ports on target IPs.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port availability checks", + "input": "IP and port", + "output": "Port status (open/closed)", + "opsec": "active", + "opsecNote": "Active probing; may be logged by firewalls.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Onyphe", "type": "url", - "url": "https://www.onyphe.io/" + "url": "https://www.onyphe.io/", + "description": "Cyber defense search engine with internet scanning, threat intelligence, and attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and threat intel", + "input": "IP, domain, CVE", + "output": "Services, vulnerabilities, certificates, datasources", + "opsec": "passive", + "opsecNote": "Passive intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/as2.0/" + "url": "https://www.cidr-report.org/as2.0/", + "description": "Tool for analyzing IPv4 CIDR blocks and finding contained IP addresses and subnets.", + "status": "live", + "pricing": "free", + "bestFor": "CIDR block analysis and subnet enumeration", + "input": "CIDR block", + "output": "IP ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IP allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reverse.report", "type": "url", - "url": "https://reverse.report/" + "url": "https://reverse.report/", + "description": "Comprehensive reverse lookup tool for IP to domain, email, and phone number associations.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse IP and domain lookups", + "input": "IP address or domain", + "output": "Associated domains, subdomains, history", + "opsec": "passive", + "opsecNote": "Passive lookup of DNS and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Team Cymru IP to ASN", "type": "url", - "url": "https://asn.cymru.com/" + "url": "https://asn.cymru.com/", + "description": "IP to ASN mapping tool providing autonomous system ownership and prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN mapping", + "input": "IP address", + "output": "ASN, organization, prefix", + "opsec": "passive", + "opsecNote": "Passive lookup of BGP and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP to ASN DB", "type": "url", - "url": "https://iptoasn.com/" + "url": "https://iptoasn.com/", + "description": "Database and API service for looking up which ASN owns a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN lookup with historical data", + "input": "IP address", + "output": "ASN, organization, prefix, company info", + "opsec": "passive", + "opsecNote": "Passive database lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hacker Target - Reverse DNS", "type": "url", - "url": "https://hackertarget.com/reverse-dns-lookup/" + "url": "https://hackertarget.com/reverse-dns-lookup/", + "description": "Reverse DNS lookup tool and API finding domain names associated with IP addresses.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse DNS lookup of IP addresses", + "input": "IP address or range", + "output": "Associated domains and PTR records", + "opsec": "passive", + "opsecNote": "Passive DNS lookup; includes free API tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1865,7 +4790,22 @@ { "name": "IPv6 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/v6/as2.0/" + "url": "https://www.cidr-report.org/v6/as2.0/", + "description": "CIDR block analysis tool for IPv6 address ranges and subnet enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "IPv6 CIDR block analysis", + "input": "IPv6 CIDR block", + "output": "IPv6 ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IPv6 allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1876,22 +4816,82 @@ { "name": "Hurricane Electric BGP Toolkit", "type": "url", - "url": "https://bgp.he.net/" + "url": "https://bgp.he.net/", + "description": "BGP and network routing analysis tools including AS to prefix lookup and BGP prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP analysis and routing intelligence", + "input": "ASN, IP range, or prefix", + "output": "BGP routes, peering, organization info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Malicious Content Ranking", "type": "url", - "url": "https://bgpranking.circl.lu/" + "url": "https://bgpranking.circl.lu/", + "description": "Platform ranking ASNs and BGP prefixes by malicious content and security threats.", + "status": "live", + "pricing": "free", + "bestFor": "Identify malicious ASNs and networks", + "input": "ASN or prefix", + "output": "Threat ranking, malicious activity metrics", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PeeringDB", "type": "url", - "url": "https://www.peeringdb.com/advanced_search" + "url": "https://www.peeringdb.com/advanced_search", + "description": "Database of internet exchange points, member networks, and AS relationships for network mapping.", + "status": "live", + "pricing": "free", + "bestFor": "Internet peering and AS relationship mapping", + "input": "ASN, organization, or IX", + "output": "Peering relationships, exchange points, contacts", + "opsec": "passive", + "opsecNote": "Passive lookup of public peering data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Tools", "type": "url", - "url": "https://www.bgp4.as/tools" + "url": "https://www.bgp4.as/tools", + "description": "Collection of BGP analysis and AS number lookup tools for network intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "BGP routing and AS analysis", + "input": "ASN, IP, or prefix", + "output": "Routes, prefixes, organizations", + "opsec": "passive", + "opsecNote": "Passive analysis of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1902,17 +4902,62 @@ { "name": "IP Void", "type": "url", - "url": "https://www.ipvoid.com/" + "url": "https://www.ipvoid.com/", + "description": "IP reputation and threat intelligence service analyzing blacklist status and security risks.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP reputation and blacklist status", + "input": "IP address", + "output": "Threat score, blacklist status, reports", + "opsec": "passive", + "opsecNote": "Passive reputation lookup; account needed for full data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExoneraTor", "type": "url", - "url": "https://exonerator.torproject.org/" + "url": "https://exonerator.torproject.org/", + "description": "Tool for checking if an IP address belonged to Tor at a specific date.", + "status": "live", + "pricing": "free", + "bestFor": "Verify Tor relay membership by date", + "input": "IP address and date", + "output": "Tor exit/entry node status confirmation", + "opsec": "passive", + "opsecNote": "Passive historical Tor relay lookup from public archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grey Noise", "type": "url", - "url": "https://viz.greynoise.io/" + "url": "https://viz.greynoise.io/", + "description": "Platform for analyzing internet background noise and identifying benign scanning activity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Distinguish malicious from benign internet activity", + "input": "IP address", + "output": "Classification, scanner type, threat assessment", + "opsec": "passive", + "opsecNote": "Passive threat intelligence; free tier available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1923,22 +4968,82 @@ { "name": "Blocklist.de", "type": "url", - "url": "https://www.blocklist.de/en/index.html" + "url": "https://www.blocklist.de/en/index.html", + "description": "Community-contributed blocklist of IP addresses involved in attacks and malicious activity.", + "status": "live", + "pricing": "free", + "bestFor": "Check IP blacklist status", + "input": "IP address", + "output": "Blacklist status, attack types logged", + "opsec": "passive", + "opsecNote": "Passive lookup of community blocklist.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DShield API", "type": "url", - "url": "https://isc.sans.edu/api/" + "url": "https://isc.sans.edu/api/", + "description": "API and database of security events and IPs involved in attacks monitored by SANS.", + "status": "live", + "pricing": "free", + "bestFor": "Query IPs involved in attacks", + "input": "IP address", + "output": "Attack reports, threat activity", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from SANS monitored networks.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Project Honey Pot", "type": "url", - "url": "https://www.projecthoneypot.org/list_of_ips.php" + "url": "https://www.projecthoneypot.org/list_of_ips.php", + "description": "Global honeypot network collecting spam and attack data with IP reputation service.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP for spam and attack history", + "input": "IP address", + "output": "Threat score, spam reports, attack activity", + "opsec": "passive", + "opsecNote": "Passive lookup of honeypot-collected threat data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1949,22 +5054,82 @@ { "name": "IP Fingerprints - Reverse IP Lookup", "type": "url", - "url": "https://ipfingerprints.com/reverseip.php" + "url": "https://ipfingerprints.com/reverseip.php", + "description": "Find all domains hosted on a shared IP address through reverse IP lookup.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bing IP Search (D)", "type": "url", - "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" + "url": "https://www.bing.com/search?q=ip%3A8.8.8.8", + "description": "Bing search operator for finding domains and subdomains hosted on a specific IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on IP using Bing index", + "input": "IP address", + "output": "Domains indexed by Bing on that IP", + "opsec": "passive", + "opsecNote": "Passive search using Bing's public index.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TCP/IP Utils - Domain Neighbors", "type": "url", - "url": "https://dnslytics.com/" + "url": "https://dnslytics.com/", + "description": "Find all domains on the same IP and subdomain information via reverse IP lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Identify related domains on same IP", + "input": "Domain or IP", + "output": "Neighbor domains, IP info", + "opsec": "passive", + "opsecNote": "Passive DNS and IP lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MyIPNeighbors", "type": "url", - "url": "https://www.my-ip-neighbors.com/" + "url": "https://www.my-ip-neighbors.com/", + "description": "Reverse IP lookup tool for discovering all domains and subdomains on an IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find all domains on same shared IP", + "input": "IP address", + "output": "List of domains on IP, subdomains", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1975,12 +5140,42 @@ { "name": "CloudFlare Watch", "type": "url", - "url": "https://www.crimeflare.com/" + "url": "https://www.crimeflare.com/", + "description": "Tool for identifying and analyzing websites protected by Cloudflare's CDN and security services.", + "status": "live", + "pricing": "free", + "bestFor": "Identify Cloudflare-protected sites", + "input": "Domain or IP", + "output": "Cloudflare status, origin IP (if discoverable)", + "opsec": "passive", + "opsecNote": "Passive lookup of Cloudflare configurations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CloudFail (T)", "type": "url", - "url": "https://github.com/m0rtem/CloudFail" + "url": "https://github.com/m0rtem/CloudFail", + "description": "Tool for finding origin IPs of Cloudflare-protected websites through enumeration techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Bypass Cloudflare to find origin IP", + "input": "Domain protected by Cloudflare", + "output": "Origin IP address (if discoverable)", + "opsec": "active", + "opsecNote": "Uses active enumeration and DNS history techniques.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1991,12 +5186,42 @@ { "name": "WiGLE: Wireless Network Mapping", "type": "url", - "url": "https://wigle.net/" + "url": "https://wigle.net/", + "description": "Global database of wireless networks (WiFi, Bluetooth, cellular) with mapping and signal strength data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Map wireless networks and find signal coverage", + "input": "Location, SSID, or BSSID", + "output": "Network locations, signal maps, network details", + "opsec": "passive", + "opsecNote": "Crowdsourced wireless network data; passive lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenCellid: Database of Cell Towers", "type": "url", - "url": "https://opencellid.org/" + "url": "https://opencellid.org/", + "description": "Open database of cellular tower locations and coverage for mobile network geolocation.", + "status": "live", + "pricing": "free", + "bestFor": "Find cellular tower locations and coverage", + "input": "Cell tower ID or location", + "output": "Tower coordinates, operator, coverage area", + "opsec": "passive", + "opsecNote": "Passive lookup of public cellular network data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2007,22 +5232,82 @@ { "name": "Wireshark", "type": "url", - "url": "https://www.wireshark.org/download.html" + "url": "https://www.wireshark.org/download.html", + "description": "Open-source network packet analyzer for deep packet inspection and network troubleshooting.", + "status": "live", + "pricing": "free", + "bestFor": "Network packet analysis and protocol debugging", + "input": "Network traffic capture file", + "output": "Detailed packet analysis, protocol breakdown", + "opsec": "Unknown", + "opsecNote": "Tool-dependent; passive capture or active sniffing possible.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NetworkMiner", "type": "url", - "url": "https://www.netresec.com/?page=Networkminer" + "url": "https://www.netresec.com/?page=Networkminer", + "description": "Passive network forensics tool for extracting files and data from network traffic captures.", + "status": "live", + "pricing": "free", + "bestFor": "Network forensics and file extraction from traffic", + "input": "PCAP network traffic files", + "output": "Extracted files, metadata, network sessions", + "opsec": "passive", + "opsecNote": "Passive analysis of already-captured traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Packet Total", "type": "url", - "url": "https://www.packettotal.com/" + "url": "https://www.packettotal.com/", + "description": "Online platform for uploading and analyzing network packet captures (PCAP files).", + "status": "live", + "pricing": "free", + "bestFor": "Cloud-based network forensics analysis", + "input": "PCAP files", + "output": "Traffic analysis, threat indicators, IoCs", + "opsec": "Unknown", + "opsecNote": "Passive analysis of PCAP; consider privacy of uploaded data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "checkip (T)", "type": "url", - "url": "https://github.com/jreisinger/checkip" + "url": "https://github.com/jreisinger/checkip", + "description": "Command-line utility for checking local machine IP address and network connectivity.", + "status": "live", + "pricing": "free", + "bestFor": "Display local IP and network info", + "input": "Local system (no input needed)", + "output": "Local IP, gateway, DNS servers", + "opsec": "passive", + "opsecNote": "Passive system utility; local only.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2033,17 +5318,62 @@ { "name": "Ki.tc", "type": "url", - "url": "https://ki.tc" + "url": "https://ki.tc", + "description": "IP logging service that generates trackable links for IP/browser info collection.", + "status": "live", + "pricing": "free", + "bestFor": "Generate trackable links to log visitor IPs", + "input": "Target URL or destination", + "output": "Tracker link, IP logs, browser info", + "opsec": "Unknown", + "opsecNote": "Creates tracking mechanism; detection depends on how link is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grabify", "type": "url", - "url": "https://grabify.link" + "url": "https://grabify.link", + "description": "URL shortener service that logs IP addresses and device information of link clickers.", + "status": "live", + "pricing": "free", + "bestFor": "Shorten URLs and log visitor IPs", + "input": "URL to shorten", + "output": "Short URL with IP logging", + "opsec": "Unknown", + "opsecNote": "Creates tracking link; malicious uses common.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Logger", "type": "url", - "url": "https://iplogger.com/" + "url": "https://iplogger.com/", + "description": "IP logging and URL shortening service tracking visitor IP, location, and browser data.", + "status": "live", + "pricing": "free", + "bestFor": "Track visitor IPs through shortened links", + "input": "URL to wrap", + "output": "Logging URL, visitor IP/location data", + "opsec": "Unknown", + "opsecNote": "Tracking service; ethical and legal concerns apply.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -2064,127 +5394,462 @@ { "name": "Google Images", "type": "url", - "url": "https://images.google.com/?gws_rd=ssl" + "url": "https://images.google.com/", + "description": "Google's reverse image and visual search via Lens for finding matches, source pages, and related images across the web.", + "status": "live", + "pricing": "free", + "bestFor": "Broad reverse image search and source discovery", + "input": "Image upload or image URL", + "output": "Visually similar images, matching pages, and indexed source sites", + "opsec": "passive", + "opsecNote": "Standard search query against Google; no direct interaction with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bing Images", "type": "url", - "url": "https://www.bing.com/images" + "url": "https://www.bing.com/images", + "description": "Microsoft visual search engine with reverse image lookup and crop-based matching for partial-object analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Cropped reverse-image matching and visual component analysis", + "input": "Image upload, image URL, or cropped image region", + "output": "Matching images, related pages, and object-level visual matches", + "opsec": "passive", + "opsecNote": "Performs web search queries without direct interaction with target identities.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FaceCheck Facial Recognition Search", "type": "url", - "url": "https://facecheck.id/" + "url": "https://facecheck.id/", + "description": "Facial recognition search engine that finds publicly indexed face matches across web and social sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding public social profiles by face image", + "input": "Face photo upload", + "output": "Potential face matches with source links and similarity scoring", + "opsec": "active", + "opsecNote": "Uploads target imagery to a third-party face-search service; treat as active collection.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Surfface Face & People Search Engine", "type": "url", - "url": "https://surfface.com/" + "url": "https://surfface.com/", + "description": "AI-based face and people search platform focused on open-source identity discovery and correlation.", + "status": "live", + "pricing": "freemium", + "bestFor": "Identity correlation from face imagery", + "input": "Face photo and optional identifying context", + "output": "Candidate profile matches from publicly available web sources", + "opsec": "active", + "opsecNote": "Submits facial data to vendor infrastructure for matching against indexed sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PimEyes Face Search Engine", "type": "url", - "url": "https://pimeyes.com/en" + "url": "https://pimeyes.com/en", + "description": "Commercial reverse face search engine for locating appearances of a face on publicly indexed websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "High-coverage reverse face search investigations", + "input": "Face photo upload", + "output": "Matched face thumbnails and source-page links", + "opsec": "active", + "opsecNote": "Face image is uploaded and processed by a third-party biometric search provider.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Yandex Images", "type": "url", - "url": "https://www.yandex.com/images/" + "url": "https://yandex.com/images/", + "description": "Reverse image search engine with strong matching for Eastern European and Asian web sources.", + "status": "live", + "pricing": "free", + "bestFor": "Finding non-Western image sources and modified variants", + "input": "Image upload or image URL", + "output": "Similar images, likely originals, and source webpages", + "opsec": "passive", + "opsecNote": "Standard search requests to Yandex index; no direct account interaction required.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Baidu Images", "type": "url", - "url": "https://graph.baidu.com/pcpage/index?tpl_from=pc" + "url": "https://image.baidu.com/", + "description": "Chinese reverse image search platform useful for discovering image reuse on China-centric websites.", + "status": "live", + "pricing": "free", + "bestFor": "China-specific image source discovery", + "input": "Image upload or image URL", + "output": "Visually similar images from Chinese websites and platforms", + "opsec": "passive", + "opsecNote": "Queries Baidu index only; no direct contact with target entities.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Twitter Image Search (M)", "type": "url", - "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images" + "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images", + "description": "Manual X/Twitter query template for finding tweets containing images for a target keyword or account.", + "status": "live", + "pricing": "free", + "bestFor": "Finding image-containing tweets by keyword or operator", + "input": "Edited URL query (keyword, account, and search operators)", + "output": "Tweets and accounts with matching image/media posts", + "opsec": "passive", + "opsecNote": "Searches public timeline content; no direct engagement with targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Imgur Search", "type": "url", - "url": "https://imgur.com/search" + "url": "https://imgur.com/search", + "description": "Search interface for Imgur-hosted public images, albums, and community media posts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Locating reposted images and public gallery content on Imgur", + "input": "Keyword, tag, or user/gallery query", + "output": "Public image posts, albums, and account-linked media results", + "opsec": "passive", + "opsecNote": "Uses public site search and does not directly contact targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Photobucket", "type": "url", - "url": "https://photobucket.com/" + "url": "https://photobucket.com/", + "description": "Long-running image hosting platform with public galleries and legacy web-hosted photo content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding legacy hosted images and user gallery artifacts", + "input": "Keyword, user, or gallery search", + "output": "Public image galleries and hosted photo assets", + "opsec": "passive", + "opsecNote": "Investigations remain on public gallery pages and search views.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "7Photos.net", "type": "url", - "url": "https://7photos.net/" - }, - { - "name": "Panoramio", - "type": "url", - "url": "https://www.panoramio.com/" + "url": "https://7photos.net/", + "description": "Unclear image-related web service with an active domain but limited publicly verifiable functionality.", + "status": "degraded", + "pricing": "unknown", + "bestFor": "Unknown; requires additional validation before operational use", + "input": "Presumed image upload", + "output": "Unclear due to gated/redirected workflow", + "opsec": "unknown", + "opsecNote": "Observed authentication-style redirect behavior; service behavior is not fully observable.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Current Location", "type": "url", - "url": "https://current-location.com/" - }, - { - "name": "Lakako Photo Search", - "type": "url", - "url": "https://www.lakako.com/" + "url": "https://current-location.com/", + "description": "Location-based photo discovery tool that aggregates geotagged images from public platforms on an interactive map.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering geotagged photos near a location of interest", + "input": "Map location, coordinates, or browser geolocation", + "output": "Geotagged image results with source context from supported platforms", + "opsec": "passive", + "opsecNote": "Queries publicly indexed geotagged photos; no direct interaction with uploaders.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Lenso.ai", "type": "url", - "url": "https://lenso.ai/" + "url": "https://lenso.ai/", + "description": "AI reverse image and face matching platform designed to find similar or edited visual content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Matching altered or low-quality images and face lookups", + "input": "Image or face photo upload", + "output": "Visual matches, related occurrences, and similarity-ranked results", + "opsec": "active", + "opsecNote": "Uploads target imagery to external AI service for analysis and indexing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CC Search", "type": "url", - "url": "https://ccsearch.creativecommons.org/" + "url": "https://search.creativecommons.org/", + "description": "Creative Commons search portal for discovering openly licensed and public-domain images.", + "status": "live", + "pricing": "free", + "bestFor": "Finding license-safe imagery and attribution-ready sources", + "input": "Keyword search with license/source filters", + "output": "CC/public-domain image results across partner collections", + "opsec": "passive", + "opsecNote": "Aggregated search over open repositories with no target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CamFind App", "type": "url", - "url": "https://camfindapp.com/" + "url": "https://camfindapp.com/", + "description": "Mobile visual search app that identifies objects, landmarks, and products from photos.", + "status": "live", + "pricing": "freemium", + "bestFor": "On-device object identification and quick visual lookups", + "input": "Mobile camera image", + "output": "Object labels, related images, and linked web results", + "opsec": "active", + "opsecNote": "Uploads captured images to remote processing service for recognition.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "RevEye Reverse Image Search (T)", "type": "url", - "url": "https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/keaaclcjhehbbapnphnmpiklalfhelgf?hl=en" + "url": "https://github.com/steven2358/reveye", + "description": "Open-source browser extension that launches reverse image searches across multiple engines from one menu.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-engine reverse image pivoting from a single browser action", + "input": "Right-click target image in browser", + "output": "Parallel reverse-search results in configured engines", + "opsec": "passive", + "opsecNote": "Client-side extension submits search queries to selected engines only.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SmugMug Search", "type": "url", - "url": "https://www.smugmug.com/" + "url": "https://www.smugmug.com/", + "description": "Photo hosting and portfolio platform with searchable public galleries and photographer profiles.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding public photographer portfolios and gallery artifacts", + "input": "Keyword, gallery, or photographer search", + "output": "Public albums, image sets, and profile-linked photo collections", + "opsec": "passive", + "opsecNote": "Research is limited to publicly exposed gallery content.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ImageNet", "type": "url", - "url": "https://image-net.org/" + "url": "https://image-net.org/", + "description": "Large-scale labeled image dataset used for computer vision and image classification research.", + "status": "live", + "pricing": "free", + "bestFor": "Reference classification sets and ML-oriented visual taxonomy work", + "input": "Category/synset browsing and dataset queries", + "output": "Labeled image classes, metadata, and downloadable dataset resources", + "opsec": "passive", + "opsecNote": "Academic dataset access with no direct subject engagement.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Places2", "type": "url", - "url": "https://places2.csail.mit.edu/explore.html" + "url": "http://places2.csail.mit.edu/", + "description": "MIT CSAIL scene-recognition dataset containing millions of place-labeled images for visual analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Scene classification reference and location-context model training", + "input": "Scene categories and dataset download requests", + "output": "Scene-labeled image datasets and related research resources", + "opsec": "passive", + "opsecNote": "Public academic dataset access; no direct target interaction.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Image Identification Project", "type": "url", - "url": "https://www.imageidentify.com/" + "url": "https://www.imageidentify.com/", + "description": "Online image recognition service that labels uploaded images with machine-generated tags and confidence scores.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick machine-labeling of unknown image content", + "input": "Image upload", + "output": "Predicted tags, object labels, and confidence values", + "opsec": "active", + "opsecNote": "Uploaded images are processed on third-party infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SauceNAO", "type": "url", - "url": "https://saucenao.com/" + "url": "https://saucenao.com/", + "description": "Reverse image source finder widely used to trace artwork, anime frames, and reposted media to origin sites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Tracing image origins and duplicate postings", + "input": "Image upload or image URL", + "output": "Likely source links, matching images, and similarity metrics", + "opsec": "passive", + "opsecNote": "Search workflow only; does not interact with target accounts directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Picarta", "type": "url", - "url": "https://picarta.ai/" + "url": "https://picarta.ai/", + "description": "AI geolocation tool that estimates likely photo capture locations from visual scene analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Estimating geographic origin of photos without metadata", + "input": "Image upload", + "output": "Predicted coordinates and location confidence cues", + "opsec": "active", + "opsecNote": "Image content is uploaded to a third-party AI geolocation service.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FaceSeek Face Search Engine", "type": "url", - "url": "https://faceseek.online" + "url": "https://www.faceseek.online/", + "description": "Face-matching web tool for locating visually similar faces across indexed online content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Supplemental reverse face lookup and comparison", + "input": "Face photo upload", + "output": "Potential facial matches with source references", + "opsec": "active", + "opsecNote": "Uploads biometric imagery to a hosted face-search platform.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2195,27 +5860,102 @@ { "name": "Webstigram", "type": "url", - "url": "https://websta.me/search-engine-optimization/" + "url": "https://websta.me/search-engine-optimization/", + "description": "Legacy Webstagram endpoint historically used for Instagram search workflows; currently not verifiable as a standalone active OSINT tool.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference while migrating to active Instagram tooling", + "input": "Instagram usernames or tags (legacy workflow)", + "output": "Unreliable/limited Instagram lookup results", + "opsec": "unknown", + "opsecNote": "Tool status is unclear and behavior is inconsistent; validate with alternative tools before operational use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Instagram", "type": "url", - "url": "https://www.instagram.com/" + "url": "https://www.instagram.com/", + "description": "Main Instagram platform used for public profile, hashtag, and location OSINT collection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Social profiling and image discovery", + "input": "Usernames, hashtags, locations", + "output": "Profiles, posts, location signals, and network context", + "opsec": "passive", + "opsecNote": "Viewing public content is low-friction, but platform telemetry and account controls still apply.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Mini Instagram", "type": "url", - "url": "https://mininsta.net/" + "url": "https://mini-for-instagram.en.softonic.com/", + "description": "Lightweight Instagram client utility used to simplify media viewing and downloading workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Preserving Instagram media for offline review", + "input": "Instagram profile or post URLs", + "output": "Downloaded Instagram images and videos", + "opsec": "passive", + "opsecNote": "Client-side utility; still follow account and platform ToS constraints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Imgrab", "type": "url", - "url": "https://www.imgrab.com/" + "url": "https://www.imgrab.com/", + "description": "Image download utility family used for saving individual or batch media from web pages.", + "status": "live", + "pricing": "free", + "bestFor": "Batch image capture and archive building", + "input": "Web pages or direct image URLs", + "output": "Downloaded image files", + "opsec": "passive", + "opsecNote": "Primarily local processing; risk profile depends on source websites being queried.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Tofo.me", "type": "url", - "url": "https://tofo.me/" + "url": "https://tofo.me/", + "description": "Legacy Instagram-related endpoint with unclear current functionality and limited verifiable OSINT value.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Unknown", + "output": "Unclear or inconsistent output", + "opsec": "unknown", + "opsecNote": "Service behavior is not reliably documented; prefer validated alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -2226,27 +5966,102 @@ { "name": "Flickr", "type": "url", - "url": "https://www.flickr.com/" + "url": "https://www.flickr.com/", + "description": "Photo hosting platform that often preserves useful image metadata and geotags for OSINT workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Image metadata and geolocation investigation", + "input": "Usernames, tags, photo links, map regions", + "output": "Public photos with metadata and account context", + "opsec": "passive", + "opsecNote": "Public browsing is generally low-risk; API and account use may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Flickr Map", "type": "url", - "url": "https://www.flickr.com/map/" + "url": "https://www.flickr.com/map/", + "description": "Flickr map interface for browsing geotagged photos by area and time.", + "status": "live", + "pricing": "free", + "bestFor": "Map-based discovery of geotagged Flickr images", + "input": "Geographic area and map navigation", + "output": "Geotagged photos plotted on interactive map tiles", + "opsec": "passive", + "opsecNote": "Uses public Flickr geotag data; activity remains normal web browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "My Pics Map", "type": "url", - "url": "https://www.mypicsmap.com/" + "url": "https://www.mypicsmap.com/", + "description": "Photo mapping utility reference with unclear present-day availability as a distinct OSINT tool.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference for photo geotag visualization", + "input": "Photo collections with location data", + "output": "Mapped photo points (when service is operational)", + "opsec": "unknown", + "opsecNote": "Current reliability is uncertain; validate output against active mapping alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "idGettr", "type": "url", - "url": "https://www.webfx.com/tools/idgettr/" + "url": "https://www.webfx.com/tools/idgettr/", + "description": "Web utility for resolving Instagram usernames to numeric account IDs.", + "status": "live", + "pricing": "free", + "bestFor": "Converting Instagram handles into numeric IDs for follow-on tooling", + "input": "Instagram username", + "output": "Numeric Instagram user ID", + "opsec": "passive", + "opsecNote": "Lookup is performed through the service; avoid using sensitive operational accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Flickr Hive Mind", "type": "url", - "url": "https://flickrhivemind.net/" + "url": "https://flickrhivemind.net/", + "description": "Advanced Flickr search and data-mining interface for tags, users, text, and date filters.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted Flickr dataset discovery and batch result review", + "input": "Tags, usernames, free text, date constraints", + "output": "Filtered photo result sets and source links", + "opsec": "passive", + "opsecNote": "Queries public Flickr data through a third-party interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2257,97 +6072,297 @@ { "name": "ExifEditor", "type": "url", - "url": "https://exifeditor.io" + "url": "https://exifeditor.io", + "description": "Browser-based EXIF metadata viewer and editor for quick image metadata inspection or sanitization.", + "status": "live", + "pricing": "free", + "bestFor": "Fast EXIF inspection and metadata cleanup in-browser", + "input": "Image files (JPEG/PNG)", + "output": "Displayed EXIF fields and optionally edited image file", + "opsec": "passive", + "opsecNote": "Primarily local browser processing; metadata edits are active data changes.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExifTool (T)", "type": "url", - "url": "https://exiftool.org/" + "url": "https://exiftool.org/", + "description": "Widely used command-line toolkit for reading and writing EXIF, IPTC, XMP, and other metadata formats.", + "status": "live", + "pricing": "free", + "bestFor": "Comprehensive multi-format metadata extraction", + "input": "Image, video, audio, and document files", + "output": "Structured metadata fields and optional file metadata updates", + "opsec": "passive", + "opsecNote": "Read operations are passive; write mode modifies source metadata.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExifViewer", "type": "url", - "url": "https://www.exifviewer.org/" + "url": "https://www.exifviewer.org/", + "description": "Online EXIF inspection utility for camera, location, and embedded image metadata fields.", + "status": "live", + "pricing": "free", + "bestFor": "Quick EXIF inspection without local CLI tools", + "input": "Image file uploads or image URLs", + "output": "Human-readable EXIF and geolocation data", + "opsec": "passive", + "opsecNote": "Uploads may route through third-party infrastructure depending on deployment.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FOCA (T)", "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" + "url": "https://github.com/ElevenPaths/FOCA", + "description": "Desktop reconnaissance tool that gathers public documents from target domains and extracts embedded metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Corporate document metadata reconnaissance", + "input": "Target domains and document repositories", + "output": "Extracted usernames, paths, software fingerprints, and document metadata", + "opsec": "active", + "opsecNote": "Performs active collection and download actions that may be logged by target infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "GeoSetter", "type": "url", - "url": "https://geosetter.de/en/main-en/" + "url": "https://geosetter.de/en/main-en/", + "description": "Windows desktop utility for viewing and editing photo geotags and EXIF/XMP metadata fields in bulk.", + "status": "live", + "pricing": "free", + "bestFor": "Bulk geolocation metadata review and correction", + "input": "Image files with embedded or missing location metadata", + "output": "Updated geotags and metadata-enhanced image sets", + "opsec": "passive", + "opsecNote": "Local tool; editing metadata is an active modification step.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Jeffrey's Exif Viewer", "type": "url", - "url": "https://exif.regex.info/" + "url": "https://regex.info/blog/", + "description": "Formerly popular EXIF web viewer that is now discontinued and kept as historical reference.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Image files (service discontinued)", + "output": "No active EXIF processing available", + "opsec": "unknown", + "opsecNote": "Service is discontinued; use active alternatives for operational work.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "JPEGsnoop (T)", "type": "url", - "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html" + "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html", + "description": "Windows forensic utility for deep JPEG structure analysis, recompression detection, and authenticity clues.", + "status": "live", + "pricing": "free", + "bestFor": "JPEG forensic analysis and tamper signal detection", + "input": "JPEG and supported media/document files", + "output": "Compression signatures, structure details, and edit indicators", + "opsec": "passive", + "opsecNote": "Local forensic analysis with no inherent outbound activity.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Metapicz", "type": "url", - "url": "https://metapicz.com/#landing" + "url": "https://metapicz.com/#landing", + "description": "Online EXIF parser historically used for quick camera and location metadata reads, now showing signs of limited maintenance.", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy metadata checks when primary tools are unavailable", + "input": "Image files", + "output": "Formatted EXIF metadata when service is functioning", + "opsec": "passive", + "opsecNote": "Reliability appears inconsistent; verify findings with maintained alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Search by Exif", "type": "url", - "url": "https://www.exif-search.com/" + "url": "https://exif.osint-tool.com", + "description": "Web EXIF inspection tool focused on extracting metadata and GPS clues from supplied images.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid EXIF and geolocation extraction", + "input": "Image files", + "output": "EXIF metadata with location-relevant fields", + "opsec": "passive", + "opsecNote": "Web-hosted processing can expose uploads to third-party infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "xeuledoc - Fetch metadata about any public Google document", "type": "url", - "url": "https://github.com/Malfrats/xeuledoc" - }, - { - "name": "FOCA (T)", - "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" + "url": "https://github.com/Malfrats/xeuledoc", + "description": "Python tool that extracts metadata from public Google Docs, Sheets, and Slides links.", + "status": "live", + "pricing": "free", + "bestFor": "Google document attribution and metadata extraction", + "input": "Public Google document URLs", + "output": "Owner identifiers, account metadata, and document context", + "opsec": "passive", + "opsecNote": "Reads only public docs without authentication bypass, but still queries Google infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Exiv2 (T)", "type": "url", - "url": "https://exiv2.org/" + "url": "https://exiv2.org/", + "description": "Cross-platform library and CLI for reading and modifying EXIF, IPTC, XMP, and ICC metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Programmatic metadata parsing and editing pipelines", + "input": "Image files with embedded metadata", + "output": "Metadata dumps and optional metadata writes", + "opsec": "passive", + "opsecNote": "Read operations are passive; write actions alter evidence files.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MediaInfo (T)", "type": "url", - "url": "https://mediaarea.net/en/MediaInfo" + "url": "https://mediaarea.net/en/MediaInfo", + "description": "Cross-platform utility for extracting technical metadata from video and audio media files.", + "status": "live", + "pricing": "free", + "bestFor": "Media codec and container metadata profiling", + "input": "Video and audio files", + "output": "Codec, bitrate, duration, stream, and tag metadata", + "opsec": "passive", + "opsecNote": "Local analysis utility with no required outbound collection.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Apache Tika (T)", "type": "url", - "url": "https://tika.apache.org/" + "url": "https://tika.apache.org/", + "description": "Apache content analysis framework for extracting metadata and text across a very broad set of file formats.", + "status": "live", + "pricing": "free", + "bestFor": "Scalable metadata extraction across heterogeneous document sets", + "input": "Documents, archives, media, and structured file types", + "output": "Normalized metadata fields and extracted text content", + "opsec": "passive", + "opsecNote": "Operational exposure depends on deployment mode (local vs server-based processing).", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "oletools (T)", "type": "url", - "url": "https://github.com/decalage2/oletools" + "url": "https://github.com/decalage2/oletools", + "description": "Python toolkit for analyzing OLE and Office documents, including macro extraction and suspicious object detection.", + "status": "live", + "pricing": "free", + "bestFor": "Office document security triage and embedded code inspection", + "input": "OLE/OOXML/RTF Office documents", + "output": "Macro code, suspicious indicators, embedded object details, and metadata", + "opsec": "active", + "opsecNote": "Malicious samples can trigger security tooling; run analysis in isolated environments.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hachoir (T)", "type": "url", - "url": "https://github.com/vstinner/hachoir" + "url": "https://hachoir.readthedocs.io/" }, { "name": "C2PA Verify", "type": "url", - "url": "https://contentcredentials.org/verify" + "url": "https://c2paviewer.com/" }, { "name": "Metadata2Go", "type": "url", "url": "https://www.metadata2go.com/" - }, - { - "name": "Get-Metadata", - "type": "url", - "url": "https://www.get-metadata.com/" } ] }, @@ -2358,12 +6373,7 @@ { "name": "Ghiro (T)", "type": "url", - "url": "https://github.com/ghirensics/ghiro" - }, - { - "name": "Camera Trace", - "type": "url", - "url": "https://www.cameratrace.com/trace" + "url": "https://getghiro.org/" }, { "name": "Forensically", @@ -2376,11 +6386,6 @@ "name": "OCR", "type": "folder", "children": [ - { - "name": "Online OCR", - "type": "url", - "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" - }, { "name": "i2OCR", "type": "url", @@ -2405,7 +6410,7 @@ { "name": "Creepy (T)", "type": "url", - "url": "https://www.geocreepy.com/" + "url": "https://github.com/ilektrojohn/creepy" } ] } @@ -2422,7 +6427,7 @@ { "name": "Google Videos", "type": "url", - "url": "https://www.google.com/videohp?gws_rd=ssl" + "url": "https://www.google.com/videohp" }, { "name": "Bing Videos", @@ -2432,7 +6437,7 @@ { "name": "Internet Archive Videos", "type": "url", - "url": "https://archive.org/details/opensource_movies" + "url": "https://archive.org/details/movies" }, { "name": "Vines (D)", @@ -2440,14 +6445,14 @@ "url": "https://www.google.com/search?q=site:vine.co+%3Csearchterm%3E" }, { - "name": "Dogpile Web Search", + "name": "Dogpile", "type": "url", "url": "https://www.dogpile.com/" }, { "name": "Geo Search Tool", "type": "url", - "url": "https://www.geosearchtool.com/" + "url": "https://youtube.github.io/geo-search-tool/" }, { "name": "blinkx Video Search", @@ -2457,17 +6462,17 @@ { "name": "Facebook Live Map", "type": "url", - "url": "https://www.facebook.com/watch/live/?ref=live_delegate" + "url": "https://facebook.com/live" }, { - "name": "LiveLeak", + "name": "LiveLeak (D)", "type": "url", "url": "https://www.liveleak.com/" }, { "name": "Metatube", "type": "url", - "url": "https://www.metatube.com/" + "url": "https://github.com/JVT038/MetaTube" }, { "name": "Yahoo Video Search", @@ -2477,7 +6482,7 @@ { "name": "Search YouTube by Location", "type": "url", - "url": "https://mattw.io/youtube-geofind/location" + "url": "https://mattw.io/youtube-geofind/" } ] }, @@ -2485,11 +6490,6 @@ "name": "Analyze / Record", "type": "folder", "children": [ - { - "name": "DetURL", - "type": "url", - "url": "https://deturl.com/" - }, { "name": "Print YouTube StoryBoard Instructions", "type": "url", @@ -2656,7 +6656,22 @@ { "name": "What Font Is", "type": "url", - "url": "https://www.whatfontis.com/" + "url": "https://www.whatfontis.com/", + "description": "AI-powered font identification tool that analyzes images against a database of 1.2M+ typefaces to identify fonts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Identifying fonts from screenshots and images", + "input": "Image files containing text (uploaded via drag-and-drop or file picker)", + "output": "Font matches with design details, download links, and up to 60+ similar alternatives", + "opsec": "passive", + "opsecNote": "Uploads images to remote servers; consider OPSEC implications for sensitive screenshots or documents.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -4118,12 +8133,266 @@ "url": "https://www.brbpub.com/" }, { - "name": "GOVDATA - Das Datenportal für Deutschland (German)", + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", "type": "url", "url": "https://www.govdata.de/" }, { - "name": "Open-Data-Portal München (German)", + "name": "Open-Data-Portal M\u00fcnchen (German)", + "type": "url", + "url": "https://www.opengov-muenchen.de/" + }, + { + "name": "Searchable FCC ID Database", + "type": "url", + "url": "https://fccid.io/" + } + ] + }, + { + "name": "Compliance & Risk Intelligence", + "type": "folder", + "children": [ + { + "name": "Sanctions Screening", + "type": "folder", + "children": [ + { + "name": "OpenSanctions", + "type": "url", + "url": "https://www.opensanctions.org/", + "description": "Aggregated database of sanctioned entities, politically exposed persons, and persons of criminal interest from 329 global data sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bulk sanctions and PEP screening across consolidated global watchlists", + "input": "Person or entity name", + "output": "Entity profiles with sanctions designations, PEP flags, and source metadata", + "opsec": "passive", + "opsecNote": "Passive lookups against a public database; API usage requires an account and is logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OFAC Sanctions List Search", + "type": "url", + "url": "https://sanctionssearch.ofac.treas.gov/", + "description": "Official U.S. Treasury tool for searching OFAC Specially Designated Nationals and related sanctions lists with approximate string matching.", + "status": "live", + "pricing": "free", + "bestFor": "Checking individuals or entities against U.S. sanctions programs", + "input": "Name, address, entity type, ID number, or sanctions program", + "output": "Matched records with name, sanctions program, list designation, and confidence score", + "opsec": "passive", + "opsecNote": "Public U.S. government search tool; queries are submitted to a federal server and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "EU Sanctions Tool (D)", + "type": "url", + "url": "https://sanctions-tool.ec.europa.eu", + "description": "European Commission tool for searching EU restrictive measures and consolidated sanctions lists targeting persons, entities, and bodies.", + "status": "degraded", + "pricing": "free", + "bestFor": "Checking individuals or entities against EU sanctions regimes", + "input": "Person or entity name", + "output": "Matches against EU consolidated sanctions list with designation details", + "opsec": "passive", + "opsecNote": "Public EU government search tool; queries are submitted to an EU server and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "dilisense", + "type": "url", + "url": "https://dilisense.com/en", + "description": "AML compliance platform that screens individuals and entities against sanctions, PEP, and watchlist data sources with fuzzy matching and confidence scoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Commercial AML/KYC sanctions screening and PEP checks", + "input": "Name, date of birth, citizenship, or other identifying information", + "output": "Match results with entity details, list sources, and confidence scores", + "opsec": "passive", + "opsecNote": "Queries sent to dilisense servers; registration required so searches are tied to an account.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "KYC / AML Tools", + "type": "folder", + "children": [ + { + "name": "NameScan", + "type": "url", + "url": "https://namescan.io", + "description": "Compliance screening platform providing sanctions checks, PEP screenings, and adverse media searches against global government databases with a free tier.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick free sanctions and PEP screening with adverse media checks", + "input": "Individual or business name", + "output": "Screening reports with sanctions matches, PEP flags, and adverse media hits", + "opsec": "passive", + "opsecNote": "Free scans available without registration; full access requires account creation.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OpenScreening", + "type": "url", + "url": "https://resources.linkurious.com/openscreening", + "description": "Free graph-based PEP and sanctions screening tool by Linkurious that visualizes connections across persons of interest using OpenSanctions and ICIJ data.", + "status": "live", + "pricing": "free", + "bestFor": "Visualizing connections between sanctioned entities, PEPs, and offshore structures", + "input": "Individual or organization name", + "output": "Interactive graph visualizations showing entity relationships and sanctions connections", + "opsec": "passive", + "opsecNote": "Web-based search against public datasets hosted by Linkurious; queries are sent to their servers.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Companies House (R)", + "type": "url", + "url": "https://find-and-update.company-information.service.gov.uk/", + "description": "Official UK government register for searching company information, officer appointments, and disqualified directors across all UK-registered companies.", + "status": "live", + "pricing": "free", + "bestFor": "Looking up UK company details, officers, and filing history", + "input": "Company name, company number, or officer name", + "output": "Company profiles, registered addresses, officer appointments, filing history, and document images", + "opsec": "passive", + "opsecNote": "Public UK government service; searches are passive lookups against an open register.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "Beneficial Ownership Lookup", + "type": "folder", + "children": [ + { + "name": "OpenOwnership", + "type": "url", + "url": "https://www.openownership.org/en/", + "description": "Global hub for beneficial ownership transparency, providing data standards and a register linking corporate ownership data across jurisdictions.", + "status": "live", + "pricing": "free", + "bestFor": "Investigating beneficial ownership of corporate entities across jurisdictions", + "input": "Company name, jurisdiction, or person name", + "output": "Beneficial ownership chains, corporate structures, and linked entities across registers", + "opsec": "passive", + "opsecNote": "Public web queries against open data; no notification to subjects.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ICIJ Offshore Leaks Database", + "type": "url", + "url": "https://offshoreleaks.icij.org/", + "description": "Searchable database of 800,000+ offshore entities from ICIJ investigations including Panama Papers, Paradise Papers, and Pandora Papers.", + "status": "live", + "pricing": "free", + "bestFor": "Tracing offshore company structures and hidden ownership from leaked documents", + "input": "Person name, company name, address, or jurisdiction", + "output": "Entity records, officer relationships, intermediary connections, and network graphs", + "opsec": "passive", + "opsecNote": "Public database queries; no notification to subjects. Bulk data also available for download.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OCCRP Aleph (R)", + "type": "url", + "url": "https://aleph.occrp.org/", + "description": "Global archive of research material for investigative reporting, aggregating public records, court filings, company registries, and leaks from 200+ sources.", + "status": "live", + "pricing": "free", + "bestFor": "Cross-referencing persons and companies across public records, leaks, and investigative datasets", + "input": "Person name, company name, or document keywords", + "output": "Entity profiles, linked datasets, document matches, and relationship mappings", + "opsec": "passive", + "opsecNote": "Registration required for full access; queries are logged by OCCRP but subjects are not notified.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "Public Records?", + "type": "url", + "url": "https://publicrecords.searchsystems.net/" + }, + { + "name": "The World Bank Open Data Catalog", + "type": "url", + "url": "https://datacatalog.worldbank.org/" + }, + { + "name": "BRB Public Records", + "type": "url", + "url": "https://www.brbpub.com/" + }, + { + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", + "type": "url", + "url": "https://www.govdata.de/" + }, + { + "name": "Open-Data-Portal M\u00fcnchen (German)", "type": "url", "url": "https://www.opengov-muenchen.de/" }, @@ -4137,9 +8406,64 @@ "type": "folder", "children": [ { - "name": "OpenSanctions", + "name": "PepChecker (R)", "type": "url", - "url": "https://www.opensanctions.org/" + "url": "https://pepchecker.com", + "description": "PEP and sanctions screening tool offering checks against comprehensive PEP lists and global sanctions databases with a free tier of limited searches.", + "status": "live", + "pricing": "freemium", + "bestFor": "Screening individuals against PEP lists and international sanctions databases", + "input": "Person name", + "output": "PEP match results, sanctions list matches, risk indicators, and political exposure details", + "opsec": "passive", + "opsecNote": "Web-based queries; registration required for workspace features. Subjects are not notified.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Ukraine PEP Register (D)", + "type": "url", + "url": "https://pep.org.ua/en/", + "description": "Formerly a database of Ukrainian politically exposed persons maintained by civil society. Now redirects to a static wartime advocacy page.", + "status": "down", + "pricing": "free", + "bestFor": "Previously used for checking Ukrainian politically exposed persons", + "input": "Person name (when operational)", + "output": "PEP profiles and political positions (when operational)", + "opsec": "passive", + "opsecNote": "Site is no longer functional; original database was a public web lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + { + "name": "EveryPolitician", + "type": "url", + "url": "https://everypolitician.org/", + "description": "Global database of political office-holders now operated as part of the OpenSanctions project, providing structured data on politicians and public officials worldwide.", + "status": "live", + "pricing": "free", + "bestFor": "Looking up current and former political office-holders globally for PEP screening", + "input": "Person name, country, or political position", + "output": "Politician profiles, positions held, party affiliations, and jurisdictional data", + "opsec": "passive", + "opsecNote": "Public database queries against open data; no notification to subjects.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -5362,12 +9686,42 @@ { "name": "Live Journal Seek", "type": "url", - "url": "https://ljseek.com/" + "url": "https://ljseek.com/", + "description": "Search tool for LiveJournal journals and communities across public entries that are indexed.", + "status": "live", + "pricing": "free", + "bestFor": "Finding public LiveJournal entries and historical community discussions", + "input": "Keywords and search terms", + "output": "Matching journal entries with author, date, and snippets", + "opsec": "passive", + "opsecNote": "Searches publicly indexed content and does not contact journal owners directly; queries are likely logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Blog Search Engine", "type": "url", - "url": "https://www.blogsearchengine.org/" + "url": "https://www.blogsearchengine.org/", + "description": "Blog-focused search engine for discovering blog posts, directories, and RSS-connected content.", + "status": "live", + "pricing": "free", + "bestFor": "Blog discovery and topic-focused blog post searching", + "input": "Keywords and blog topics", + "output": "Matching blog posts, listings, and feed-linked results", + "opsec": "passive", + "opsecNote": "Aggregates publicly indexed blog data without direct user contact to target blogs; queries are logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5378,17 +9732,62 @@ { "name": "Discord Bot List", "type": "url", - "url": "https://discord.bots.gg/" + "url": "https://discord.bots.gg/", + "description": "Searchable directory of Discord bots with listings, categories, and discovery metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Discord bot discovery and ecosystem mapping", + "input": "Bot names, keywords, and categories", + "output": "Bot profiles with descriptions, ratings, and invite metadata", + "opsec": "passive", + "opsecNote": "Enumerates publicly listed bots and does not require direct Discord account interaction for browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "ReconXplorer (T)", "type": "url", - "url": "https://github.com/root7am/ReconXplorer" + "url": "https://github.com/root7am/ReconXplorer", + "description": "Open-source reconnaissance toolkit with modules for IP, email, and Discord-focused lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-input OSINT checks from a local scriptable toolkit", + "input": "IP addresses, emails, Discord tokens, and host data", + "output": "Recon results including geolocation, service, and account-related metadata", + "opsec": "active", + "opsecNote": "Runs direct external queries from the operator environment and may trigger service-side detection or logging.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Top.gg", "type": "url", - "url": "https://top.gg/" + "url": "https://top.gg/", + "description": "Large Discord bot and app discovery platform with ranking, filtering, and listing data.", + "status": "live", + "pricing": "free", + "bestFor": "Discord bot ranking analysis and app discovery", + "input": "Bot names, tags, and search filters", + "output": "Bot listings with popularity, server counts, and profile details", + "opsec": "passive", + "opsecNote": "Uses public listing data and does not require direct target interaction for standard browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5399,27 +9798,102 @@ { "name": "BoardReader", "type": "url", - "url": "https://boardreader.com/" + "url": "https://boardreader.com/", + "description": "Forum search engine that indexes discussions across message boards and community platforms.", + "status": "live", + "pricing": "free", + "bestFor": "Finding forum threads and topic-centric discussion history", + "input": "Keywords, forum names, and topical queries", + "output": "Indexed posts and thread references with source links", + "opsec": "passive", + "opsecNote": "Searches indexed forum content and avoids direct interaction with target forum users.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Omgili", "type": "url", - "url": "https://webz.io/" + "url": "https://webz.io/", + "description": "Forum and discussion search capability operated through Webz.io infrastructure and data products.", + "status": "live", + "pricing": "freemium", + "bestFor": "Forum discussion discovery with optional API-driven workflows", + "input": "Keywords and Boolean-style forum queries", + "output": "Discussion posts and thread-level matching results", + "opsec": "passive", + "opsecNote": "Uses indexed discussion datasets from a third-party provider; user-side browsing is passive.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Craigslist Forums", "type": "url", - "url": "https://forums.craigslist.org/" + "url": "https://forums.craigslist.org/", + "description": "Craigslist-hosted forum system for public community discussions and region-oriented threads.", + "status": "live", + "pricing": "free", + "bestFor": "Reviewing Craigslist community discussions and regional forum activity", + "input": "Forum categories, keywords, and regional navigation", + "output": "Forum threads, post content, and timing context", + "opsec": "passive", + "opsecNote": "Reads publicly visible forum content and does not require direct messaging or contact with users.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Delphi Forum Search", "type": "url", - "url": "https://www.delphiforums.com/" + "url": "https://www.delphiforums.com/", + "description": "Forum platform with searchable user communities across niche interest categories.", + "status": "live", + "pricing": "freemium", + "bestFor": "Niche forum discovery and historical community thread review", + "input": "Forum names, categories, and keywords", + "output": "Forum listings, thread titles, and message pages", + "opsec": "passive", + "opsecNote": "Public forum browsing is passive; some communities may require registration for deeper access.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Groups Search", "type": "url", - "url": "https://groups.google.com/forum/#!overview" + "url": "https://groups.google.com/forum/#!overview", + "description": "Search interface for Google Groups and archived discussion content, including historical threads.", + "status": "live", + "pricing": "free", + "bestFor": "Researching archived mailing-list and discussion-group content", + "input": "Keywords, group names, authors, and date ranges", + "output": "Thread messages and group-level discussion results", + "opsec": "passive", + "opsecNote": "Searches archived public discussions through Google-hosted infrastructure where activity is logged.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5430,22 +9904,82 @@ { "name": "Mibbit", "type": "url", - "url": "https://search.mibbit.com/" + "url": "https://search.mibbit.com/", + "description": "Former web IRC client and channel search service that is no longer operational.", + "status": "down", + "pricing": "free", + "bestFor": "Legacy reference for historical IRC channel search workflows", + "input": "Channel or keyword queries (historical behavior)", + "output": "No current output; service is discontinued", + "opsec": "Unknown", + "opsecNote": "Service shut down on August 30, 2024 and cannot be relied on for active workflows.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "IRCP (T)", "type": "url", - "url": "https://github.com/internet-relay-chat/IRCP" + "url": "https://github.com/internet-relay-chat/IRCP", + "description": "Python-based IRC probing utility for scanning servers and collecting network/channel metadata.", + "status": "live", + "pricing": "free", + "bestFor": "IRC server enumeration and protocol-level reconnaissance", + "input": "Target ranges, IRC ports, and server parameters", + "output": "Server and channel metadata in machine-readable output", + "opsec": "active", + "opsecNote": "Actively connects to IRC services and may be detectable by network monitoring and server logs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ircsnapshot (T)", "type": "url", - "url": "https://github.com/bwall/ircsnapshot" + "url": "https://github.com/bwall/ircsnapshot", + "description": "IRC data collection tool that connects bots to servers for user and channel mapping.", + "status": "live", + "pricing": "free", + "bestFor": "IRC topology mapping and user/channel relationship analysis", + "input": "IRC server details, bot config, and channel targets", + "output": "Collected user, hostmask, and channel affiliation data", + "opsec": "active", + "opsecNote": "Requires active network participation via bot accounts and is likely visible to channel operators.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "netsplit.de", "type": "url", - "url": "https://netsplit.de/channels/search.php" + "url": "https://netsplit.de/channels/search.php", + "description": "IRC directory and search portal for channel listings, network stats, and discovery workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Passive IRC channel discovery and network trend checks", + "input": "Channel names, keywords, and network filters", + "output": "Channel listings with network and user-count context", + "opsec": "passive", + "opsecNote": "Uses aggregated indexed IRC data and does not require direct IRC server interaction for searches.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5456,17 +9990,62 @@ { "name": "Arctic Shift", "type": "url", - "url": "https://arctic-shift.photon-reddit.com/" + "url": "https://arctic-shift.photon-reddit.com/", + "description": "Search and access layer for Reddit datasets with tools for historical content retrieval and analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical Reddit dataset analysis and subreddit research", + "input": "Search terms, dataset queries, or API-style requests", + "output": "Matching Reddit posts, comments, and metadata from indexed datasets", + "opsec": "passive", + "opsecNote": "Works against archived or indexed data sources without requiring direct engagement with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cama's Reddit Search", "type": "url", - "url": "https://camas.github.io/reddit-search/" + "url": "https://camas.github.io/reddit-search/", + "description": "Web tool for searching Reddit posts and comments by author, subreddit, text, and time filters.", + "status": "live", + "pricing": "free", + "bestFor": "Reddit user and subreddit content discovery", + "input": "Usernames, subreddits, keywords, and date constraints", + "output": "Filtered post/comment search results with metadata", + "opsec": "passive", + "opsecNote": "Uses public data indexing paths; original GitHub hosting was discontinued but alternative hosting remains available.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reveddit", "type": "url", - "url": "https://www.reveddit.com/" + "url": "https://www.reveddit.com/", + "description": "Interface for viewing Reddit content removals using archived and moderation-related visibility signals.", + "status": "live", + "pricing": "free", + "bestFor": "Investigating deleted or removed Reddit discussions", + "input": "Reddit URLs, usernames, or subreddit paths", + "output": "Recovered or flagged removed-content views with moderation indicators", + "opsec": "passive", + "opsecNote": "Queries archive-backed sources and public content pathways without direct contact to target users.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -5709,7 +10288,7 @@ { "name": "Online OCR", "type": "url", - "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" + "url": "https://www.onlineocr.net/" }, { "name": "i2OCR", @@ -5720,11 +10299,6 @@ "name": "New OCR", "type": "url", "url": "https://www.newocr.com/" - }, - { - "name": "Online OCR", - "type": "url", - "url": "https://www.onlineocr.net/" } ] }, @@ -6521,7 +11095,22 @@ { "name": "ClearImage Barcode Reader", "type": "url", - "url": "https://online-barcode-reader.inliteresearch.com/" + "url": "https://online-barcode-reader.inliteresearch.com/", + "description": "Web-based barcode and QR code recognition tool using Inlite Research ClearImage technology for common image and document formats.", + "status": "live", + "pricing": "free", + "bestFor": "Barcode and QR code decoding from uploaded files", + "input": "Image files and PDFs containing barcode or QR symbols", + "output": "Decoded barcode and QR payload values", + "opsec": "active", + "opsecNote": "Uploaded files are processed by a third-party web service and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6532,32 +11121,122 @@ { "name": "JS Beautifier", "type": "url", - "url": "https://beautifier.io/" + "url": "https://beautifier.io/", + "description": "Open-source JavaScript formatter that rewrites minified or obfuscated code into readable, consistently indented source.", + "status": "live", + "pricing": "free", + "bestFor": "Fast readability improvements for packed JavaScript", + "input": "Minified or obfuscated JavaScript source text", + "output": "Formatted JavaScript with normalized structure and spacing", + "opsec": "passive", + "opsecNote": "Typical use is low-risk code formatting through a public web interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "JS NICE", "type": "url", - "url": "https://jsnice.org/" + "url": "https://jsnice.org/", + "description": "Legacy JavaScript reverse-engineering service that previously improved variable names and recovered structure from minified code.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference for JavaScript decompilation workflows", + "input": "Obfuscated or minified JavaScript code", + "output": "No current output because the public service is unavailable", + "opsec": "Unknown", + "opsecNote": "Service is currently unreachable and should be treated as defunct until replaced.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Firebug (T)", "type": "url", - "url": "https://getfirebug.com/downloads/" + "url": "https://getfirebug.com/downloads/", + "description": "Former Firefox debugging extension that has been retired, with core functionality absorbed into modern Firefox Developer Tools.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical context for legacy JavaScript debugging references", + "input": "Legacy Firefox extension workflows and old debugging material", + "output": "Archived documentation and obsolete download artifacts", + "opsec": "Unknown", + "opsecNote": "Tool is unmaintained and not suitable for active investigative workflows.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "SpiderMonkey (T)", "type": "url", - "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey" + "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey", + "description": "Mozilla JavaScript engine used by Firefox and available for standalone execution and analysis in local environments.", + "status": "live", + "pricing": "free", + "bestFor": "Local JavaScript execution and behavior testing without browser UI", + "input": "JavaScript source code", + "output": "Execution results, runtime behavior, and script output", + "opsec": "passive", + "opsecNote": "Runs locally and avoids sending samples to third-party analysis services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kahu Revelo (T)", "type": "url", - "url": "https://www.kahusecurity.com/tools/" + "url": "https://www.kahusecurity.com/tools/", + "description": "Windows-focused JavaScript deobfuscation utility that executes scripts in a controlled environment to reveal hidden logic.", + "status": "live", + "pricing": "free", + "bestFor": "Unpacking heavily obfuscated JavaScript samples on Windows", + "input": "Obfuscated JavaScript files or script text", + "output": "Deobfuscated code and decoded runtime content", + "opsec": "active", + "opsecNote": "Tool executes suspect code paths, so sandbox or VM isolation is recommended.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "JavaScript Deobfuscator (T)", "type": "url", - "url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/" + "url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/", + "description": "Firefox add-on for inspecting and deobfuscating JavaScript in-browser during page analysis and script review.", + "status": "live", + "pricing": "free", + "bestFor": "Browser-native JavaScript deobfuscation during web investigations", + "input": "JavaScript loaded in Firefox pages or pasted script content", + "output": "Readable deobfuscated script output in browser tooling", + "opsec": "active", + "opsecNote": "Browser execution context can run page scripts and trackers while analyzing content.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6568,7 +11247,22 @@ { "name": "DDecode - PHP Decoder", "type": "url", - "url": "https://ddecode.com/phpdecoder/" + "url": "https://ddecode.com/phpdecoder/", + "description": "Online decoder for layered PHP obfuscation chains such as eval, base64, gzinflate, and related encoding wrappers.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid decoding of obfuscated PHP webshell and malware snippets", + "input": "Encoded or obfuscated PHP code", + "output": "Decoded and expanded PHP source text", + "opsec": "active", + "opsecNote": "Submitted samples are processed by a third-party server, so sensitive code should be sanitized first.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6583,17 +11277,62 @@ { "name": "XORSearch & XORStrings (T)", "type": "url", - "url": "https://blog.didierstevens.com/programs/xorsearch/" + "url": "https://blog.didierstevens.com/programs/xorsearch/", + "description": "Didier Stevens command-line utilities for locating XOR, ROL, ROT, and SHIFT-encoded strings in suspicious binaries.", + "status": "live", + "pricing": "free", + "bestFor": "String extraction and key hunting in encoded malware payloads", + "input": "Binary files and encoded byte streams", + "output": "Decoded candidate strings across transformation and key ranges", + "opsec": "passive", + "opsecNote": "Runs locally on analyst systems and does not require online submission.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "xortool (T)", "type": "url", - "url": "https://github.com/hellman/xortool" + "url": "https://github.com/hellman/xortool", + "description": "Python-based XOR analysis tool that estimates key lengths and recovers likely multi-byte keys via frequency analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Recovering repeating XOR keys from encoded files", + "input": "XOR-encrypted text or binary data", + "output": "Likely XOR keys and candidate decrypted output", + "opsec": "passive", + "opsecNote": "Pure local processing with no required external service calls.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "unxor (T)", "type": "url", - "url": "https://github.com/tomchop/unxor" + "url": "https://github.com/tomchop/unxor", + "description": "Known-plaintext XOR analysis utility for deriving keystreams and recovering original content from encoded samples.", + "status": "live", + "pricing": "free", + "bestFor": "Known-plaintext XOR cracking against malware and encoded artifacts", + "input": "XOR-encoded file plus known plaintext fragments", + "output": "Recovered keystream segments and decoded content", + "opsec": "passive", + "opsecNote": "Local command-line analysis avoids submitting artifacts to remote services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6604,7 +11343,22 @@ { "name": "Kahu Converter Utilities (T)", "type": "url", - "url": "https://www.kahusecurity.com/tools/" + "url": "https://www.kahusecurity.com/tools/", + "description": "Windows utility collection for format conversion, hex/binary transforms, and XOR-related decoding workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Mixed conversion and XOR utility operations on Windows", + "input": "Binary blobs, hex strings, and text samples", + "output": "Converted data and decoded intermediate representations", + "opsec": "passive", + "opsecNote": "Runs locally on analyst systems without mandatory cloud processing.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6615,22 +11369,82 @@ { "name": "iheartxor.py (T)", "type": "url", - "url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html" + "url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html", + "description": "Python script for brute-forcing XOR-obfuscated strings within defined boundaries to reveal hidden text in malware samples.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted extraction of XOR-obfuscated strings from binaries", + "input": "Binary data, dumps, or encoded string segments", + "output": "Recovered candidate strings and associated key bytes", + "opsec": "passive", + "opsecNote": "Offline local script execution keeps sample handling under analyst control.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "XORBruteForcer.py (T)", "type": "url", - "url": "https://eternal-todo.com/var/scripts/xorbruteforcer" + "url": "https://github.com/jesparza/scripts/blob/master/xorBruteForcer.py", + "description": "Single-byte XOR brute-force Python script that iterates candidate key values and surfaces matching decoded output.", + "status": "live", + "pricing": "free", + "bestFor": "Single-byte XOR key brute-forcing and quick validation", + "input": "Encoded file or byte sequence", + "output": "Decoded candidates mapped to tested XOR key values", + "opsec": "passive", + "opsecNote": "Local script analysis avoids artifact upload and minimizes external exposure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NoMoreXOR.py (T)", "type": "url", - "url": "https://github.com/hiddenillusion/NoMoreXOR" + "url": "https://github.com/hiddenillusion/NoMoreXOR", + "description": "Python utility for recovering long XOR keys using character frequency heuristics and YARA-assisted pattern matching.", + "status": "live", + "pricing": "free", + "bestFor": "Recovering long XOR keys in malware binaries", + "input": "Malware sample or obfuscated binary content", + "output": "Likely keys, decoded streams, and extraction hints", + "opsec": "passive", + "opsecNote": "Operates locally and is suitable for isolated malware analysis environments.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Balbuzard (T)", "type": "url", - "url": "https://bitbucket.org/decalage/balbuzard" + "url": "https://github.com/decalage2/balbuzard", + "description": "Python malware analysis toolkit that extracts indicators and brute-forces common obfuscation patterns including XOR and rotation transforms.", + "status": "live", + "pricing": "free", + "bestFor": "Automated deobfuscation and indicator extraction from suspicious files", + "input": "Suspicious binaries and encoded artifact files", + "output": "Decoded content, extracted IoCs, and pattern-analysis results", + "opsec": "passive", + "opsecNote": "Local toolkit execution supports controlled analysis without remote sample submission.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -6639,12 +11453,42 @@ { "name": "CyberChef", "type": "url", - "url": "https://gchq.github.io/CyberChef/" + "url": "https://gchq.github.io/CyberChef/", + "description": "GCHQ-maintained browser workbench for chained encoding, decoding, hashing, crypto, and data transformation operations.", + "status": "live", + "pricing": "free", + "bestFor": "Building and replaying multi-step decode and transform recipes", + "input": "Text, binary, hex, Base64, and structured payloads", + "output": "Transformed output for each selected operation chain", + "opsec": "passive", + "opsecNote": "Public web app use is convenient, but locally hosted builds are preferred for sensitive data.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Functions Online", "type": "url", - "url": "https://www.functions-online.com/" + "url": "https://www.functions-online.com/", + "description": "PHP-oriented online utility suite for common encoding, decoding, hashing, and string-manipulation function tests.", + "status": "live", + "pricing": "free", + "bestFor": "Quick PHP-specific encoding and decoding checks in browser", + "input": "Function parameters and data strings for selected PHP routines", + "output": "Computed function results and transformed data values", + "opsec": "active", + "opsecNote": "Data is processed server-side, so avoid submitting sensitive payloads directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -7511,7 +12355,22 @@ { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Maltiverse", @@ -7868,7 +12727,7 @@ "url": "https://themanyhats.club/centralised-place-for-privacy-resources/" }, { - "name": "The Hitchhiker’s Guide to Online Anonymity", + "name": "The Hitchhiker\u2019s Guide to Online Anonymity", "type": "url", "url": "https://anonymousplanet.org/guide/" }, @@ -8044,4 +12903,4 @@ ] } ] -} +} \ No newline at end of file