diff --git a/public/arf.json b/public/arf.json index 2ac6072..2668057 100644 --- a/public/arf.json +++ b/public/arf.json @@ -10,6 +10,26 @@ "name": "Username Search Engines", "type": "folder", "children": [ + { + "name": "WhatsMyName Web", + "type": "url", + "url": "https://whatsmyname.app/", + "description": "Free web-based OSINT username enumeration tool that searches for a specified username across 1500+ websites and platforms simultaneously, returning direct links to matching profiles.", + "status": "live", + "pricing": "free", + "bestFor": "Quick web-based username enumeration across social media, forums, gaming platforms, and professional networks", + "input": "Username", + "output": "List of sites where the username exists with direct profile links", + "opsec": "active", + "opsecNote": "Makes HTTP requests to each target site to check for username existence, however it does it from WhatsMyName infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, { "name": "WhatsMyName (T)", "type": "url", @@ -4008,20 +4028,65 @@ "name": "AWS Enumeration", "type": "folder", "children": [ - { - "name": "cloud_enum (T)", - "type": "url", - "url": "https://github.com/initstring/cloud_enum" - }, { "name": "AWSBucketDump (T)", "type": "url", - "url": "https://github.com/jordanpotti/AWSBucketDump" + "url": "https://github.com/jordanpotti/AWSBucketDump", + "description": "Python tool that enumerates AWS S3 buckets and optionally downloads accessible objects using keyword and pattern-based discovery.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted S3 bucket discovery and object collection", + "input": "AWS account naming patterns, keywords, and optional wordlists", + "output": "Discovered bucket names and downloadable object listings/files", + "opsec": "active", + "opsecNote": "Actively sends requests to S3 endpoints and can download objects.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "cloud_enum (T)", + "type": "url", + "url": "https://github.com/initstring/cloud_enum", + "description": "Multi-cloud enumeration tool that looks for exposed AWS, Azure, and GCP storage assets from target naming patterns.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid discovery of cloud storage exposure across major providers", + "input": "Company names, domains, and custom keywords/wordlists", + "output": "Potentially exposed cloud storage resources by provider", + "opsec": "active", + "opsecNote": "Performs direct enumeration requests against cloud provider endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Subfinder (T)", "type": "url", - "url": "https://github.com/projectdiscovery/subfinder" + "url": "https://github.com/projectdiscovery/subfinder", + "description": "Fast passive subdomain discovery utility that aggregates results from many curated OSINT and API-backed sources.", + "status": "live", + "pricing": "free", + "bestFor": "Passive subdomain enumeration for cloud asset inventorying", + "input": "Domain name and optional API credentials for data sources", + "output": "Resolved and unresolved subdomain candidates", + "opsec": "passive", + "opsecNote": "Uses third-party data sources by default and avoids active probing unless paired with other tools.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4029,30 +4094,105 @@ "name": "Azure/GCP Discovery", "type": "folder", "children": [ - { - "name": "GCPBucketBrute (T)", - "type": "url", - "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute" - }, { "name": "AADInternals (T)", "type": "url", - "url": "https://github.com/Gerenios/AADInternals" + "url": "https://github.com/Gerenios/AADInternals", + "description": "PowerShell toolkit for Azure AD and Entra ID assessment, including tenant reconnaissance and hybrid identity attack-path analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Deep Azure AD reconnaissance and security assessment", + "input": "Tenant identifiers, domain names, and account context", + "output": "Tenant/user intelligence, configuration findings, and attack-path indicators", + "opsec": "active", + "opsecNote": "Queries Microsoft identity services directly and may generate tenant-visible activity.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { - "name": "ROADtools (T)", + "name": "GCPBucketBrute (T)", "type": "url", - "url": "https://github.com/dirkjanm/roadtools" + "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute", + "description": "Google Cloud Storage bucket enumeration utility for identifying publicly accessible or weakly protected buckets.", + "status": "live", + "pricing": "free", + "bestFor": "Enumerating likely GCS bucket names at scale", + "input": "Target company names, domains, and custom wordlists", + "output": "Valid bucket names with access status and findings", + "opsec": "active", + "opsecNote": "Performs direct requests against GCS endpoints and can be detected in provider logs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MicroBurst (T)", "type": "url", - "url": "https://github.com/NetSPI/MicroBurst" + "url": "https://github.com/NetSPI/MicroBurst", + "description": "PowerShell collection focused on Azure security assessment, including subscription discovery and cloud service misconfiguration checks.", + "status": "live", + "pricing": "free", + "bestFor": "Azure subscription and service-level exposure testing", + "input": "Azure tenant/subscription context and optional credentials", + "output": "Recon data and security findings for Azure resources", + "opsec": "active", + "opsecNote": "Runs active checks against Azure control/data plane endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ROADtools (T)", + "type": "url", + "url": "https://github.com/dirkjanm/roadtools", + "description": "Azure AD exploration framework for dumping tenant objects, principals, and permissions to support attack-path and privilege analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Enumerating Azure AD objects and privilege relationships", + "input": "Azure AD tenant context and authentication tokens/credentials", + "output": "Users, groups, applications, roles, and privilege mappings", + "opsec": "active", + "opsecNote": "Interacts directly with Microsoft Graph and Azure AD endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Stormspotter (T)", "type": "url", - "url": "https://github.com/Azure/Stormspotter" + "url": "https://github.com/Azure/Stormspotter", + "description": "Graph-based Azure reconnaissance platform that maps cloud attack paths and trust relationships using Neo4j-backed visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Visual analysis of Azure attack paths and privilege chains", + "input": "Azure subscription/tenant metadata collected by collectors", + "output": "Interactive graph of Azure identities, resources, and attack edges", + "opsec": "active", + "opsecNote": "Collection phase performs authenticated queries against Azure APIs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4061,29 +4201,104 @@ "type": "folder", "children": [ { - "name": "Public Buckets", + "name": "BucketLoot (T)", "type": "url", - "url": "https://buckets.grayhatwarfare.com/" + "url": "https://github.com/redhuntlabs/BucketLoot", + "description": "Open-source cloud bucket discovery utility with limited current documentation and unclear maintenance signals.", + "status": "degraded", + "pricing": "free", + "bestFor": "Supplemental bucket discovery when validating legacy workflows", + "input": "Bucket name patterns and target-related keywords", + "output": "Candidate bucket names and accessible resource indications", + "opsec": "Unknown", + "opsecNote": "Insufficient current documentation to classify behavior confidently.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "goblob (T)", "type": "url", - "url": "https://github.com/Macmod/goblob" - }, - { - "name": "S3Scanner (T)", - "type": "url", - "url": "https://github.com/sa7mon/s3scanner" - }, - { - "name": "BucketLoot (T)", - "type": "url", - "url": "https://github.com/redhuntlabs/BucketLoot" + "url": "https://github.com/Macmod/goblob", + "description": "Go-based Azure blob storage enumeration utility designed for fast discovery of publicly exposed containers and blobs.", + "status": "live", + "pricing": "free", + "bestFor": "Enumerating Azure blob container exposure quickly", + "input": "Target naming patterns and optional custom wordlists", + "output": "Discovered blob storage endpoints and access results", + "opsec": "active", + "opsecNote": "Sends direct requests to Azure storage endpoints during enumeration.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "lazys3 (T)", "type": "url", - "url": "https://github.com/nahamsec/lazys3" + "url": "https://github.com/nahamsec/lazys3", + "description": "S3 bucket brute-forcing utility that generates candidate names from permutations and checks bucket accessibility.", + "status": "live", + "pricing": "free", + "bestFor": "Quick permutation-based S3 bucket name discovery", + "input": "Base target keywords and optional custom wordlists", + "output": "Potential S3 buckets with accessible bucket responses", + "opsec": "active", + "opsecNote": "Performs direct requests against AWS S3 bucket endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Public Buckets", + "type": "url", + "url": "https://buckets.grayhatwarfare.com/", + "description": "Search interface for publicly indexed cloud object storage buckets and files across multiple providers.", + "status": "live", + "pricing": "freemium", + "bestFor": "Investigating exposed bucket contents without running local scanners", + "input": "Keywords, domains, filenames, and object metadata filters", + "output": "Indexed public bucket/object matches with downloadable links", + "opsec": "passive", + "opsecNote": "Queries an existing index rather than probing target infrastructure directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "S3Scanner (T)", + "type": "url", + "url": "https://github.com/sa7mon/s3scanner", + "description": "Command-line scanner for enumerating and checking S3 bucket misconfigurations across AWS and compatible object storage services.", + "status": "live", + "pricing": "free", + "bestFor": "Validating bucket exposure and permissions across S3-compatible targets", + "input": "Bucket names, generated candidates, or wordlist-driven targets", + "output": "Bucket existence and permission states (list/read/write/public indicators)", + "opsec": "active", + "opsecNote": "Actively queries cloud storage endpoints and leaves provider-side request logs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4092,29 +4307,104 @@ "type": "folder", "children": [ { - "name": "Prowler (T)", + "name": "Checkov (T)", "type": "url", - "url": "https://github.com/prowler-cloud/prowler" - }, - { - "name": "ScoutSuite (T)", - "type": "url", - "url": "https://github.com/nccgroup/ScoutSuite" + "url": "https://github.com/bridgecrewio/checkov", + "description": "Infrastructure-as-code security scanner that checks Terraform, CloudFormation, Kubernetes, and other cloud configs against policy rules.", + "status": "live", + "pricing": "free", + "bestFor": "Shift-left cloud misconfiguration detection in IaC repositories", + "input": "IaC source files, templates, and configuration manifests", + "output": "Policy violations with severity and remediation context", + "opsec": "passive", + "opsecNote": "Analyzes local code/config files without probing target cloud environments directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Cloud Custodian (T)", "type": "url", - "url": "https://github.com/cloud-custodian/cloud-custodian" + "url": "https://github.com/cloud-custodian/cloud-custodian", + "description": "Policy-as-code engine for cloud governance and security that can detect and remediate risky cloud configurations.", + "status": "live", + "pricing": "free", + "bestFor": "Automated cloud governance and continuous configuration enforcement", + "input": "Cloud account credentials and YAML policy definitions", + "output": "Matched resources, policy findings, and optional remediation actions", + "opsec": "active", + "opsecNote": "Uses cloud APIs directly and can trigger enforcement actions when configured.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { - "name": "Checkov (T)", + "name": "Prowler (T)", "type": "url", - "url": "https://github.com/bridgecrewio/checkov" + "url": "https://github.com/prowler-cloud/prowler", + "description": "Cloud security posture and compliance assessment framework covering AWS, Azure, GCP, Kubernetes, and SaaS surfaces.", + "status": "live", + "pricing": "freemium", + "bestFor": "Broad cloud security and compliance baseline assessments", + "input": "Cloud account credentials, profiles, and optional compliance benchmarks", + "output": "Findings by control/check with compliance mapping and export options", + "opsec": "active", + "opsecNote": "Performs authenticated API checks against cloud environments and logs activity.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ScoutSuite (T)", + "type": "url", + "url": "https://github.com/nccgroup/ScoutSuite", + "description": "Multi-cloud auditing tool that inventories cloud resources and highlights security risks in an interactive HTML report.", + "status": "live", + "pricing": "free", + "bestFor": "Snapshot-style multi-cloud security posture reviews", + "input": "Cloud account credentials and provider-specific profile configuration", + "output": "Interactive audit report with categorized misconfiguration findings", + "opsec": "active", + "opsecNote": "Collects cloud metadata directly from provider APIs using granted credentials.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Steampipe (T)", "type": "url", - "url": "https://github.com/turbot/steampipe" + "url": "https://github.com/turbot/steampipe", + "description": "SQL interface over cloud APIs and services, enabling ad hoc querying of AWS, Azure, GCP, and many other data sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "SQL-driven cloud inventory and security query workflows", + "input": "SQL queries and plugin connections to cloud/provider APIs", + "output": "Tabular query results from live cloud metadata", + "opsec": "active", + "opsecNote": "Executes API-backed queries against connected cloud accounts.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4125,25 +4415,35 @@ { "name": "Amass (T)", "type": "url", - "url": "https://github.com/owasp-amass/amass" - }, - { - "name": "Sublist3r (T)", - "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" - }, - { - "name": "theHarvester (T)", - "type": "url", - "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "url": "https://github.com/owasp-amass/amass", + "description": "Advanced attack surface mapping framework for DNS and subdomain enumeration with graph correlation and extensive data-source support.", "status": "live", "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", - "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "bestFor": "Comprehensive external attack-surface and subdomain mapping", + "input": "Domain names, ASN data, CIDRs, and optional API credentials", + "output": "Correlated graph of domains, subdomains, infrastructure, and relationships", + "opsec": "active", + "opsecNote": "Supports both passive and active techniques, including DNS probing and brute-force modes.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "dnsrecon (T)", + "type": "url", + "url": "https://github.com/darkoperator/dnsrecon", + "description": "DNS enumeration script for recon workflows, supporting record discovery, zone transfer checks, brute-force, and reverse lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Detailed DNS reconnaissance and validation", + "input": "Domain names, name servers, and optional DNS wordlists", + "output": "DNS records, discovered hosts, and transfer/bruteforce findings", + "opsec": "active", + "opsecNote": "Performs direct DNS queries and active enumeration techniques against target infrastructure.", "localInstall": true, "googleDork": false, "registration": false, @@ -4173,9 +4473,44 @@ "deprecated": false }, { - "name": "dnsrecon (T)", + "name": "Sublist3r (T)", "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" + "url": "https://github.com/aboul3la/Sublist3r", + "description": "Passive subdomain enumeration tool that aggregates subdomains from public search engines and certificate-related sources.", + "status": "live", + "pricing": "free", + "bestFor": "Quick passive subdomain discovery for reconnaissance", + "input": "Domain name", + "output": "Discovered subdomain list and optional live-host checks", + "opsec": "passive", + "opsecNote": "Primarily uses third-party data sources and search interfaces for discovery.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "theHarvester (T)", + "type": "url", + "url": "https://github.com/laramies/theHarvester", + "description": "Reconnaissance tool for gathering emails, domains, hosts, and employee-related intelligence from public search and data sources.", + "status": "live", + "pricing": "free", + "bestFor": "Email and host discovery tied to a target organization", + "input": "Domain names, company names, and selected data-source modules", + "output": "Emails, hosts, domains, IPs, and related reconnaissance artifacts", + "opsec": "passive", + "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -8435,7 +8770,7 @@ "input": "Name, RUN (Chilean ID number), or vehicle plate", "output": "Personal identification data, vehicle registration, company records", "opsec": "active", - "opsecNote": "Requires registration with Chilean RUT; queries may be logged", + "opsecNote": "Requires registration with Chilean RUT; queries may be logged.", "localInstall": false, "googleDork": false, "registration": true, @@ -8455,7 +8790,7 @@ "input": "Name, address, phone number, email, or IP address", "output": "Contact details, associated addresses, phone numbers, email addresses", "opsec": "passive", - "opsecNote": "Free tier has daily lookup limits; no account required for basic searches", + "opsecNote": "Free tier has daily lookup limits; no account required for basic searches.", "localInstall": false, "googleDork": false, "registration": false, @@ -8475,7 +8810,7 @@ "input": "Name, address, phone, or email", "output": "Verified contact data, address standardization, identity confirmation", "opsec": "active", - "opsecNote": "Enterprise service; queries logged and usage tracked under account", + "opsecNote": "Enterprise service; queries logged and usage tracked under account.", "localInstall": false, "googleDork": false, "registration": true, @@ -8484,26 +8819,6 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "SalesMaple Contact Search", - "type": "url", - "url": "https://www.salesmaple.com/contacts/#!/", - "description": "Former B2B sales intelligence SaaS for contact search. Service is no longer operational.", - "status": "down", - "pricing": "paid", - "bestFor": "B2B contact discovery (defunct)", - "input": "Company name or contact criteria", - "output": "Business contact information", - "opsec": "Unknown", - "opsecNote": "Site is down; domain no longer resolves", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": true - }, { "name": "PeekYou", "type": "url", @@ -8515,7 +8830,7 @@ "input": "Name and optional location, or username", "output": "Aggregated social media profiles, contact information, web presence", "opsec": "passive", - "opsecNote": "No registration required; all searches use public data", + "opsecNote": "No registration required; all searches use public data.", "localInstall": false, "googleDork": false, "registration": false, @@ -8524,46 +8839,6 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "Reverse Genie People", - "type": "url", - "url": "https://www.reversegenie.com/people.php", - "description": "People search subsection of Reverse Genie (InfoTracer). Offered free caller ID, contact data lookups, and a browser extension (delisted Sept 2025).", - "status": "down", - "pricing": "freemium", - "bestFor": "Reverse phone and people lookups (degraded)", - "input": "Name, phone number, or address", - "output": "Contact details, caller identification", - "opsec": "passive", - "opsecNote": "Site unreachable via automated tools; browser extension delisted", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": true - }, - { - "name": "Wink People Search", - "type": "url", - "url": "https://itools.com/tool/wink-people-search", - "description": "Former meta-search tool for finding people across social networks by name, location, school, or workplace. Underlying Wink search engine is defunct.", - "status": "down", - "pricing": "free", - "bestFor": "Social network people search (defunct)", - "input": "Name, location, school, or workplace", - "output": "Social media profiles", - "opsec": "passive", - "opsecNote": "Service is no longer operational", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": true - }, { "name": "Webmii", "type": "url", @@ -8575,7 +8850,7 @@ "input": "First and last name", "output": "Web visibility score, social profiles, images, videos, news mentions", "opsec": "passive", - "opsecNote": "No registration required; searches public web data only", + "opsecNote": "No registration required; searches public web data only.", "localInstall": false, "googleDork": false, "registration": false, @@ -8595,7 +8870,7 @@ "input": "First and last name", "output": "Social media profiles across ~40 platforms", "opsec": "passive", - "opsecNote": "SSL certificate expired; browsers will show security warnings", + "opsecNote": "SSL certificate expired; browsers will show security warnings.", "localInstall": false, "googleDork": false, "registration": false, @@ -8615,7 +8890,7 @@ "input": "Email address or username", "output": "Matching profiles across 148+ social media platforms", "opsec": "passive", - "opsecNote": "No registration required; searches public profiles only", + "opsecNote": "No registration required; searches public profiles only.", "localInstall": false, "googleDork": false, "registration": false, @@ -8635,7 +8910,7 @@ "input": "Name, location, profession, company, or skills", "output": "Aggregated web presence, professional profiles, contact information", "opsec": "passive", - "opsecNote": "No registration for searches; account needed for profile creation features", + "opsecNote": "No registration for searches; account needed for profile creation features.", "localInstall": false, "googleDork": false, "registration": false, @@ -8655,7 +8930,7 @@ "input": "Name, date of birth, location, or family details", "output": "Historical records, census data, BMD certificates, military records", "opsec": "active", - "opsecNote": "Subscription required for full record access; free trial available", + "opsecNote": "Subscription required for full record access; free trial available.", "localInstall": false, "googleDork": false, "registration": true, @@ -8664,26 +8939,6 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "HowManyOfMe", - "type": "url", - "url": "https://howmanyofme.com/search/", - "description": "Former novelty tool that estimated how many people in the US shared a given name, based on Census data. Domain expired August 2025.", - "status": "down", - "pricing": "free", - "bestFor": "US name frequency estimation (defunct)", - "input": "First and last name", - "output": "Estimated number of people with that name in the US", - "opsec": "passive", - "opsecNote": "Domain expired; site permanently offline", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": true - }, { "name": "IDCrawl", "type": "url", @@ -8695,7 +8950,7 @@ "input": "Name, username, phone, or email", "output": "Social media profiles, photos, public records, contact information", "opsec": "passive", - "opsecNote": "Cloudflare-protected; no registration required", + "opsecNote": "Cloudflare-protected; no registration required.", "localInstall": false, "googleDork": false, "registration": false, @@ -8715,7 +8970,7 @@ "input": "Name, date, place, or family relationships", "output": "Historical records, family trees, digitized documents, cemetery records", "opsec": "passive", - "opsecNote": "Basic search is free without login; account needed for Family Tree features", + "opsecNote": "Basic search is free without login; account needed for Family Tree features.", "localInstall": false, "googleDork": false, "registration": false, @@ -8728,14 +8983,14 @@ "name": "Ancestry.com", "type": "url", "url": "https://www.ancestry.com/search/", - "description": "World largest genealogy platform with over 40 billion historical records including census, immigration, military, and vital records across 80+ countries.", + "description": "World's largest genealogy platform with over 40 billion historical records including census, immigration, military, and vital records across 80+ countries.", "status": "live", "pricing": "freemium", "bestFor": "Comprehensive genealogy and family history research", "input": "Name, date of birth, location, or family details", "output": "Historical records, DNA matches, family trees, immigration records", "opsec": "active", - "opsecNote": "Free basic search; subscription required for full record access and DNA features", + "opsecNote": "Free basic search; subscription required for full record access and DNA features.", "localInstall": false, "googleDork": false, "registration": false, @@ -8755,7 +9010,7 @@ "input": "Name, phone number, or address", "output": "Contact details, address, phone numbers, associated people", "opsec": "passive", - "opsecNote": "Free service; may have bot protection on automated access", + "opsecNote": "Free service; may have bot protection on automated access.", "localInstall": false, "googleDork": false, "registration": false, @@ -8775,7 +9030,7 @@ "input": "Name, phone number, or address", "output": "Name, age, partial phone numbers, associated addresses", "opsec": "passive", - "opsecNote": "Free basic searches; detailed reports require Intelius subscription", + "opsecNote": "Free basic searches; detailed reports require Intelius subscription.", "localInstall": false, "googleDork": false, "registration": false, @@ -8795,7 +9050,7 @@ "input": "Uploaded face photograph", "output": "Matching profiles, social media accounts, news articles, mugshots", "opsec": "active", - "opsecNote": "Uploaded images are processed server-side; free tier has limited results, credits required for full access", + "opsecNote": "Uploaded images are processed server-side; free tier has limited results, credits required for full access.", "localInstall": false, "googleDork": false, "registration": false, @@ -8834,14 +9089,14 @@ "name": "The Knot", "type": "url", "url": "https://www.theknot.com/registry/couplesearch", - "description": "Wedding registry search allowing lookup of couples wedding registries by name. Part of The Knot comprehensive wedding planning platform.", + "description": "Wedding registry search allowing lookup of couples' wedding registries by name. Part of The Knot comprehensive wedding planning platform.", "status": "live", "pricing": "free", "bestFor": "Finding wedding registries by couple name", "input": "Couple first and last names", "output": "Wedding registry links and gift lists", "opsec": "passive", - "opsecNote": "Public search; no registration required", + "opsecNote": "Public search; no registration required.", "localInstall": false, "googleDork": false, "registration": false, @@ -8861,7 +9116,7 @@ "input": "Registrant first and last name", "output": "Registry links across multiple retailers", "opsec": "passive", - "opsecNote": "No registration required; revenue from affiliate commissions", + "opsecNote": "No registration required; revenue from affiliate commissions.", "localInstall": false, "googleDork": false, "registration": false, @@ -8881,7 +9136,7 @@ "input": "Registrant name", "output": "Unified gift registry with items from multiple stores", "opsec": "passive", - "opsecNote": "Free registry search; account needed to create registries; has developer portal", + "opsecNote": "Free registry search; account needed to create registries.", "localInstall": false, "googleDork": false, "registration": false, @@ -8894,14 +9149,14 @@ "name": "Amazon Registry Search", "type": "url", "url": "https://www.amazon.com/registries", - "description": "Amazon gift registry search for wedding, baby, and other registries. Original URL returns 404; registries moved to /registries path.", + "description": "Amazon gift registry search for wedding, baby, and other registries.", "status": "degraded", "pricing": "free", "bestFor": "Finding Amazon gift registries by name", "input": "Registrant name", "output": "Amazon gift registry links and wish lists", "opsec": "passive", - "opsecNote": "Amazon account may be required; original URL returns 404, registries moved to /registries", + "opsecNote": "Amazon account may be required for full access.", "localInstall": false, "googleDork": false, "registration": false, @@ -8910,26 +9165,6 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "Bed, Bath, & Beyond Gift Registry", - "type": "url", - "url": "https://www.bedbathandbeyond.com/store/giftregistry/registry_search_guest.jsp", - "description": "Former gift registry from Bed Bath & Beyond. Company filed Chapter 11 bankruptcy April 2023; domain acquired by Beyond Inc. Gift registry no longer exists.", - "status": "down", - "pricing": "free", - "bestFor": "Gift registry search (defunct)", - "input": "Registrant name", - "output": "N/A \u2014 service discontinued", - "opsec": "Unknown", - "opsecNote": "Company bankrupt; domain redirects to Beyond Inc. e-commerce site", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": true - }, { "name": "The Bump", "type": "url", @@ -8941,7 +9176,7 @@ "input": "Parent first and last name", "output": "Baby registry links and gift lists", "opsec": "passive", - "opsecNote": "No registration required to search registries", + "opsecNote": "No registration required to search registries.", "localInstall": false, "googleDork": false, "registration": false, @@ -9689,27 +9924,102 @@ { "name": "Melissa Data - Property Viewer (R)", "type": "url", - "url": "https://www.melissa.com/" + "url": "https://melissa-data.com", + "description": "Commercial property lookup and real estate information provider with verified tax assessor data. Requires registration and payment for detailed property records.", + "status": "live", + "pricing": "paid", + "bestFor": "Property ownership verification", + "input": "Address or property ID", + "output": "Property details, tax info, ownership history", + "opsec": "passive", + "opsecNote": "Commercial service; creates footprint", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Regrid (US Only)", "type": "url", - "url": "https://app.regrid.com/us/" + "url": "https://regrid.com", + "description": "Interactive property mapping and parcel data tool covering most US counties. Provides parcel boundaries, assessment data, and ownership information.", + "status": "live", + "pricing": "freemium", + "bestFor": "Parcel mapping and property boundaries", + "input": "Address, parcel number, or map coordinates", + "output": "Parcel maps, ownership, assessment data", + "opsec": "passive", + "opsecNote": "US-only coverage; free tier limited", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Emporis", "type": "url", - "url": "https://www.emporis.com/" + "url": "https://www.emporis.com/", + "description": "Buildings database and information portal. DEPRECATED - closed September 2022 by CoStar Group.", + "status": "down", + "pricing": "paid", + "bestFor": "N/A - Service shutdown", + "input": "N/A", + "output": "N/A", + "opsec": "Unknown", + "opsecNote": "Service discontinued September 2022", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Neighbor Report", "type": "url", - "url": "https://neighbor.report/" + "url": "https://neighbor.report/", + "description": "Neighborhood and property statistics including crime data, schools, and community information. Aggregates public data into neighborhood profiles.", + "status": "live", + "pricing": "free", + "bestFor": "Neighborhood demographics and safety", + "input": "Address or zip code", + "output": "Crime stats, schools, community data", + "opsec": "passive", + "opsecNote": "Public aggregator, no footprint concerns", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Redfin", "type": "url", - "url": "https://www.redfin.com/" + "url": "https://redfin.com", + "description": "Real estate marketplace with comprehensive property history, MLS data, and market analytics. Includes tax history and public records.", + "status": "live", + "pricing": "free", + "bestFor": "Property history and market data", + "input": "Address or property ID", + "output": "Sale history, price trends, tax info", + "opsec": "passive", + "opsecNote": "Public real estate platform", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9720,97 +10030,382 @@ { "name": "Nationwide County Court Records", "type": "url", - "url": "https://www.blackbookonline.info/USA-County-Court-Records.aspx" + "url": "https://www.publicrecordcenter.com/onlinecourtrecords.htm", + "description": "Directory and aggregator linking to county court record systems across the United States. Provides navigation to local court databases.", + "status": "live", + "pricing": "free", + "bestFor": "Locating county court records", + "input": "County name and state", + "output": "Links to county court systems", + "opsec": "passive", + "opsecNote": "Aggregator of public court links", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "World Legal Information Institute", "type": "url", - "url": "https://worldlii.org/" + "url": "https://worldlii.org", + "description": "International legal database aggregating laws, regulations, and court decisions from 140+ countries. Free access to legal documents.", + "status": "live", + "pricing": "free", + "bestFor": "International legal research", + "input": "Jurisdiction, case name, statute", + "output": "Court decisions, laws, regulations", + "opsec": "passive", + "opsecNote": "Academic/government source", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Most Wanted Criminal Pages", "type": "url", - "url": "https://ancestorhunt.com/most-wanted-criminals-and-fugitives.htm" + "url": "https://www.fbi.gov/wanted/fugitives", + "description": "FBI's official wanted fugitives database featuring the Ten Most Wanted list and expanded fugitive database with photos and details.", + "status": "live", + "pricing": "free", + "bestFor": "Wanted fugitive identification", + "input": "Name, photo description", + "output": "Fugitive profiles, photos, rewards", + "opsec": "passive", + "opsecNote": "Official FBI resource", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Black Book Online - Criminal Search", "type": "url", - "url": "https://www.blackbookonline.info/criminalsearch.aspx" + "url": "https://www.blackbookonline.info/", + "description": "Free public records search portal covering 37,000+ types of records including criminal records, court records, property records, and background checks.", + "status": "live", + "pricing": "free", + "bestFor": "Broad public records aggregation", + "input": "Name, location, record type", + "output": "Criminal records, property, court filings", + "opsec": "passive", + "opsecNote": "Not FCRA compliant; accuracy not guaranteed", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CrimeReports.com", "type": "url", - "url": "https://www.crimereports.com/" + "url": "https://crimereports.com", + "description": "Real-time crime reporting map aggregating incident data from law enforcement agencies. Interactive map with searchable crime statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Crime incident mapping", + "input": "Address or area", + "output": "Crime incidents, type, date, location", + "opsec": "passive", + "opsecNote": "Public law enforcement data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Familywatchdog - Sex Offender Search", "type": "url", - "url": "https://www.familywatchdog.us/" + "url": "https://www.familywatchdog.us/", + "description": "Free sex offender registry aggregator combining data from all US state registries. Interactive mapping of registered offenders.", + "status": "live", + "pricing": "free", + "bestFor": "Sex offender registry search", + "input": "Name or address", + "output": "Offender registry info, photo, location", + "opsec": "passive", + "opsecNote": "Public registry aggregation", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "The Inmate Locator", "type": "url", - "url": "https://theinmatelocator.com/" + "url": "https://www.bop.gov/inmateloc/", + "description": "Federal Bureau of Prisons official inmate search tool. Covers federal inmates incarcerated from 1982 to present with daily updates.", + "status": "live", + "pricing": "free", + "bestFor": "Federal inmate location", + "input": "Name or BOP register number", + "output": "Location, release date, facility", + "opsec": "passive", + "opsecNote": "Official federal database", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "National Sex Offender Search", "type": "url", - "url": "https://www.nsopw.gov/search-public-sex-offender-registries" + "url": "https://www.nsopw.gov/", + "description": "Official National Sex Offender Public Website aggregating state registry data. Comprehensive multi-state sex offender search tool.", + "status": "live", + "pricing": "free", + "bestFor": "National sex offender search", + "input": "Name, address, jurisdiction", + "output": "Registry info, photo, address", + "opsec": "passive", + "opsecNote": "Official government aggregator", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Mugshots.com", "type": "url", - "url": "https://mugshots.com/" + "url": "https://mugshots.com", + "description": "Searchable mugshot database aggregating arrest records and booking photos from law enforcement agencies nationwide.", + "status": "live", + "pricing": "free", + "bestFor": "Arrest record and mugshot lookup", + "input": "Name, location", + "output": "Mugshot, charges, arrest info", + "opsec": "passive", + "opsecNote": "Public arrest booking data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "judyrecords", "type": "url", - "url": "https://www.judyrecords.com/" + "url": "https://www.judyrecords.com/", + "description": "Free nationwide court case search engine with 760M+ US court cases. Covers federal and state courts with 10x more cases than PACER.", + "status": "live", + "pricing": "free", + "bestFor": "Nationwide court case search", + "input": "Case name, parties, docket number", + "output": "Court documents, docket info, filings", + "opsec": "passive", + "opsecNote": "Public domain court records", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Caselaw Access Project", "type": "url", - "url": "https://case.law/" + "url": "https://case.law/", + "description": "Harvard-hosted comprehensive free legal database with 6M+ court opinions. Digitized legal decisions from centuries of US case law.", + "status": "live", + "pricing": "free", + "bestFor": "Historical legal opinion research", + "input": "Case name, court, year range", + "output": "Full text opinions, citations", + "opsec": "passive", + "opsecNote": "Academic/nonprofit source", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CourtListener", "type": "url", - "url": "https://www.courtlistener.com/" + "url": "https://courtlistener.com/", + "description": "Free legal research platform with millions of opinions, dockets, and RECAP data from US federal and appellate courts.", + "status": "live", + "pricing": "free", + "bestFor": "Federal court opinion and docket search", + "input": "Case name, docket number, judge", + "output": "Opinions, dockets, documents", + "opsec": "passive", + "opsecNote": "Nonprofit legal research platform", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Docket Alarm", "type": "url", - "url": "https://www.docketalarm.com/" + "url": "https://docketalarm.com", + "description": "Federal and state litigation docket tracking and analysis. Free PACER alternative with real-time docket updates and case tracking.", + "status": "live", + "pricing": "freemium", + "bestFor": "Litigation docket tracking", + "input": "Case name or docket number", + "output": "Docket filings, case status", + "opsec": "passive", + "opsecNote": "Incorporates free and paid PACER data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Scholar Case Law", "type": "url", - "url": "https://scholar.google.com/" + "url": "https://scholar.google.com/scholar_courts", + "description": "Google's free legal research tool indexing millions of court opinions from US federal and state courts.", + "status": "live", + "pricing": "free", + "bestFor": "Quick case law lookup", + "input": "Case name, citation, party", + "output": "Case opinions, related cases", + "opsec": "passive", + "opsecNote": "Google service - tracks searches", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PACER", "type": "url", - "url": "https://pacer.uscourts.gov/" + "url": "https://pacer.uscourts.gov/", + "description": "Public Access to Court Electronic Records. Official US federal court records system with fee-based access to documents.", + "status": "live", + "pricing": "paid", + "bestFor": "Official federal court documents", + "input": "Case number, party name", + "output": "Court documents, dockets, filings", + "opsec": "passive", + "opsecNote": "$0.10/page cost; registration required", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Free Law RECAP Archive", "type": "url", - "url": "https://www.courtlistener.com/recap/" + "url": "https://www.courtlistener.com/recap/", + "description": "Free archive of PACER documents crowdsourced by Free Law Project. Contains millions of federal court documents without per-page fees.", + "status": "live", + "pricing": "free", + "bestFor": "Free federal court documents", + "input": "Docket number or case name", + "output": "Court documents, PACER filings", + "opsec": "passive", + "opsecNote": "Crowdsourced PACER data via CourtListener", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "UniCourt", "type": "url", - "url": "https://unicourt.com/" + "url": "https://unicourt.com/", + "description": "Free nationwide litigation database and docket analyzer. Aggregates state and federal court records with smart search and case tracking.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-state litigation search", + "input": "Case name, parties, docket number", + "output": "Dockets, filings, case details", + "opsec": "passive", + "opsecNote": "Free PACER alternative with additional data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Federal Inmate Locator", "type": "url", - "url": "https://www.bop.gov/inmateloc/" + "url": "https://www.bop.gov/inmateloc/", + "description": "Bureau of Prisons official inmate search tool covering federal inmates 1982-present. Daily database updates with release dates.", + "status": "live", + "pricing": "free", + "bestFor": "Federal inmate location and release dates", + "input": "Name or BOP register number", + "output": "Inmate location, facility, release date", + "opsec": "passive", + "opsecNote": "Official federal database, daily updates", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Epstein Exposed", "type": "url", - "url": "https://epsteinexposed.com" + "url": "https://epsteinexposed.com/", + "description": "Comprehensive searchable database of Epstein case documents including court records, flight logs, emails, and financial records.", + "status": "live", + "pricing": "free", + "bestFor": "Epstein case document research", + "input": "Name, document type, keyword", + "output": "Court docs, emails, flight logs, connections", + "opsec": "passive", + "opsecNote": "Public records aggregation; includes network analysis", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9821,17 +10416,62 @@ { "name": "NC Salary DB", "type": "url", - "url": "https://www.newsobserver.com/news/databases/state-pay/" + "url": "https://www.ncosc.gov/public-information/state-employee-salary-database", + "description": "Official North Carolina state employee salary database. Published by Office of State Controller for transparency.", + "status": "live", + "pricing": "free", + "bestFor": "NC public employee salary lookup", + "input": "Employee name, agency", + "output": "Salary, agency, position", + "opsec": "passive", + "opsecNote": "Official state publication", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Gov Data Canada", "type": "url", - "url": "https://govdataca.com/" + "url": "https://open.canada.ca/data/en/dataset", + "description": "Government of Canada Open Data Portal. Federal open data including demographics, business info, and statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Canadian federal public data", + "input": "Dataset name, keyword", + "output": "Open datasets, addresses, business data", + "opsec": "passive", + "opsecNote": "Official federal open data portal", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CA Salary DB", "type": "url", - "url": "https://www.sacbee.com/news/databases/state-pay/article229468549.html" + "url": "https://transparentcalifornia.com/", + "description": "Comprehensive California government salary database covering state, local, schools, universities, and special districts.", + "status": "live", + "pricing": "free", + "bestFor": "California public employee salary lookup", + "input": "Name, employer, position", + "output": "Salary, benefits, employer", + "opsec": "passive", + "opsecNote": "Transparency-focused public records", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9842,17 +10482,62 @@ { "name": "BIN Base", "type": "url", - "url": "https://www.binbase.com/search.html" + "url": "https://www.buybindatabase.binbase.com/", + "description": "Business Identification Number database for company registration lookups. Provides business registration and compliance information.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business registration verification", + "input": "Company name or BIN", + "output": "Business registration, status, details", + "opsec": "passive", + "opsecNote": "Commercial company database", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "VAT Research", "type": "url", - "url": "https://vat-search.eu/" + "url": "https://www.belastingdienst.nl/", + "description": "Netherlands tax authorities (Belastingdienst) database. Allows VAT number verification through VIES system.", + "status": "live", + "pricing": "free", + "bestFor": "Dutch VAT number verification", + "input": "VAT number or company name", + "output": "VAT status, registration, business info", + "opsec": "passive", + "opsecNote": "Official Dutch tax authority", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NETR Online", "type": "url", - "url": "https://publicrecords.netronline.com/" + "url": "https://publicrecords.netronline.com/", + "description": "Nationwide property records portal linking to county assessors and county recorders. Provides property tax, deed, and parcel data.", + "status": "live", + "pricing": "free", + "bestFor": "County property records aggregation", + "input": "Address, county name, owner name", + "output": "Property deeds, tax records, assessments", + "opsec": "passive", + "opsecNote": "Links to county systems; coverage varies", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9863,7 +10548,22 @@ { "name": "Sorted by Birth Date", "type": "url", - "url": "https://sortedbybirthdate.com/" + "url": "https://www.bop.gov/inmateloc/", + "description": "Refers to inmate search filters available in state and federal inmate databases. Searchable by date of birth field.", + "status": "live", + "pricing": "free", + "bestFor": "Inmate lookup by birth date", + "input": "Date of birth, state/federal system", + "output": "Inmate records, location, release date", + "opsec": "passive", + "opsecNote": "Feature of various inmate databases", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9874,17 +10574,62 @@ { "name": "Death Check", "type": "url", - "url": "https://www.melissa.com/" + "url": "https://www.deathindexes.com/", + "description": "Directory of online death indexes, obituaries, and cemetery records. Aggregates links to state and national obituary databases.", + "status": "live", + "pricing": "free", + "bestFor": "Death record and obituary lookup", + "input": "Name, location, date range", + "output": "Obituaries, death certificates, dates", + "opsec": "passive", + "opsecNote": "Aggregator of public death records", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Find A Grave", "type": "url", - "url": "https://www.findagrave.com/" + "url": "https://www.findagrave.com/", + "description": "Largest online cemetery database with 615M+ grave records from 250M+ graves in 500K+ cemeteries worldwide.", + "status": "live", + "pricing": "free", + "bestFor": "Cemetery and burial record search", + "input": "Name, cemetery, location", + "output": "Grave location, photos, dates", + "opsec": "passive", + "opsecNote": "User-contributed genealogical data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "GraveInfo", "type": "url", - "url": "https://www.graveinfo.com/" + "url": "https://billiongraves.com/", + "description": "Cemetery records database with GPS-marked grave locations and gravestone photos. Aggregates cemetery information with mobile crowdsourcing.", + "status": "live", + "pricing": "freemium", + "bestFor": "GPS cemetery mapping", + "input": "Name, cemetery, location", + "output": "Grave location, coordinates, photos", + "opsec": "passive", + "opsecNote": "Crowdsourced cemetery photographs", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9895,7 +10640,22 @@ { "name": "NACo County Explorer", "type": "url", - "url": "https://explorer.naco.org/index.html" + "url": "https://explorer.naco.org/", + "description": "Interactive mapping tool with 1000+ demographic and economic indicators for all 3,069 US counties. National Association of Counties data portal.", + "status": "live", + "pricing": "free", + "bestFor": "County-level demographic analysis", + "input": "County name, data indicator", + "output": "Demographics, economics, health, education", + "opsec": "passive", + "opsecNote": "Public aggregated county data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9906,7 +10666,22 @@ { "name": "Voter Registration Data", "type": "url", - "url": "https://www.blackbookonline.info/USA-Voter-Records.aspx" + "url": "https://www.sos.secretary.state.gov/", + "description": "State-level voter registration databases. Varies significantly by state in coverage and access methods.", + "status": "live", + "pricing": "free", + "bestFor": "Voter registration verification", + "input": "Name, state, county", + "output": "Registration status, voting history", + "opsec": "passive", + "opsecNote": "State-specific access and restrictions vary", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9917,12 +10692,42 @@ { "name": "US Patent Office Search", "type": "url", - "url": "https://www.uspto.gov/patents/search" + "url": "https://www.uspto.gov/patents/search", + "description": "Official US Patent and Trademark Office searchable patent database. Covers US patents and applications.", + "status": "live", + "pricing": "free", + "bestFor": "US patent search", + "input": "Patent number, inventor name, keyword", + "output": "Patent documents, claims, assignee info", + "opsec": "passive", + "opsecNote": "Official USPTO database", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Patent Search", "type": "url", - "url": "https://patents.google.com/advanced" + "url": "https://patents.google.com/", + "description": "Google's searchable patent database covering US, EU, WIPO and other international patents. Full-text search with categorization.", + "status": "live", + "pricing": "free", + "bestFor": "International patent research", + "input": "Patent number, inventor, keyword, CPC", + "output": "Patent docs, citations, families", + "opsec": "passive", + "opsecNote": "Google service tracks searches", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -9933,59 +10738,224 @@ { "name": "Political MoneyLine", "type": "url", - "url": "https://info.cq.com/" + "url": "https://www.opensecrets.org/", + "description": "Campaign finance and political money database aggregating federal election contributions and lobbying data.", + "status": "live", + "pricing": "free", + "bestFor": "Campaign finance and lobbying tracking", + "input": "Candidate name, donor, committee", + "output": "Contributions, expenditures, disclosures", + "opsec": "passive", + "opsecNote": "OpenSecrets nonprofit database", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MelissaData - Campaign Contributions", "type": "url", - "url": "https://www.melissa.com/" + "url": "https://melissa-data.com", + "description": "Commercial campaign contribution database with verified donor and contribution records. Requires subscription.", + "status": "live", + "pricing": "paid", + "bestFor": "Verified campaign donation records", + "input": "Donor name, candidate, date range", + "output": "Contributions, amounts, recipients", + "opsec": "passive", + "opsecNote": "Commercial data service; subscription required", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Influence Explorer", "type": "url", - "url": "https://data.influenceexplorer.com/#" + "url": "https://influenceexplorer.com/", + "description": "Campaign finance, lobbying, and political data aggregator. Part of OpenSecrets ecosystem with federal and state data.", + "status": "live", + "pricing": "free", + "bestFor": "Political influence and money tracking", + "input": "Name, organization, industry", + "output": "Political contributions, lobbying, connections", + "opsec": "passive", + "opsecNote": "OpenSecrets-affiliated nonprofit", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "US Federal Election Commission", "type": "url", - "url": "https://www.fec.gov/data/" + "url": "https://fec.gov/data", + "description": "Official Federal Election Commission data portal. Searchable federal campaign finance disclosures and election data.", + "status": "live", + "pricing": "free", + "bestFor": "Federal campaign finance records", + "input": "Candidate, committee, donor name", + "output": "Contributions, expenditures, disclosures", + "opsec": "passive", + "opsecNote": "Official government source", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Every Politician", "type": "url", - "url": "https://everypolitician.org:443/" + "url": "https://everypolitician.org/", + "description": "Open data project aggregating politician information globally. Structured data on politicians, positions, and affiliations.", + "status": "live", + "pricing": "free", + "bestFor": "Global politician data and positions", + "input": "Politician name, country, position", + "output": "Bio, positions, affiliations, contact", + "opsec": "passive", + "opsecNote": "Crowdsourced open government data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "Public Records?", "type": "url", - "url": "https://publicrecords.searchsystems.net/" + "url": "https://www.brbpublications.com/", + "description": "Ambiguous entry - likely refers to BRB Publications' public records portal or aggregator. See BRB Public Records below for clarification.", + "status": "live", + "pricing": "free", + "bestFor": "Unclear - requires VP clarification", + "input": "Unknown", + "output": "Unknown", + "opsec": "Unknown", + "opsecNote": "FLAG: Ambiguous tool name; VP guidance needed", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "The World Bank Open Data Catalog", "type": "url", - "url": "https://datacatalog.worldbank.org/" + "url": "https://datacatalog.worldbank.org/", + "description": "World Bank open development data portal with datasets on economics, demographics, and global development indicators.", + "status": "live", + "pricing": "free", + "bestFor": "Development data and statistics", + "input": "Country, indicator, dataset name", + "output": "Economic, social, health data", + "opsec": "passive", + "opsecNote": "Official World Bank datasets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BRB Public Records", "type": "url", - "url": "https://www.brbpub.com/" + "url": "https://www.brbpublications.com/", + "description": "BRB Publications portal linking to public records sources across US. Reference guide with 20K+ government agencies and vendors.", + "status": "live", + "pricing": "freemium", + "bestFor": "Public records source directory", + "input": "Record type, jurisdiction", + "output": "Agency links, access instructions", + "opsec": "passive", + "opsecNote": "Aggregator of public access links", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { - "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", + "name": "GOVDATA - Das Datenportal für Deutschland (German)", "type": "url", - "url": "https://www.govdata.de/" + "url": "https://www.govdata.de/", + "description": "Official German government open data portal with 120K+ datasets. Centralized access to federal, state, and local administrative data.", + "status": "live", + "pricing": "free", + "bestFor": "German administrative data", + "input": "Dataset name, keyword, category", + "output": "Open datasets, metadata, downloads", + "opsec": "passive", + "opsecNote": "Official German government portal", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { - "name": "Open-Data-Portal M\u00fcnchen (German)", + "name": "Open-Data-Portal München (German)", "type": "url", - "url": "https://www.opengov-muenchen.de/" + "url": "https://opendata.muenchen.de/", + "description": "City of Munich open data portal with 331+ datasets. Provides administrative data from Munich government at city level.", + "status": "live", + "pricing": "free", + "bestFor": "Munich municipal administrative data", + "input": "Dataset name, category, keyword", + "output": "City datasets, statistics, services", + "opsec": "passive", + "opsecNote": "Official Munich city data portal", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Searchable FCC ID Database", "type": "url", - "url": "https://fccid.io/" + "url": "https://www.fcc.gov/oet/ea/fccid", + "description": "Official FCC database for electronic device certification. Searchable by FCC ID with product specs, manuals, and test reports.", + "status": "live", + "pricing": "free", + "bestFor": "Electronics device certification lookup", + "input": "FCC ID, device model, manufacturer", + "output": "Device specs, manuals, test reports, photos", + "opsec": "passive", + "opsecNote": "Official FCC database", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -10227,12 +11197,12 @@ "url": "https://www.brbpub.com/" }, { - "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", + "name": "GOVDATA - Das Datenportal für Deutschland (German)", "type": "url", "url": "https://www.govdata.de/" }, { - "name": "Open-Data-Portal M\u00fcnchen (German)", + "name": "Open-Data-Portal München (German)", "type": "url", "url": "https://www.opengov-muenchen.de/" }, @@ -14920,22 +15890,82 @@ { "name": "Genymotion (T)", "type": "url", - "url": "https://www.genymotion.com/" + "url": "https://www.genymotion.com/", + "status": "live", + "pricing": "freemium", + "description": "Cloud-based and desktop Android emulator platform for app testing and forensic analysis. Supports multi-instance deployment and integration with security testing tools.", + "bestFor": "Testing mobile apps, forensic analysis, multi-device simulation", + "input": "APK files, app bundles", + "output": "Runtime behavior, app data artifacts, system logs", + "opsec": "active", + "opsecNote": "Genymotion generates detectable device signatures; fingerprinting tools may identify it as emulated", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BlueStacks 2 (T)", "type": "url", - "url": "https://www.bluestacks.com/" + "url": "https://www.bluestacks.com/", + "status": "live", + "pricing": "free", + "description": "Free, lightweight Android emulator for desktop. Includes built-in forensic capabilities for data extraction from installed apps.", + "bestFor": "Quick Android testing, forensic artifact extraction, app analysis", + "input": "APK files, installed apps", + "output": "App data, SQLite databases, shared preferences, file system artifacts", + "opsec": "active", + "opsecNote": "Emulator detection possible via device properties and system checks", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Nox App Player", "type": "url", - "url": "https://www.bignox.com/" + "url": "https://www.bignox.com/", + "status": "live", + "pricing": "free", + "description": "Free Android emulator with support for multiple Android versions and root access. Used for app analysis and testing.", + "bestFor": "Android version testing, app analysis, rooted device simulation", + "input": "APK files, apps", + "output": "App behavior, system-level data, rooted access artifacts", + "opsec": "active", + "opsecNote": "Detectable via emulator checks; includes obvious emulator markers", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Apk Online", "type": "url", - "url": "https://www.apkonline.net/" + "url": "https://apk.online/", + "status": "live", + "pricing": "free", + "description": "Browser-based tool for analyzing and downloading APK files. Allows viewing app permissions, features, and metadata without installation.", + "bestFor": "Quick APK analysis, permission review, app feature reconnaissance", + "input": "App package names or APK files", + "output": "APK downloads, permission lists, app metadata, manifest data", + "opsec": "passive", + "opsecNote": "No installation required; passive reconnaissance only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -14950,22 +15980,82 @@ { "name": "Facebook (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.facebook.katana" + "url": "https://www.facebook.com/", + "status": "live", + "pricing": "free", + "description": "Major social network with over 2 billion users. Primary target for social OSINT and profile reconnaissance.", + "bestFor": "Profile reconnaissance, relationship mapping, photo analysis, location tracking", + "input": "Usernames, profile URLs, phone numbers, email addresses", + "output": "Profile data, friend networks, photos, location history, activity timeline", + "opsec": "active", + "opsecNote": "Facebook monitors and blocks suspicious activity patterns; tool-based scraping is easily detected", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "LinkedIn (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.linkedin.android" + "url": "https://www.linkedin.com/", + "status": "live", + "pricing": "freemium", + "description": "Professional social network with 900M+ users. Key source for professional identity verification and corporate structure mapping.", + "bestFor": "Professional background verification, corporate reconnaissance, employment history research", + "input": "Usernames, email domains, company names", + "output": "Professional profiles, employment history, connections, company structure", + "opsec": "active", + "opsecNote": "LinkedIn actively blocks scraping tools and monitors for bulk data collection", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Twitter (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.twitter.android" + "url": "https://www.twitter.com/", + "status": "live", + "pricing": "free", + "description": "Microblogging platform with 500M+ users. Extensive public data, real-time information, and relationship networks.", + "bestFor": "Real-time monitoring, account verification, relationship mapping, sentiment analysis", + "input": "Usernames, hashtags, keywords, user IDs", + "output": "Tweets, user profiles, follower networks, location data, media", + "opsec": "passive", + "opsecNote": "Mostly passive; API-based tools are rate-limited but account scraping can be detected", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Pinterest (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.pinterest" + "url": "https://www.pinterest.com/", + "status": "live", + "pricing": "free", + "description": "Visual discovery platform with 460M+ users. Used for lifestyle, location, and interest-based profiling.", + "bestFor": "Interest profiling, location discovery, lifestyle analysis, image reverse search", + "input": "Usernames, pins, boards, images", + "output": "User profiles, boards, pins, location metadata, follower networks", + "opsec": "passive", + "opsecNote": "Passive reconnaissance; less aggressively monitored than Facebook or LinkedIn", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -14976,42 +16066,162 @@ { "name": "Signal Private Messenger (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=org.thoughtcrime.securesms" + "url": "https://signal.org/", + "status": "live", + "pricing": "free", + "description": "End-to-end encrypted messaging app with 40M+ users. Limited OSINT value due to privacy-first design.", + "bestFor": "Identity verification, account discovery via phone/email, community research", + "input": "Phone numbers, email addresses, usernames", + "output": "Account existence, profile names, avatar images", + "opsec": "passive", + "opsecNote": "Very limited information exposure; encrypted content not accessible", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Riot.im - Communicate, your way (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=im.vector.app" + "url": "https://riot.im/", + "status": "live", + "pricing": "free", + "description": "Open-source Matrix client for decentralized messaging. Limited public data but useful for community monitoring.", + "bestFor": "Open community monitoring, channel discovery, user verification", + "input": "Usernames, community names, room IDs", + "output": "Community membership, user profiles, message history (if public), user activity", + "opsec": "passive", + "opsecNote": "Privacy depends on server configuration; public rooms and communities are openly accessible", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Telegram (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=org.telegram.messenger" + "url": "https://telegram.org/", + "status": "live", + "pricing": "free", + "description": "Messaging platform with 700M+ users. Extensive public data through public channels, groups, and user searches.", + "bestFor": "User discovery, channel monitoring, group reconnaissance, bot creation for data collection", + "input": "Usernames, user IDs, chat links, phone numbers", + "output": "User profiles, channel data, group membership, message history, media", + "opsec": "passive", + "opsecNote": "Public channels and users are accessible without authentication; bot development requires API key", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Snapchat (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.snapchat.android" + "url": "https://www.snapchat.com/", + "status": "live", + "pricing": "free", + "description": "Ephemeral messaging app with 400M+ users. Limited historical data due to auto-deletion, but real-time activity visible.", + "bestFor": "User verification, story analysis, location tracking via snap maps, relationship mapping", + "input": "Usernames, Snapcodes, phone numbers", + "output": "User profiles, story content, snap maps, friend networks", + "opsec": "active", + "opsecNote": "Snapchat actively detects and blocks third-party clients; API access is restricted", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WhatsApp Messenger (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.whatsapp" + "url": "https://www.whatsapp.com/", + "status": "live", + "pricing": "free", + "description": "Messaging platform with 2B+ users. End-to-end encrypted, but profile data and metadata are accessible.", + "bestFor": "User verification, profile discovery, status updates, contact verification", + "input": "Phone numbers, WhatsApp IDs", + "output": "User profiles, status messages, profile pictures, last-seen timestamps, online status", + "opsec": "passive", + "opsecNote": "No official API for OSINT; third-party tools easily detected and account-banned", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Kik (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=kik.android" + "url": "https://www.kik.com/", + "status": "live", + "pricing": "free", + "description": "Messaging app with 300M+ registered users. Public username search and profile visibility.", + "bestFor": "User discovery, profile analysis, public username search", + "input": "Usernames, user handles", + "output": "User profiles, status, profile pictures, user discovery", + "opsec": "passive", + "opsecNote": "Public search available; less monitored than major platforms", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Yik Yak (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.yik.yak" + "url": "https://www.yikyak.com/", + "status": "live", + "pricing": "free", + "description": "Anonymous location-based social network. Public posts visible by location, useful for community sentiment and event tracking.", + "bestFor": "Location-based event monitoring, community sentiment analysis, anonymity assessment", + "input": "Location coordinates, proximity radius", + "output": "Anonymous posts, location data, user engagement, community trends", + "opsec": "passive", + "opsecNote": "Designed for anonymity; minimal PII exposure, but location data and timing can reveal patterns", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "LINE (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=jp.naver.line.android" + "url": "https://line.me/", + "status": "live", + "pricing": "free", + "description": "Messaging app with 200M+ users, dominant in Asia. User search and public profile visibility.", + "bestFor": "Asian market user discovery, profile analysis, account verification", + "input": "User IDs, phone numbers, LINE accounts", + "output": "User profiles, status messages, timeline data, friends list", + "opsec": "passive", + "opsecNote": "Public profile search available; varies by region and privacy settings", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -15022,12 +16232,42 @@ { "name": "Instagram (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.instagram.android" + "url": "https://www.instagram.com/", + "status": "live", + "pricing": "free", + "description": "Photo and video sharing platform with 2B+ users. Extensive visual OSINT and metadata analysis.", + "bestFor": "Visual reconnaissance, metadata analysis, location tracking via geotagging, relationship mapping", + "input": "Usernames, hashtags, locations, profile URLs", + "output": "User profiles, photos, videos, captions, location data, follower networks", + "opsec": "active", + "opsecNote": "Instagram aggressively blocks scraping tools; bulk data collection easily detected", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Flickr (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.yahoo.mobile.client.android.flickr" + "url": "https://www.flickr.com/", + "status": "live", + "pricing": "freemium", + "description": "Photo hosting and sharing platform with 200M+ photos. Extensive metadata and location data.", + "bestFor": "Photo metadata analysis, EXIF data extraction, location tracking, photographer identification", + "input": "Usernames, tags, locations, URLs", + "output": "Photos, metadata, EXIF data, location coordinates, user profiles", + "opsec": "passive", + "opsecNote": "Passive access to public photos; metadata freely available", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -15038,24 +16278,84 @@ { "name": "Periscope (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=tv.periscope.android" + "url": "https://www.periscope.tv/", + "status": "live", + "pricing": "free", + "description": "Live video streaming app merged into Twitter. Limited standalone value; functionality integrated into Twitter.", + "bestFor": "Live event monitoring, real-time location tracking (via broadcast metadata), community monitoring", + "input": "Broadcast URLs, user handles, search keywords", + "output": "Broadcast data, viewer information, location metadata, broadcast archives", + "opsec": "passive", + "opsecNote": "Functionality largely superseded by Twitter; limited independent OSINT utility", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Meerkat (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=co.getair.meerkat" + "url": "https://meerkatapp.co/", + "status": "live", + "pricing": "free", + "description": "Live streaming social app. Currently dormant with minimal active users; historical value for archived streams.", + "bestFor": "Legacy stream archives, historical event analysis", + "input": "Stream URLs, user profiles, timestamps", + "output": "Archived streams, viewer data, user activity logs", + "opsec": "unknown", + "opsecNote": "Service is largely dormant; limited active OSINT value", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Vine (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=co.vine.android" + "url": "https://vine.co/", + "status": "down", + "pricing": "free", + "description": "Short-form video platform shut down by Twitter in January 2017. No longer operational.", + "bestFor": "Historical video archives only (via archive services)", + "input": "Archived Vine URLs, video IDs", + "output": "Historical video data via Internet Archive or similar services", + "opsec": "unknown", + "opsecNote": "Platform is defunct; only accessible via web archives", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, { "name": "Truecaller (T)", "type": "url", - "url": "https://play.google.com/store/apps/details?id=com.truecaller" + "url": "https://www.truecaller.com/", + "status": "live", + "pricing": "freemium", + "description": "Phone and contact verification app with 500M+ users. Reverse phone lookup and caller ID identification.", + "bestFor": "Phone number verification, caller ID lookup, spam detection, contact validation", + "input": "Phone numbers, contact names", + "output": "Caller name, carrier info, location data, spam reports, contact validation", + "opsec": "passive", + "opsecNote": "Requires app or web access; limited free tier for bulk lookups", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -15068,22 +16368,82 @@ { "name": "APKLeaks", "type": "url", - "url": "https://github.com/dwisiswant0/apkleaks" + "url": "https://github.com/dwisiswant0/apkleaks", + "status": "live", + "pricing": "free", + "description": "Open-source tool that scans APK files for hardcoded secrets, API endpoints, and sensitive information.", + "bestFor": "API endpoint discovery, hardcoded credential detection, sensitive data extraction from APKs", + "input": "APK files", + "output": "Discovered secrets, API endpoints, hardcoded strings, configuration data", + "opsec": "passive", + "opsecNote": "Local analysis only; no network communication required", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "APKtool", "type": "url", - "url": "https://apktool.org/" + "url": "https://apktool.org/", + "status": "live", + "pricing": "free", + "description": "Open-source tool for reverse engineering Android apps. Decompiles APKs to extract resources and bytecode.", + "bestFor": "APK decompilation, resource extraction, smali code analysis, app structure analysis", + "input": "APK files", + "output": "Decompiled source code, resources, manifest data, smali bytecode", + "opsec": "passive", + "opsecNote": "Local analysis only; operates offline on APK files", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "JADX", "type": "url", - "url": "https://github.com/skylot/jadx" + "url": "https://github.com/skylot/jadx", + "status": "live", + "pricing": "free", + "description": "Open-source decompiler (47k+ GitHub stars) that converts DEX bytecode to Java source code. GUI and CLI available.", + "bestFor": "Java source code recovery, app logic analysis, vulnerability assessment, code review", + "input": "APK files, DEX files, class files", + "output": "Java source code, code structure, method signatures, data flow", + "opsec": "passive", + "opsecNote": "Local analysis tool; no network communication", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MobSF", "type": "url", - "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF" + "url": "https://github.com/MobSF/Mobile-Security-Framework-MobSF", + "status": "live", + "pricing": "free", + "description": "Open-source mobile security framework for static and dynamic analysis. Comprehensive vulnerability scanning and artifact extraction.", + "bestFor": "Comprehensive mobile app security analysis, vulnerability assessment, artifact extraction, compliance testing", + "input": "APK files, IPA files, source code", + "output": "Security vulnerabilities, permissions analysis, data flow analysis, forensic artifacts", + "opsec": "passive", + "opsecNote": "Can be deployed locally or on private infrastructure for analysis", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -15094,12 +16454,42 @@ { "name": "Autopsy", "type": "url", - "url": "https://www.autopsy.com/" + "url": "https://www.autopsy.com/", + "status": "live", + "pricing": "free", + "description": "Open-source digital forensics platform. Extracts and analyzes data from mobile devices and disk images.", + "bestFor": "Mobile forensic artifact extraction, database analysis, file system recovery, evidence analysis", + "input": "Device backups, disk images, app databases, file systems", + "output": "SQLite databases, app data, deleted files, timeline analysis, forensic artifacts", + "opsec": "passive", + "opsecNote": "Works on forensic images and backups; no interaction with live devices", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Frida", "type": "url", - "url": "https://frida.re/" + "url": "https://frida.re/", + "status": "live", + "pricing": "free", + "description": "Open-source dynamic instrumentation toolkit. Injects JavaScript to intercept and modify app behavior at runtime.", + "bestFor": "Runtime behavior analysis, API call interception, encryption bypass, behavior modification", + "input": "Running app processes, method signatures, target functions", + "output": "Intercepted method calls, API parameters, return values, runtime state", + "opsec": "active", + "opsecNote": "Requires rooted/jailbroken device or emulator; app-level detection is possible", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -15110,17 +16500,62 @@ { "name": "Charles Proxy", "type": "url", - "url": "https://www.charlesproxy.com/" + "url": "https://www.charlesproxy.com/", + "status": "live", + "pricing": "paid", + "description": "Commercial HTTP/HTTPS proxy for traffic analysis. Captures and analyzes network traffic between apps and servers.", + "bestFor": "Network traffic interception, API endpoint mapping, parameter analysis, encryption analysis", + "input": "Network traffic, SSL/TLS sessions", + "output": "HTTP requests/responses, SSL certificates, decoded payloads, traffic analysis", + "opsec": "active", + "opsecNote": "HTTPS interception requires certificate pinning bypass; easily detected by security-aware apps", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Lynxio OSINT", "type": "url", - "url": "https://apps.apple.com/us/app/lynxio-osint/id6745894335" + "url": "https://lynxio.io/", + "status": "live", + "pricing": "freemium", + "description": "Mobile OSINT search tool for multi-identifier reconnaissance. Searches across phone numbers, email addresses, usernames, and social platforms.", + "bestFor": "Multi-identifier search, quick reconnaissance, phone number lookup, email verification", + "input": "Phone numbers, email addresses, usernames, URLs", + "output": "Associated identifiers, social media profiles, verification results, relationship mapping", + "opsec": "passive", + "opsecNote": "Aggregates public data from multiple sources; passive only", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OSINT Researcher", "type": "url", - "url": "https://apps.apple.com/gy/app/osint-researcher/id6747302251" + "url": "https://apps.apple.com/us/app/osint-researcher/id6747302251", + "status": "live", + "pricing": "free", + "description": "iOS app for GitHub organization reconnaissance and open-source intelligence. Limited to App Store distribution.", + "bestFor": "GitHub OSINT, organization structure analysis, open-source project discovery, team reconnaissance", + "input": "Organization names, GitHub URLs, repository URLs", + "output": "Organization members, repository lists, contribution history, project metadata", + "opsec": "passive", + "opsecNote": "App Store only; limited availability and distribution", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -15943,37 +17378,142 @@ { "name": "Bitcoin Who's Who", "type": "url", - "url": "https://www.bitcoinwhoswho.com/" + "url": "https://www.bitcoinwhoswho.com/", + "description": "Bitcoin address profiling and scam reporting platform with community-driven address tagging for fraud detection and wallet identification.", + "status": "live", + "pricing": "free", + "bestFor": "Bitcoin address scam reports and community tagging", + "input": "Bitcoin address, wallet identifier, or transaction hash", + "output": "Address profile, transaction history, scam reports, community tags", + "opsec": "passive", + "opsecNote": "Direct lookup of public blockchain data; no registration required for basic queries.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BitRef", "type": "url", - "url": "https://bitref.com/" + "url": "https://bitref.com/", + "description": "Bitcoin address balance checker and transaction analyzer supporting address clustering, mempool data, mining statistics, and developer API.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bitcoin address balance lookup and transaction analysis", + "input": "Bitcoin address, transaction ID, or block hash", + "output": "Current balance, transaction history, block data, mempool status", + "opsec": "passive", + "opsecNote": "Public blockchain query via web interface; no account required for basic lookups.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Blockonomics", "type": "url", - "url": "https://www.blockonomics.co/" + "url": "https://www.blockonomics.co/", + "description": "Bitcoin payment API and OSINT platform providing address monitoring, wallet balance tracking, and transaction alerts for developers and enterprises.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bitcoin payment integration and address monitoring for developers", + "input": "Bitcoin address, webhook configuration, or payment tracking setup", + "output": "Balance notifications, transaction alerts via email/webhook, payment confirmations", + "opsec": "passive", + "opsecNote": "Uses public blockchain data; API keys required for monitoring features but basic lookups are unrestricted.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Blockr.io", "type": "url", - "url": "https://blockr.io/" + "url": "https://blockr.io/", + "description": "Legacy Bitcoin blockchain explorer acquired by Coinbase in August 2014 and no longer maintained as standalone service.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only (service discontinued)", + "input": "Bitcoin address or transaction hash (legacy)", + "output": "Service unavailable; rebranded to Coinbase services", + "opsec": "Unknown", + "opsecNote": "Original service is defunct. Users should migrate to Blockchair, Blockchain.com, or Etherscan.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Blocktrail", "type": "url", - "url": "https://www.blocktrail.com/BTC" + "url": "https://www.blocktrail.com/BTC", + "description": "Bitcoin transaction analysis platform acquired by Bitmain in July 2016 and rebranded to BTC.com; original service no longer operational.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only (rebranded to BTC.com)", + "input": "Bitcoin address or transaction (legacy)", + "output": "Service migrated; use BTC.com instead", + "opsec": "Unknown", + "opsecNote": "Original blocktrail.com service is deprecated. Some wallet recovery tools remain but core blockchain explorer moved to BTC.com.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Orbit (T)", "type": "url", - "url": "https://github.com/s0md3v/Orbit" + "url": "https://github.com/s0md3v/Orbit", + "description": "Python CLI tool for Bitcoin wallet network analysis that visualizes transaction relationships through recursive crawling and graph rendering.", + "status": "live", + "pricing": "free", + "bestFor": "Bitcoin transaction network visualization and wallet relationship mapping", + "input": "Bitcoin address(es) via command line; supports single or multiple wallet analysis", + "output": "Interactive graph visualization showing fund flows, transaction frequency, node connections", + "opsec": "active", + "opsecNote": "Makes direct queries to blockchain APIs (configurable). Graph output may leak investigation scope to observers.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Wallet Explorer", "type": "url", - "url": "https://www.walletexplorer.com/" + "url": "https://www.walletexplorer.com/", + "description": "Bitcoin address clustering and wallet linking tool using multi-input heuristics to identify related addresses and track entity-level transaction patterns.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bitcoin address clustering and entity wallet identification", + "input": "Bitcoin address, transaction hash, or entity name search", + "output": "Clustered wallet addresses, transaction patterns, entity profiles, balance summaries", + "opsec": "passive", + "opsecNote": "Analyzes public blockchain data; no registration required for basic lookups.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -15984,42 +17524,162 @@ { "name": "Bitcoin Abuse Database", "type": "url", - "url": "https://bitcoinabuse.com/" + "url": "https://bitcoinabuse.com/", + "description": "Community-curated Bitcoin address abuse database tracking addresses associated with ransomware, fraud, scams, and illicit activities.", + "status": "live", + "pricing": "free", + "bestFor": "Identifying Bitcoin addresses linked to scams and ransomware", + "input": "Bitcoin address to search against abuse reports", + "output": "Abuse reports, report dates, reporter comments, associated crime type classifications", + "opsec": "passive", + "opsecNote": "Public abuse reports from community; service noted to have received 75% spam in past operations. Use with caution for investigative confidence.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bitcoin Who's Who", "type": "url", - "url": "https://www.bitcoinwhoswho.com/" + "url": "https://www.bitcoinwhoswho.com/", + "description": "Bitcoin address profiling and scam reporting platform with community-driven address tagging for fraud detection and wallet identification.", + "status": "live", + "pricing": "free", + "bestFor": "Bitcoin address scam reports and community tagging", + "input": "Bitcoin address, wallet identifier, or transaction hash", + "output": "Address profile, transaction history, scam reports, community tags", + "opsec": "passive", + "opsecNote": "Direct lookup of public blockchain data; no registration required for basic queries.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BitRef", "type": "url", - "url": "https://bitref.com/" + "url": "https://bitref.com/", + "description": "Bitcoin address balance checker and transaction analyzer supporting address clustering, mempool data, mining statistics, and developer API.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bitcoin address balance lookup and transaction analysis", + "input": "Bitcoin address, transaction ID, or block hash", + "output": "Current balance, transaction history, block data, mempool status", + "opsec": "passive", + "opsecNote": "Public blockchain query via web interface; no account required for basic lookups.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Blockchair", "type": "url", - "url": "https://blockchair.com/" + "url": "https://blockchair.com/", + "description": "Multi-chain blockchain explorer supporting 48+ blockchains (Bitcoin, Ethereum, Litecoin, Solana, etc.) with advanced search, SQL-like queries, and privacy-focused design (Tor accessible, no tracking).", + "status": "live", + "pricing": "freemium", + "bestFor": "Cross-chain address and transaction search with privacy-friendly interface", + "input": "Blockchain address, transaction hash, or advanced SQL-like query across chains", + "output": "Transaction history, balance data, token transfers, smart contract events, cross-chain analytics", + "opsec": "passive", + "opsecNote": "Accessible via Tor; does not require registration; minimal tracking or logging. Privacy-oriented design.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Blockscan", "type": "url", - "url": "https://blockscan.com/" + "url": "https://blockscan.com/", + "description": "Multichain EVM blockchain explorer aggregating 25+ EVM-compatible chains with portfolio tracking, real-time data, and in-depth analytics.", + "status": "live", + "pricing": "freemium", + "bestFor": "EVM-chain portfolio aggregation and cross-chain transaction tracking", + "input": "Wallet address across EVM chains or transaction hash", + "output": "Portfolio balances across chains, transaction history, token holdings, DeFi position tracking", + "opsec": "passive", + "opsecNote": "Aggregates data from public blockchain APIs; no account required for basic lookups.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Etherscan", "type": "url", - "url": "https://etherscan.io/" + "url": "https://etherscan.io/", + "description": "Leading blockchain explorer, analytics, and API platform for Ethereum and 60+ EVM-compatible chains with comprehensive smart contract interaction tracking and developer tools.", + "status": "live", + "pricing": "freemium", + "bestFor": "Ethereum and EVM transaction analysis, smart contract inspection, token tracking", + "input": "Ethereum address, transaction hash, smart contract address, token contract", + "output": "Transaction details, smart contract source code, token transfers, holder lists, gas analytics", + "opsec": "passive", + "opsecNote": "Query via web interface or free API (rate-limited); no registration required for basic lookup. API keys enable higher rate limits.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OXT.me", "type": "url", - "url": "https://oxt.me/" + "url": "https://oxt.me/", + "description": "Bitcoin blockchain analysis platform providing address probability scoring, transaction graph visualization, and timeline-based balance analysis for privacy research.", + "status": "live", + "pricing": "free", + "bestFor": "Bitcoin address privacy analysis and transaction probability scoring", + "input": "Bitcoin address or transaction hash", + "output": "Address summary, transaction timeline, balance history, probability-linked wallet analysis, transaction graph", + "opsec": "passive", + "opsecNote": "Public blockchain analysis without registration; part of Samourai Wallet ecosystem.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Wallet Explorer", "type": "url", - "url": "https://www.walletexplorer.com/" + "url": "https://www.walletexplorer.com/", + "description": "Bitcoin address clustering and wallet linking tool using multi-input heuristics to identify related addresses and track entity-level transaction patterns.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bitcoin address clustering and entity wallet identification", + "input": "Bitcoin address, transaction hash, or entity name search", + "output": "Clustered wallet addresses, transaction patterns, entity profiles, balance summaries", + "opsec": "passive", + "opsecNote": "Analyzes public blockchain data; no registration required for basic lookups.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -16030,12 +17690,42 @@ { "name": "DefiLlama", "type": "url", - "url": "https://defillama.com/" + "url": "https://defillama.com/", + "description": "DeFi analytics platform aggregating Total Value Locked (TVL), yields, protocol revenue, and fees across 7000+ protocols on 500+ chains.", + "status": "live", + "pricing": "freemium", + "bestFor": "DeFi protocol TVL comparison and yield aggregation across chains", + "input": "Protocol name, chain identifier, or yield pool search", + "output": "TVL rankings, historical TVL charts, protocol fees, revenue data, yield opportunities, stablecoin supply", + "opsec": "passive", + "opsecNote": "Public DeFi data aggregation; no registration required for dashboard viewing. API access available for extended queries.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Dune Analytics", "type": "url", - "url": "https://dune.com/" + "url": "https://dune.com/", + "description": "Onchain data analytics platform enabling SQL queries against indexed blockchain data for 100+ blockchains with interactive dashboard and visualization tools.", + "status": "live", + "pricing": "freemium", + "bestFor": "Custom blockchain data analysis and dashboard creation via SQL queries", + "input": "SQL queries against blockchain tables; custom dashboard specifications", + "output": "Query results, custom visualizations, shareable dashboards, blockchain analytics insights", + "opsec": "passive", + "opsecNote": "Public web platform; free tier supports publishing dashboards. Queries are indexed by Dune but individual data lookups are transparent.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -16046,7 +17736,22 @@ { "name": "Etherscan", "type": "url", - "url": "https://etherscan.io/" + "url": "https://etherscan.io/", + "description": "Leading blockchain explorer, analytics, and API platform for Ethereum and 60+ EVM-compatible chains with comprehensive smart contract interaction tracking and developer tools.", + "status": "live", + "pricing": "freemium", + "bestFor": "Ethereum and EVM transaction analysis, smart contract inspection, token tracking", + "input": "Ethereum address, transaction hash, smart contract address, token contract", + "output": "Transaction details, smart contract source code, token transfers, holder lists, gas analytics", + "opsec": "passive", + "opsecNote": "Query via web interface or free API (rate-limited); no registration required for basic lookup. API keys enable higher rate limits.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -16057,27 +17762,102 @@ { "name": "Arkham Intelligence", "type": "url", - "url": "https://intel.arkm.com/" + "url": "https://intel.arkm.com/", + "description": "AI-powered blockchain intelligence platform mapping 300+ million address labels and 150K+ entity pages using proprietary Ultra system for entity deanonymization and fund-flow tracking.", + "status": "live", + "pricing": "freemium", + "bestFor": "Institutional-grade cryptocurrency entity mapping and fund-flow analysis", + "input": "Cryptocurrency address, entity name, or organization identifier", + "output": "Entity profile pages, address labels, transaction network visualization, fund-flow tracking, counterparty analysis", + "opsec": "active", + "opsecNote": "Aggregates on-chain and off-chain intelligence; registered users leave account footprint. Government and institutional adoption.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Breadcrumbs.app", "type": "url", - "url": "https://www.breadcrumbs.app/" + "url": "https://www.breadcrumbs.app/", + "description": "Community-powered blockchain analytics platform with fund-flow visualization (PathFinder), address investigation, and crypto transaction network mapping.", + "status": "live", + "pricing": "freemium", + "bestFor": "Crypto fund-flow visualization and transaction relationship mapping", + "input": "Cryptocurrency address (Bitcoin, Ethereum, or other supported chains)", + "output": "Interactive fund-flow graph, incoming/outgoing transaction patterns, related address recommendations, balance summaries", + "opsec": "passive", + "opsecNote": "Public blockchain data visualization; graph relationships may indicate investigation interest to observers.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MetaSleuth", "type": "url", - "url": "https://metasleuth.io/" + "url": "https://metasleuth.io/", + "description": "Cross-chain cryptocurrency tracking and AML platform supporting 13 blockchains with fund-tracing through mixers using time/amount heuristics and network analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Cross-chain fund tracking and mixer analysis for compliance investigations", + "input": "Cryptocurrency address across supported chains (Bitcoin, Ethereum, Solana, TRON, Polygon, etc.)", + "output": "Traced fund paths, mixer exit point detection, heuristic-based wallet linking, transaction timeline, compliance risk scoring", + "opsec": "active", + "opsecNote": "Active investigation platform; registered use may be logged. Used by compliance teams and law enforcement.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MistTrack", "type": "url", - "url": "https://misttrack.io/" + "url": "https://misttrack.io/", + "description": "Comprehensive AML and fund-tracing platform with 400M+ labeled wallet addresses, compliance database integration (OFAC, NBCTF, UK HMT), and real-time monitoring for 100K+ users.", + "status": "live", + "pricing": "freemium", + "bestFor": "Institutional AML compliance and suspicious transaction flagging", + "input": "Wallet address across Bitcoin, Ethereum, BNB, and other supported chains", + "output": "AML risk scoring, address labels from sanctions lists, transaction monitoring alerts, compliance reports, entity investigation", + "opsec": "active", + "opsecNote": "Enterprise compliance platform used by exchanges and regulators; addresses are actively monitored and investigations may be logged.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OFAC Sanctions List Search", "type": "url", - "url": "https://sanctionssearch.ofac.treas.gov/" + "url": "https://sanctionssearch.ofac.treas.gov/", + "description": "Official U.S. Treasury Department tool for searching the Specially Designated Nationals (SDN) list and consolidated sanctions lists using fuzzy-logic name matching.", + "status": "live", + "pricing": "free", + "bestFor": "Checking against U.S. government sanctions list (SDN and consolidated lists)", + "input": "Individual or entity name (fuzzy-matched), alias variations", + "output": "SDN list matches, alternate names, addresses, dates of birth (when available), designation details", + "opsec": "passive", + "opsecNote": "Official government database; searches are not logged against user identity but accessing the government website may be monitored.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -16088,12 +17868,42 @@ { "name": "Monero Blocks", "type": "url", - "url": "https://localmonero.co/blocks/" + "url": "https://localmonero.co/blocks/", + "description": "Monero blockchain explorer displaying blocks, transactions, and network statistics for the privacy-focused Monero cryptocurrency.", + "status": "live", + "pricing": "free", + "bestFor": "Monero block and transaction lookup with basic privacy-coin exploration", + "input": "Monero block hash, block height, or transaction ID", + "output": "Block details, transaction count, network hashrate, difficulty, emission rate", + "opsec": "passive", + "opsecNote": "Public Monero blockchain browsing; inherent privacy from Monero's ring signature design limits address-level tracing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "XMRChain.net", "type": "url", - "url": "https://xmrchain.net/" + "url": "https://xmrchain.net/", + "description": "Minimal Monero blockchain explorer with no JavaScript, cookies, or tracking; available via Tor with focus on privacy and open-source design.", + "status": "live", + "pricing": "free", + "bestFor": "Monero transaction lookup with privacy-first design (Tor-accessible)", + "input": "Monero transaction ID, block height, or block hash", + "output": "Transaction details, block information, network statistics, Monero emission data", + "opsec": "passive", + "opsecNote": "No tracking or analytics; Tor-accessible for anonymous browsing. Inherent Monero privacy limits address tracing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -16104,12 +17914,42 @@ { "name": "Bitquery Explorer", "type": "url", - "url": "https://explorer.bitquery.io/" + "url": "https://explorer.bitquery.io/", + "description": "Multi-chain blockchain explorer with GraphQL API supporting 40+ blockchains, real-time streaming, and advanced querying for token trades, transfers, and smart contract events.", + "status": "live", + "pricing": "freemium", + "bestFor": "Advanced cross-chain data querying and real-time blockchain event tracking", + "input": "Blockchain query via GraphQL (address, transaction, token, smart contract), or web interface search", + "output": "Transaction data, token transfer history, DEX trades, smart contract events, real-time streaming via WebSocket", + "opsec": "passive", + "opsecNote": "API-first platform; queries are processed by Bitquery servers. Free tier available with rate limits.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Blockchair", "type": "url", - "url": "https://blockchair.com/" + "url": "https://blockchair.com/", + "description": "Multi-chain blockchain explorer supporting 48+ blockchains (Bitcoin, Ethereum, Litecoin, Solana, etc.) with advanced search, SQL-like queries, and privacy-focused design (Tor accessible, no tracking).", + "status": "live", + "pricing": "freemium", + "bestFor": "Cross-chain address and transaction search with privacy-friendly interface", + "input": "Blockchain address, transaction hash, or advanced SQL-like query across chains", + "output": "Transaction history, balance data, token transfers, smart contract events, cross-chain analytics", + "opsec": "passive", + "opsecNote": "Accessible via Tor; does not require registration; minimal tracking or logging. Privacy-oriented design.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -16120,12 +17960,42 @@ { "name": "Etherscan NFT Tracker", "type": "url", - "url": "https://etherscan.io/nft" + "url": "https://etherscan.io/nft", + "description": "NFT-specific section of Etherscan for tracking ERC-721 and ERC-1155 token transfers, marketplace activities, and collection-level statistics.", + "status": "live", + "pricing": "freemium", + "bestFor": "Ethereum NFT transaction tracking and collection analysis", + "input": "NFT contract address, collection name, or transaction hash", + "output": "NFT transaction history, collection floor prices, holder distribution, trading volume, minting data", + "opsec": "passive", + "opsecNote": "Subset of Etherscan; same passive analysis of public Ethereum NFT data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenSea", "type": "url", - "url": "https://opensea.io/" + "url": "https://opensea.io/", + "description": "Multi-chain NFT marketplace supporting 22+ blockchains (Ethereum, Solana, Arbitrum, Optimism, etc.) with transaction history, collection analytics, and trading data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-chain NFT trading history and collection-level analysis", + "input": "NFT collection address, wallet address, or transaction search", + "output": "Trading history, collection floor prices, holder analysis, transaction data, offer history", + "opsec": "passive", + "opsecNote": "Public marketplace; wallet connections identify users for OpenSea platform (not blockchain-level deanonymization).", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -16136,12 +18006,42 @@ { "name": "XMRChain.net (Monero)", "type": "url", - "url": "https://xmrchain.net/" + "url": "https://xmrchain.net/", + "description": "Minimal Monero blockchain explorer with no JavaScript, cookies, or tracking; available via Tor with focus on privacy and open-source design.", + "status": "live", + "pricing": "free", + "bestFor": "Monero transaction lookup with privacy-first design (Tor-accessible)", + "input": "Monero transaction ID, block height, or block hash", + "output": "Transaction details, block information, network statistics, Monero emission data", + "opsec": "passive", + "opsecNote": "No tracking or analytics; Tor-accessible for anonymous browsing. Inherent Monero privacy limits address tracing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Zcash Block Explorer", "type": "url", - "url": "https://blockchair.com/zcash" + "url": "https://blockchair.com/zcash", + "description": "Zcash blockchain explorer (hosted on Blockchair) supporting transparent and shielded transaction analysis for privacy-coin OSINT with transaction filtering and address lookup.", + "status": "live", + "pricing": "freemium", + "bestFor": "Zcash transparent transaction tracking (limited privacy-coin OSINT)", + "input": "Zcash address (transparent), transaction hash, or block height", + "output": "Transaction details, address balance (transparent addresses only), block information, mining statistics", + "opsec": "passive", + "opsecNote": "Only transparent Zcash transactions are traceable; shielded transactions provide privacy beyond analysis capability.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -16152,12 +18052,42 @@ { "name": "Blockchair", "type": "url", - "url": "https://blockchair.com/" + "url": "https://blockchair.com/", + "description": "Multi-chain blockchain explorer supporting 48+ blockchains (Bitcoin, Ethereum, Litecoin, Solana, etc.) with advanced search, SQL-like queries, and privacy-focused design (Tor accessible, no tracking).", + "status": "live", + "pricing": "freemium", + "bestFor": "Cross-chain address and transaction search with privacy-friendly interface", + "input": "Blockchain address, transaction hash, or advanced SQL-like query across chains", + "output": "Transaction history, balance data, token transfers, smart contract events, cross-chain analytics", + "opsec": "passive", + "opsecNote": "Accessible via Tor; does not require registration; minimal tracking or logging. Privacy-oriented design.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Wallet Explorer", "type": "url", - "url": "https://www.walletexplorer.com/" + "url": "https://www.walletexplorer.com/", + "description": "Bitcoin address clustering and wallet linking tool using multi-input heuristics to identify related addresses and track entity-level transaction patterns.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bitcoin address clustering and entity wallet identification", + "input": "Bitcoin address, transaction hash, or entity name search", + "output": "Clustered wallet addresses, transaction patterns, entity profiles, balance summaries", + "opsec": "passive", + "opsecNote": "Analyzes public blockchain data; no registration required for basic lookups.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -16975,32 +18905,122 @@ { "name": "Decalage Malware Search", "type": "url", - "url": "https://decalage.info/en/mwsearch" + "url": "https://decalage.info/en/mwsearch", + "description": "Custom metasearch engine that indexes malware analysis databases to find malware samples containing specific strings, filenames, hashes, or IOCs.", + "status": "live", + "pricing": "free", + "bestFor": "Quick metasearch across multiple malware analysis databases by hash, string, or filename", + "input": "IOC (hash, filename, string, yara rule, VT hash)", + "output": "Links to malware analysis reports from aggregated databases", + "opsec": "passive", + "opsecNote": "Search-only interface; no account required; queries are directed to indexed databases", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "VirusShare.com", "type": "url", - "url": "https://virusshare.com/" + "url": "https://virusshare.com/", + "description": "Repository of 111+ million live malware samples provided for security researchers, incident responders, forensic analysts, and researchers.", + "status": "live", + "pricing": "free", + "bestFor": "Bulk access to malware sample collections for research and analysis", + "input": "MD5 hash, account credentials", + "output": "Malware sample files (zip archives, password protected), related IOCs", + "opsec": "passive", + "opsecNote": "Registration required; no direct execution occurs; passive hash lookup available", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "#totalhash", "type": "url", - "url": "https://totalhash.cymru.com/" + "url": "https://totalhash.cymru.com/", + "description": "Malware Hash Registry that searches against 30+ antivirus databases to validate malware hashes with detection percentage results. Updated daily.", + "status": "live", + "pricing": "free", + "bestFor": "Hash validation against 30+ AV engines with detection percentages", + "input": "MD5 or SHA-1 hash", + "output": "Detection percentage, last seen timestamp, signature matches from AV databases", + "opsec": "passive", + "opsecNote": "No registration required; read-only hash lookups leave minimal traces", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VX Vault", "type": "url", - "url": "https://vxvault.net/ViriList.php" + "url": "https://vxvault.net/ViriList.php", + "description": "Active collection of malware samples and related data shared among security researchers and malware analysts for threat intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Access to active malware sample collections", + "input": "Web interface browsing, malware sample queries", + "output": "Malware sample information, related indicators", + "opsec": "passive", + "opsecNote": "Web-based browsing interface; no registration typically required", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ID Ransomware", "type": "url", - "url": "https://id-ransomware.malwarehunterteam.com/" + "url": "https://id-ransomware.malwarehunterteam.com/", + "description": "Free ransomware identification tool that analyzes ransom notes and encrypted file samples to identify variants and provide decryption guidance. Detects 1181+ ransomware types.", + "status": "live", + "pricing": "free", + "bestFor": "Ransomware identification and victim support", + "input": "Ransom note file, encrypted file sample, ransom email address", + "output": "Ransomware variant identification, decryption status, victim resources", + "opsec": "passive", + "opsecNote": "File uploads provide victim privacy options to protect personal data exposure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "National Software Reference Library", "type": "url", - "url": "https://nsrl.hashsets.com/national_software_reference_library1_search.php" + "url": "https://nsrl.hashsets.com/national_software_reference_library1_search.php", + "description": "NIST-maintained repository of cryptographic hash values for known, legitimate software to identify known-good files during digital forensics investigations.", + "status": "live", + "pricing": "free", + "bestFor": "Eliminating known-good files in forensic investigations and digital triage", + "input": "File hash (MD5, SHA-1, SHA-256), software query", + "output": "Hash matches to known software, file metadata, product versioning", + "opsec": "passive", + "opsecNote": "No registration required; lookup-only service; government maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17015,12 +19035,42 @@ { "name": "TYLabs QuickSand Framework", "type": "url", - "url": "https://scan.tylabs.com/" + "url": "https://scan.tylabs.com/", + "description": "Python-based malware analysis framework for analyzing Office documents and PDFs to identify exploits in decoded streams using YARA signatures.", + "status": "live", + "pricing": "freemium", + "bestFor": "Document and PDF malware analysis with exploit detection", + "input": "Office documents (.doc, .xls, .ppt), PDFs, emails, Postscript", + "output": "YARA signature matches, exploit detection, risk scoring, threat analysis", + "opsec": "active", + "opsecNote": "Hosted analysis requires file upload; local installation available for offline use", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "JoeSandbox Document Analyzer", "type": "url", - "url": "https://www.joesandbox.com/" + "url": "https://www.joesandbox.com/", + "description": "Hosted automated malware analysis service that performs dynamic and static analysis of files including Office documents, PDFs, and executables with comprehensive behavioral reporting.", + "status": "live", + "pricing": "freemium", + "bestFor": "Comprehensive malware analysis with behavioral insights and threat scoring", + "input": "Executable files, documents, PDFs, URLs, APKs (Max 30MB free tier)", + "output": "Behavioral analysis, network IOCs, detection verdicts, MITRE ATT&CK mappings, export formats (JSON, XML, HTML, PDF)", + "opsec": "active", + "opsecNote": "File uploads are processed on external sandbox; free tier limited to 30 submissions/month", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17031,7 +19081,22 @@ { "name": "TYLabs QuickSand Framework", "type": "url", - "url": "https://scan.tylabs.com/" + "url": "https://scan.tylabs.com/", + "description": "Python-based malware analysis framework for analyzing Office documents and PDFs to identify exploits in decoded streams using YARA signatures.", + "status": "live", + "pricing": "freemium", + "bestFor": "Document and PDF malware analysis with exploit detection", + "input": "Office documents (.doc, .xls, .ppt), PDFs, emails, Postscript", + "output": "YARA signature matches, exploit detection, risk scoring, threat analysis", + "opsec": "active", + "opsecNote": "Hosted analysis requires file upload; local installation available for offline use", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17042,12 +19107,42 @@ { "name": "Akana Android Malware", "type": "url", - "url": "https://akana.mobiseclab.org/" + "url": "https://akana.mobiseclab.org/", + "description": "Online Android Interactive Analysis Environment with plugins for analyzing malicious Android applications and APKs for suspicious behavior and malware characteristics.", + "status": "live", + "pricing": "free", + "bestFor": "Android app malware analysis and interactive examination", + "input": "Android APK files", + "output": "Malware detection results, behavioral analysis, plugin-based threat assessment", + "opsec": "active", + "opsecNote": "File uploads required; external analysis service", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe APK Analyzer", "type": "url", - "url": "https://www.apk-analyzer.net/" + "url": "https://www.apk-analyzer.net/", + "description": "Part of Joe Sandbox suite; performs dynamic and static analysis of Android Application Packages to detect malicious behavior and generate detailed analysis reports.", + "status": "live", + "pricing": "freemium", + "bestFor": "Android malware analysis with dynamic behavior monitoring", + "input": "Android APK files", + "output": "Malware detection, behavioral analysis, threat intelligence IOCs", + "opsec": "active", + "opsecNote": "File uploads to external sandbox; free tier has limitations", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17074,67 +19169,262 @@ { "name": "OPSWAT Meta Defender", "type": "url", - "url": "https://metadefender.opswat.com/#!/" + "url": "https://metadefender.opswat.com/#!/", + "description": "Multi-engine malware scanning service using 20+ antivirus engines with advanced threat analysis, content disarm & reconstruction, and emulation-based detection for zero-day threats.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-engine malware detection with advanced threat analysis", + "input": "Files (all types), URLs", + "output": "Multi-engine scan results, threat verdicts, IOC extraction, file behavior analysis", + "opsec": "active", + "opsecNote": "File uploads required; free community version available with API limits", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hybrid Analysis", "type": "url", - "url": "https://hybrid-analysis.com/" + "url": "https://hybrid-analysis.com/", + "description": "Free automated malware analysis service powered by CrowdStrike Falcon Sandbox. Combines runtime data with memory dump analysis to extract execution pathways and IOCs for evasive malware.", + "status": "live", + "pricing": "freemium", + "bestFor": "Advanced malware behavior analysis and evasion detection", + "input": "Files (30MB max free tier), URLs, APKs (up to 30 per month free)", + "output": "Hybrid behavioral analysis, memory dumps, disassembly, IOC extraction, behavioral indicators", + "opsec": "active", + "opsecNote": "Free tier limited to 30 uploads/month; file uploads to external sandbox infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Config", "type": "url", - "url": "https://malwareconfig.com/" + "url": "https://malwareconfig.com/", + "description": "Database for searching and analyzing extracted malware configurations by hash, domain, or IP address to track C2 infrastructure and malware attributes.", + "status": "live", + "pricing": "free", + "bestFor": "Malware configuration extraction and C2 server tracking", + "input": "SHA256 hash, domain, IP address, malware family", + "output": "Extracted malware configurations, C2 infrastructure, encrypted keys, command data", + "opsec": "passive", + "opsecNote": "Search-only interface; no file uploads required; passive lookups", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MetaDefender", "type": "url", - "url": "https://metadefender.opswat.com/" + "url": "https://metadefender.opswat.com/", + "description": "OPSWAT's cloud-based multi-engine malware scanning platform with advanced threat detection using 30+ antivirus engines, CDR technology, and behavioral analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Enterprise-grade multi-engine malware detection and advanced threat analysis", + "input": "Files, URLs, streams", + "output": "Multi-engine detection results, threat verdicts, behavioral analysis, IOC extraction", + "opsec": "active", + "opsecNote": "File uploads required; commercial and free tiers available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Ether", "type": "url", - "url": "https://ether.gtisc.gatech.edu/web_unpack/" + "url": "https://ether.gtisc.gatech.edu/web_unpack/", + "description": "Georgia Tech malware analysis framework using Intel VT hardware virtualization for transparent, stealthy malware analysis resistant to anti-analysis techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Transparent malware analysis resistant to anti-analysis evasion", + "input": "Executable files, malware samples", + "output": "Fine-grained execution traces, instruction-level analysis, unpacking results, behavior extraction", + "opsec": "active", + "opsecNote": "Hosted analysis service; academic research project from Georgia Institute of Technology", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Jotti's Malware Scanner", "type": "url", - "url": "https://virusscan.jotti.org/en-US/scan-file" + "url": "https://virusscan.jotti.org/en-US/scan-file", + "description": "Free multi-scanner malware analysis service that submits files for analysis against 14+ antivirus engines. No installation or account setup required.", + "status": "live", + "pricing": "free", + "bestFor": "Quick multi-engine scan without installation or account setup", + "input": "Files (up to 5 concurrent, 250MB per file)", + "output": "Detection results from 14+ AV engines, file metadata, scan reports", + "opsec": "active", + "opsecNote": "No account required; file uploads to external scanning service", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Valkyrie File Analysis", "type": "url", - "url": "https://consumer.valkyrie.comodo.com/" + "url": "https://consumer.valkyrie.comodo.com/", + "description": "Cloud-based verdict-driven malware analysis platform from Comodo using static analysis (450+ unpackers), dynamic analysis, and optional human expert analysis for unknown files.", + "status": "live", + "pricing": "freemium", + "bestFor": "Advanced malware analysis with human expert review option", + "input": "Files (all types), URLs", + "output": "File verdict, behavioral analysis results, IOC extraction, confidence scores, expert analysis", + "opsec": "active", + "opsecNote": "File uploads required; expert analysis available for premium users", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "detux Linux Sandbox", "type": "url", - "url": "https://detux.org/" + "url": "https://detux.org/", + "description": "Open-source multiplatform Linux sandbox for analyzing Linux malware across multiple CPU architectures (x86, x86-64, ARM, MIPS) using QEMU emulation and traffic analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Linux malware analysis across multiple architectures", + "input": "Linux executable files, malware samples", + "output": "Static analysis strings, dynamic traffic capture, IOC extraction, architecture-specific analysis", + "opsec": "active", + "opsecNote": "Open-source tool; can be deployed locally or used as hosted service", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe File Analyzer", "type": "url", - "url": "https://www.file-analyzer.net/" + "url": "https://www.file-analyzer.net/", + "description": "Part of Joe Sandbox suite; performs hybrid code analysis of PE files on Windows with detailed behavioral and system interaction reporting.", + "status": "live", + "pricing": "freemium", + "bestFor": "PE file malware analysis with system interaction tracking", + "input": "PE executable files (.exe, .dll, etc.)", + "output": "Hybrid behavioral analysis, system calls, network IOCs, threat scores", + "opsec": "active", + "opsecNote": "File uploads to Joe Sandbox infrastructure; free tier has submission limits", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Pikker.ee Cuckoo Sandbox", "type": "url", - "url": "https://sandbox.pikker.ee/" + "url": "https://sandbox.pikker.ee/", + "description": "Public instance of Cuckoo Sandbox malware analysis system hosted in Estonia. Provides automated dynamic analysis with detailed result reporting for submitted files.", + "status": "live", + "pricing": "free", + "bestFor": "Free automated dynamic malware analysis with detailed behavioral reports", + "input": "Executable files, documents, archives", + "output": "Process monitoring, API calls, file system changes, network traffic, behavioral analysis", + "opsec": "active", + "opsecNote": "Public instance; files uploaded to external infrastructure; Estonian-hosted", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Koodous", "type": "url", - "url": "https://koodous.com" + "url": "https://koodous.com", + "description": "Collaborative platform for Android malware research and analysis with community-driven database of 70+ million Android applications with crowd-sourced malware detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Android malware analysis with community collaboration and threat intelligence", + "input": "Android APK files, package names, hashes", + "output": "Malware detection results, community analysis, threat indicators, sample sharing", + "opsec": "active", + "opsecNote": "Registration available; community platform with shared threat intelligence", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Any Run", "type": "url", - "url": "https://app.any.run/" + "url": "https://app.any.run/", + "description": "Interactive malware analysis sandbox allowing real-time manual interaction with Windows, macOS, Linux, and Android environments. Fast report generation with MITRE ATT&CK mapping.", + "status": "live", + "pricing": "freemium", + "bestFor": "Interactive malware analysis with real-time system interaction", + "input": "Files, URLs, APKs, documents (platform-specific)", + "output": "Process graphs, behavioral analysis, MITRE ATT&CK TTPs, IOCs, customizable reports", + "opsec": "active", + "opsecNote": "Interactive analysis leaves traces; free tier limited to 3 public analyses/day; private mode in paid plans", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Uncover It", "type": "url", - "url": "https://www.uncoverit.org/" + "url": "https://www.uncoverit.org/", + "description": "Static malware configuration extractor that quickly analyzes files without execution to extract malware configurations, C2 infrastructure, and IOCs in under 5 seconds.", + "status": "live", + "pricing": "free", + "bestFor": "Fast static malware configuration extraction", + "input": "Malware samples, executable files", + "output": "Extracted configurations, C2 servers, encryption keys, behavioral indicators", + "opsec": "passive", + "opsecNote": "Static analysis only; no code execution; quick analysis without external dependencies", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17145,12 +19435,42 @@ { "name": "Office Mal Scanner (T)", "type": "url", - "url": "https://www.reconstructer.org/" + "url": "https://www.reconstructer.org/", + "description": "Malicious Office document analysis tool for analyzing and reconstructing Office documents to identify exploits and malicious content.", + "status": "live", + "pricing": "free", + "bestFor": "Malicious Office document analysis and reconstruction", + "input": "Microsoft Office documents (.doc, .xls, .ppt)", + "output": "Document structure analysis, malicious content extraction, exploit identification", + "opsec": "active", + "opsecNote": "Document upload required; analysis service online", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OffVis (T)", "type": "url", - "url": "https://download.microsoft.com/download/1/2/7/127ba59a-4fe1-4acd-ba47-513ceef85a85/OffVis.zip" + "url": "https://download.microsoft.com/download/1/2/7/127ba59a-4fe1-4acd-ba47-513ceef85a85/OffVis.zip", + "description": "Microsoft Office Visualization Tool for analyzing Office binary files to identify exploits and malicious structures. Displays hex and object tree views.", + "status": "live", + "pricing": "free", + "bestFor": "Office binary file format analysis and exploit detection", + "input": "Office binary files (.doc, .xls, .ppt, .pps, .pot)", + "output": "File structure visualization, hex dump, object trees, vulnerability detection", + "opsec": "passive", + "opsecNote": "Local desktop application; no file uploads; Microsoft-provided tool", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17161,12 +19481,42 @@ { "name": "PDF Tools (T)", "type": "url", - "url": "https://blog.didierstevens.com/programs/pdf-tools/" + "url": "https://blog.didierstevens.com/programs/pdf-tools/", + "description": "Free suite of PDF analysis tools by Didier Stevens including pdfid (keyword scanning) and pdf-parser.py for analyzing malicious PDF documents and extracting embedded objects.", + "status": "live", + "pricing": "free", + "bestFor": "PDF structure analysis and malicious object extraction", + "input": "PDF files", + "output": "PDF keyword identification, object parsing, embedded JavaScript detection, IOC extraction", + "opsec": "passive", + "opsecNote": "Command-line tools; local execution; open-source from reputable security researcher", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Origami Framework (T)", "type": "url", - "url": "https://code.google.com/archive/p/origami-pdf/" + "url": "https://code.google.com/archive/p/origami-pdf/", + "description": "Ruby framework for parsing, analyzing, and forging PDF documents. Includes PDF Walker GUI and PDFcop heuristic checker for detecting dangerous PDF content.", + "status": "live", + "pricing": "free", + "bestFor": "PDF parsing and manipulation for malicious PDF analysis", + "input": "PDF files, PDF objects, malicious content", + "output": "Parsed PDF structure, extracted objects, deobfuscated content, modified PDFs", + "opsec": "passive", + "opsecNote": "Open-source framework; local installation required; no file uploads", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17177,24 +19527,84 @@ { "name": "Malware-Traffic-Analysis.net", "type": "url", - "url": "https://www.malware-traffic-analysis.net/index.html" + "url": "https://www.malware-traffic-analysis.net/index.html", + "description": "Training resource and PCAP repository providing network traffic captures from malware infections since 2013. Includes tutorials and exercises for malware traffic analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Malware network behavior analysis and training exercises", + "input": "PCAP files, network traffic captures", + "output": "Network indicators (IPs, domains, C2 servers), behavioral analysis, post-exploitation patterns", + "opsec": "passive", + "opsecNote": "PCAP analysis is passive; no live malware execution; educational resource", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "Ghidra (T)", "type": "url", - "url": "https://github.com/NationalSecurityAgency/ghidra" + "url": "https://github.com/NationalSecurityAgency/ghidra", + "description": "Free and open-source reverse engineering framework from NSA for analyzing compiled software. Includes disassembly, decompilation, scripting, and interactive graphing for malware analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Reverse engineering and static malware analysis", + "input": "Executable files (ELF, PE, Mach-O, raw binaries), multiple architectures", + "output": "Disassembly, decompiled code, control flow graphs, function analysis, custom scripts", + "opsec": "passive", + "opsecNote": "Local desktop application; no file uploads; open-source from NSA", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Analysis Tools", "type": "url", - "url": "https://malwareanalysis.tools/" + "url": "https://malwareanalysis.tools/", + "description": "Curated resource and reference guide for malware analysis tools with recommendations for virtualization, safety practices, and tool selection for analysis scenarios.", + "status": "live", + "pricing": "free", + "bestFor": "Malware analysis tool discovery and best practices reference", + "input": "Tool research, methodology guidance", + "output": "Tool recommendations, analysis methodologies, safety practices, learning resources", + "opsec": "passive", + "opsecNote": "Reference resource only; no file uploads or active analysis", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "virustotal", "type": "url", - "url": "https://www.virustotal.com/gui/home/upload" + "url": "https://www.virustotal.com/gui/home/upload", + "description": "Free online service that analyzes files and URLs for viruses, trojans and malicious content detected by 70+ antivirus engines and URL/domain reputation services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-engine malware scanning and URL reputation lookup", + "input": "Files, URLs, domains, IP addresses, file hashes", + "output": "Detection results from 70+ AV engines, behavioral analysis, file insights, related samples", + "opsec": "passive", + "opsecNote": "File uploads are indexed and visible to other users; hash-only queries are private", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17321,22 +19731,82 @@ { "name": "SecAI.ai", "type": "url", - "url": "https://secai.ai/research" + "url": "https://secai.ai/research", + "description": "Security research platform providing threat intelligence, vulnerability analysis, and cybersecurity insights with focus on emerging threats.", + "status": "live", + "pricing": "free", + "bestFor": "Security research and threat intelligence", + "input": "Threat indicator or research topic", + "output": "Research articles and threat analysis", + "opsec": "passive", + "opsecNote": "Passive threat intelligence platform", + "localInstall": false, + "googleDork": false, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "api": false, + "deprecated": false }, { "name": "https://openphish.com/feed.txt", "type": "url", - "url": "https://openphish.com/feed.txt" + "url": "https://openphish.com/feed.txt", + "description": "Real-time phishing URL feed providing confirmed malicious phishing sites updated continuously.", + "status": "live", + "pricing": "free", + "bestFor": "Phishing URL detection", + "input": "Feed subscription or URL lookup", + "output": "Phishing URLs and malicious domains", + "opsec": "passive", + "opsecNote": "Passive feed consumption of public phishing data", + "localInstall": false, + "googleDork": false, + "api": true, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "deprecated": false }, { "name": "PhishTank", "type": "url", - "url": "https://www.phishtank.com/" + "url": "https://www.phishtank.com/", + "description": "Community-driven phishing URL database where users submit and verify suspected phishing sites.", + "status": "live", + "pricing": "free", + "bestFor": "Phishing site verification", + "input": "Phishing URL or suspected malicious site", + "output": "Phishing status and community verification votes", + "opsec": "passive", + "opsecNote": "Passive lookup of community-reported database", + "localInstall": false, + "googleDork": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "registration": false, + "deprecated": false }, { "name": "PhishStats", "type": "url", - "url": "https://phishstats.info/" + "url": "https://phishstats.info/", + "description": "Phishing detection and analysis platform providing statistics on campaigns and domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Phishing campaign analysis", + "input": "Domain, IP, or keyword", + "output": "Campaign tracking and threat profiles", + "opsec": "passive", + "opsecNote": "Passive querying of phishing statistics database", + "localInstall": false, + "googleDork": false, + "api": true, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "deprecated": false } ] }, @@ -17347,37 +19817,142 @@ { "name": "Jager", "type": "url", - "url": "https://github.com/sroberts/jager" + "url": "https://github.com/sroberts/jager", + "description": "Python IOC aggregation and analysis tool for collecting and organizing security indicators.", + "status": "live", + "pricing": "free", + "bestFor": "IOC collection and aggregation", + "input": "IOC feeds or indicator lists", + "output": "Aggregated IOC database in standardized format", + "opsec": "passive", + "opsecNote": "Local processing of public feeds", + "localInstall": true, + "googleDork": false, + "api": true, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "deprecated": false }, { "name": "IOC Parser", "type": "url", - "url": "https://github.com/armbues/ioc_parser" + "url": "https://github.com/armbues/ioc_parser", + "description": "Python library for extracting and parsing IOCs from raw text and security reports.", + "status": "live", + "pricing": "free", + "bestFor": "IOC extraction from reports", + "input": "Raw text or security reports", + "output": "Parsed IOCs in structured format", + "opsec": "passive", + "opsecNote": "Local text analysis without network interaction", + "localInstall": true, + "googleDork": false, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "api": false, + "deprecated": false }, { "name": "Cacador", "type": "url", - "url": "https://github.com/sroberts/cacador" + "url": "https://github.com/sroberts/cacador", + "description": "Python tool for indicator extraction and deduplication from threat intelligence documents.", + "status": "live", + "pricing": "free", + "bestFor": "Indicator extraction and deduplication", + "input": "Documents and threat feeds", + "output": "Extracted and deduplicated IOCs", + "opsec": "passive", + "opsecNote": "Local processing tool for passive analysis", + "localInstall": true, + "googleDork": false, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "api": false, + "deprecated": false }, { "name": "ThreatPinch Lookup", "type": "url", - "url": "https://github.com/cloudtracer/ThreatPinchLookup" + "url": "https://github.com/cloudtracer/ThreatPinchLookup", + "description": "Browser extension and Python tool for enriching IOCs with real-time threat intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Indicator enrichment", + "input": "IOC or domain/IP/hash", + "output": "Enriched threat intelligence from multiple sources", + "opsec": "passive", + "opsecNote": "Passive lookup of public threat intel APIs", + "localInstall": true, + "googleDork": false, + "api": true, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "deprecated": false }, { "name": "Mimir", "type": "url", - "url": "https://github.com/NullArray/Mimir" + "url": "https://github.com/NullArray/Mimir", + "description": "IOC extraction and validation tool from security reports (unmaintained).", + "status": "live", + "pricing": "free", + "bestFor": "IOC extraction and validation", + "input": "Security reports and documents", + "output": "Validated IOCs in structured format", + "opsec": "passive", + "opsecNote": "Local processing tool for passive extraction", + "localInstall": true, + "googleDork": false, + "invitationOnly": false, + "deprecated": true, + "registration": false, + "editUrl": false, + "api": false }, { "name": "iocextract (T)", "type": "url", - "url": "https://github.com/InQuest/iocextract" + "url": "https://github.com/InQuest/iocextract", + "description": "Python library and CLI tool for rapid IOC extraction with support for obfuscated indicators.", + "status": "live", + "pricing": "free", + "bestFor": "IOC extraction with deobfuscation", + "input": "Raw text with obfuscated indicators", + "output": "Extracted IOCs including decoded variants", + "opsec": "passive", + "opsecNote": "Local text parsing without network interaction", + "localInstall": true, + "googleDork": false, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "api": false, + "deprecated": false }, { "name": "ThreatIngestor (T)", "type": "url", - "url": "https://github.com/InQuest/ThreatIngestor" + "url": "https://github.com/InQuest/ThreatIngestor", + "description": "Modular IOC ingestion platform for automated threat indicator extraction from multiple sources.", + "status": "live", + "pricing": "free", + "bestFor": "Automated IOC collection and enrichment", + "input": "Multiple threat feeds and RSS sources", + "output": "Aggregated and enriched IOCs in repository", + "opsec": "passive", + "opsecNote": "Passive aggregation of public threat feeds", + "localInstall": true, + "googleDork": false, + "api": true, + "invitationOnly": false, + "registration": false, + "editUrl": false, + "deprecated": false } ] }, @@ -17388,12 +19963,42 @@ { "name": "Malware Exploit TTP Database", "type": "url", - "url": "https://www.pwnmalw.re/" + "url": "https://www.pwnmalw.re/", + "description": "Malware exploit database documenting security vulnerabilities in malware families (offline).", + "status": "down", + "pricing": "free", + "bestFor": "Malware exploit research", + "input": "Malware name or exploit query", + "output": "Exploit documentation and vulnerability details", + "opsec": "passive", + "opsecNote": "Passive lookup when functional", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Mitre TTPs", "type": "url", - "url": "https://attack.mitre.org/wiki/All_Techniques" + "url": "https://attack.mitre.org/", + "description": "MITRE ATT&CK framework: globally-accessible knowledge base of adversary tactics and techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Threat modeling and TTP analysis", + "input": "Search for tactics, techniques, or threat groups", + "output": "Technique descriptions and mitigation strategies", + "opsec": "passive", + "opsecNote": "Passive research of public threat intelligence", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17408,12 +20013,42 @@ { "name": "Global Terrorism Database", "type": "url", - "url": "https://www.start.umd.edu/research-projects/global-terrorism-database-gtd" + "url": "https://www.start.umd.edu/research-projects/global-terrorism-database-gtd", + "description": "Academic database of terrorist attacks maintained by START at University of Maryland.", + "status": "live", + "pricing": "free", + "bestFor": "Terrorism research and analysis", + "input": "Search by attack, group, or date", + "output": "Terrorist attack records and analysis data", + "opsec": "passive", + "opsecNote": "Passive academic research database", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "START Consortium for the Study of Terrorism and Responses to Terrorism", "type": "url", - "url": "https://www.start.umd.edu/" + "url": "https://www.start.umd.edu/", + "description": "National Consortium conducting research on terrorism causes, consequences, and responses.", + "status": "live", + "pricing": "free", + "bestFor": "Terrorism research and education", + "input": "Research topics and publications", + "output": "Academic research and threat intelligence", + "opsec": "passive", + "opsecNote": "Passive academic research access", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17424,17 +20059,62 @@ { "name": "CSIS Warfare, Irregular Threats, and Terrorism Program", "type": "url", - "url": "https://www.csis.org/programs/warfare-irregular-threats-and-terrorism-program" + "url": "https://www.csis.org/programs/warfare-irregular-threats-and-terrorism-program", + "description": "Research program analyzing terrorism, cyber threats, and irregular warfare.", + "status": "live", + "pricing": "free", + "bestFor": "Terrorism and threat analysis research", + "input": "Research topics and reports", + "output": "Reports and analysis on terrorism and warfare", + "opsec": "passive", + "opsecNote": "Passive access to public research", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Institute for Strategic Dialogue", "type": "url", - "url": "https://www.isdglobal.org/" + "url": "https://www.isdglobal.org/", + "description": "International research organization studying conflict, extremism, and social change.", + "status": "live", + "pricing": "free", + "bestFor": "Extremism and conflict research", + "input": "Research topics and publications", + "output": "Research reports and analysis", + "opsec": "passive", + "opsecNote": "Passive access to public research", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "RAND Terrorism Research", "type": "url", - "url": "https://www.rand.org/topics/terrorism.html" + "url": "https://www.rand.org/topics/terrorism.html", + "description": "RAND Corporation's collection of research and analysis on terrorism topics.", + "status": "live", + "pricing": "free", + "bestFor": "Terrorism research and policy analysis", + "input": "Search for terrorism research", + "output": "Academic papers and research findings", + "opsec": "passive", + "opsecNote": "Passive access to public research", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17445,17 +20125,62 @@ { "name": "OFAC Sanctions List Search", "type": "url", - "url": "https://sanctionssearch.ofac.treas.gov/" + "url": "https://sanctionssearch.ofac.treas.gov/", + "description": "U.S. Treasury tool for searching SDN and sanctions lists with approximate string matching.", + "status": "live", + "pricing": "free", + "bestFor": "Sanctions list lookups", + "input": "Person or entity name", + "output": "Sanctions status and entity information", + "opsec": "passive", + "opsecNote": "Government database lookup with approximate matching", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenSanctions", "type": "url", - "url": "https://www.opensanctions.org/" + "url": "https://www.opensanctions.org/", + "description": "Platform aggregating global sanctions, watchlists, and PEP data from 329 sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "Sanctions and compliance research", + "input": "Person, company, or entity name", + "output": "Sanctions status and entity details", + "opsec": "passive", + "opsecNote": "Passive lookup of aggregated public data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "UN Security Council Consolidated List", "type": "url", - "url": "https://main.un.org/securitycouncil/en/content/un-sc-consolidated-list" + "url": "https://main.un.org/securitycouncil/en/content/un-sc-consolidated-list", + "description": "Official UN Security Council list of designated individuals and entities.", + "status": "live", + "pricing": "free", + "bestFor": "UN sanctions verification", + "input": "Person or entity name", + "output": "UN designation status", + "opsec": "passive", + "opsecNote": "Passive lookup of official UN data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -17466,7 +20191,22 @@ { "name": "Terrorist Finance Tracking Program", "type": "url", - "url": "https://home.treasury.gov/policy-issues/terrorism-and-illicit-finance/terrorist-finance-tracking-program-tftp" + "url": "https://home.treasury.gov/policy-issues/terrorism-and-illicit-finance/terrorist-finance-tracking-program-tftp", + "description": "U.S. Treasury program tracking terrorist financing and money laundering.", + "status": "live", + "pricing": "free", + "bestFor": "Terrorist financing intelligence", + "input": "Financial or entity information", + "output": "Financing intelligence and reports", + "opsec": "passive", + "opsecNote": "Government resource access", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -17475,35 +20215,95 @@ { "name": "IBM X-Force Exchange", "type": "url", - "url": "https://exchange.xforce.ibmcloud.com/new" + "url": "https://exchange.xforce.ibmcloud.com/", + "description": "Collaborative threat intelligence platform with malware, vulnerability, and campaign data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware and threat intelligence", + "input": "IOC, domain, or malware sample", + "output": "Threat analysis and intelligence reports", + "opsec": "passive", + "opsecNote": "Passive querying of threat database", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Information Sharing Platform", "type": "url", - "url": "https://www.misp-project.org/" + "url": "https://www.misp-project.org/", + "description": "Open-source platform for collecting, storing, and sharing cyber threat indicators and malware data.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence sharing", + "input": "Threat indicators and malware samples", + "output": "Structured threat intelligence and correlations", + "opsec": "passive", + "opsecNote": "Local platform for passive sharing", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Patrol", "type": "url", - "url": "https://www.malwarepatrol.net/integrations-formats-threat-intelligence-feed-integration/" + "url": "https://www.malwarepatrol.net/", + "description": "Threat intelligence feed service providing malware samples, URLs, domains, and IOC data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware IOC and feed intelligence", + "input": "IOC queries or feed subscriptions", + "output": "Malware hashes, URLs, and threat intel", + "opsec": "passive", + "opsecNote": "Passive consumption of threat feeds", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "AlienVault OTX", "type": "url", - "url": "https://otx.alienvault.com/" + "url": "https://otx.alienvault.com/", + "description": "Crowd-sourced threat intelligence platform with 180K+ participants sharing 19M+ daily threats.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence", + "input": "IOC, domain, IP, or search query", + "output": "Community threat pulses and analysis", + "opsec": "passive", + "opsecNote": "Passive community threat data sharing", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FireHOL IP Lists ", "type": "url", "url": "https://iplists.firehol.org/", - "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "description": "Collection of firewall-friendly IP blacklists for blocking malicious and spam sources.", "status": "live", "pricing": "free", - "bestFor": "Block malicious/spam IP sources", - "input": "IP address or list download", + "bestFor": "IP reputation and blocking", + "input": "IP address or list subscription", "output": "Blacklist membership status", "opsec": "passive", - "opsecNote": "Passive lookup of public IP reputation lists.", + "opsecNote": "Passive lookup of public reputation lists", "localInstall": false, "googleDork": false, "registration": false, @@ -17515,72 +20315,282 @@ { "name": "Maltiverse", "type": "url", - "url": "https://maltiverse.com/start" + "url": "https://maltiverse.com/", + "description": "Threat intelligence platform aggregating 100+ sources with real-time IOC scoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "IOC aggregation and scoring", + "input": "IOC or threat indicator", + "output": "Threat scores and context", + "opsec": "passive", + "opsecNote": "Passive aggregation of threat data", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malpedia", "type": "url", - "url": "https://malpedia.caad.fkie.fraunhofer.de/library" + "url": "https://malpedia.caad.fkie.fraunhofer.de/", + "description": "Free collaborative malware database from Fraunhofer FKIE with 600+ malware families.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware family identification", + "input": "Malware sample or family name", + "output": "Malware family analysis and YARA rules", + "opsec": "passive", + "opsecNote": "Passive malware research database", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": true, + "deprecated": false }, { "name": "Project Honey Pot", "type": "url", - "url": "https://www.projecthoneypot.org/" + "url": "https://www.projecthoneypot.org/", + "description": "Distributed honeypot project tracking email harvesters, spam servers, and malicious IPs.", + "status": "live", + "pricing": "free", + "bestFor": "Spam and harvester tracking", + "input": "IP address or email domain", + "output": "Harvester and spam activity records", + "opsec": "passive", + "opsecNote": "Passive honeypot intelligence", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cymon Open Threat Intelligence", "type": "url", - "url": "https://cymon.io/" + "url": "https://cymon.io/", + "description": "Largest open tracker of malware, phishing, botnets containing 6M+ malicious IPs.", + "status": "live", + "pricing": "freemium", + "bestFor": "IP threat tracking", + "input": "IP address or threat indicator", + "output": "Malware and threat reports", + "opsec": "passive", + "opsecNote": "Passive threat database queries", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "mlsecproject / combine", "type": "url", - "url": "https://github.com/mlsecproject/combine" + "url": "https://github.com/mlsecproject/combine", + "description": "Tool for gathering and normalizing threat intelligence feeds from public sources.", + "status": "live", + "pricing": "free", + "bestFor": "Threat feed aggregation", + "input": "Multiple threat intelligence feeds", + "output": "Normalized IOC data in CSV or CRITs format", + "opsec": "passive", + "opsecNote": "Local processing of public feeds", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "hostintel - keithjjones Github", "type": "url", - "url": "https://github.com/keithjjones/hostintel" + "url": "https://github.com/keithjjones/hostintel", + "description": "Modular Python application to collect host and malicious IP intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Host intelligence gathering", + "input": "IP, FQDN, or domain name", + "output": "Intelligence data in CSV format", + "opsec": "passive", + "opsecNote": "Local tool for passive host analysis", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "massive-octo-spice - csirtgadgets Github", "type": "url", - "url": "https://github.com/csirtgadgets/massive-octo-spice" + "url": "https://github.com/csirtgadgets/massive-octo-spice", + "description": "CSIRT threat intelligence platform (deprecated - use bearded-avenger v3 instead).", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy CSIRT intelligence platform", + "input": "Threat intelligence feeds", + "output": "Aggregated threat data", + "opsec": "passive", + "opsecNote": "Local platform for threat aggregation", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Scam Database", "type": "url", - "url": "https://www.scamdb.net" + "url": "https://www.scamdb.net/", + "description": "User-contributed database of scam reports searchable by phone, email, and website.", + "status": "live", + "pricing": "free", + "bestFor": "Scam and fraud reporting", + "input": "Phone, email, or website", + "output": "Unverified scam reports and details", + "opsec": "passive", + "opsecNote": "Passive lookup of community reports", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bot Scout", "type": "url", - "url": "https://botscout.com/" + "url": "https://botscout.com/", + "description": "Service tracking bot signatures (names, IPs, emails) to prevent automated spam and abuse.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bot and spam detection", + "input": "IP, email, or username", + "output": "Bot activity and spam records", + "opsec": "passive", + "opsecNote": "Passive honeypot-based detection", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "APTnotes", "type": "url", - "url": "https://github.com/aptnotes/data" + "url": "https://github.com/aptnotes/data", + "description": "Repository of public documents, whitepapers, and articles about APT campaigns.", + "status": "live", + "pricing": "free", + "bestFor": "APT research and threat analysis", + "input": "Search APT campaign documents", + "output": "Threat reports and analysis", + "opsec": "passive", + "opsecNote": "Passive access to public threat research", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "HoneyDB", "type": "url", - "url": "https://riskdiscovery.com/honeydb/" + "url": "https://honeydb.io/", + "description": "Honeypot network providing real-time IoT and server threat intelligence via REST API.", + "status": "live", + "pricing": "freemium", + "bestFor": "IoT honeypot intelligence", + "input": "IP address or attack queries", + "output": "Honeypot interaction logs and threat data", + "opsec": "passive", + "opsecNote": "Passive honeypot-based intelligence", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Pulsedive", "type": "url", - "url": "https://pulsedive.com" + "url": "https://pulsedive.com/", + "description": "Free threat intelligence platform for enriching IPs, URLs, domains, and IOCs from OSINT feeds.", + "status": "live", + "pricing": "freemium", + "bestFor": "IOC enrichment and risk scoring", + "input": "IP, URL, domain, or IOC", + "output": "Enriched threat intelligence and risk factors", + "opsec": "passive", + "opsecNote": "Passive querying of enrichment database", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Mr.Looquer IOC Feed - 1st Dual Stack Threat Feed", "type": "url", - "url": "https://iocfeed.mrlooquer.com" + "url": "https://iocfeed.mrlooquer.com/", + "description": "Threat intelligence feed providing IOC data with IPv4/IPv6 dual stack support.", + "status": "live", + "pricing": "free", + "bestFor": "IOC threat feed access", + "input": "Feed subscription", + "output": "IOC threat intelligence feed", + "opsec": "passive", + "opsecNote": "Passive threat feed consumption", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "REScure Cyber Threat Intelligence Project", "type": "url", - "url": "https://rescure.me/feeds.html" + "url": "https://rescure.me/", + "description": "Community-driven cyber threat intelligence project providing IOC feeds and research.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence feeds", + "input": "IOC feed subscription", + "output": "IOC threat intelligence", + "opsec": "passive", + "opsecNote": "Passive threat feed access", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Attack Surface / Security Testing", @@ -17589,7 +20599,22 @@ { "name": "ImmuniWeb", "type": "url", - "url": "https://www.immuniweb.com/" + "url": "https://www.immuniweb.com/", + "description": "AI-powered application security platform for web penetration testing and vulnerability scanning.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web security testing and scanning", + "input": "Web application or target URL", + "output": "Vulnerability reports and risk assessment", + "opsec": "active", + "opsecNote": "Performs actual penetration testing and scanning - generates server logs", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -17867,7 +20892,7 @@ "url": "https://themanyhats.club/centralised-place-for-privacy-resources/" }, { - "name": "The Hitchhiker\u2019s Guide to Online Anonymity", + "name": "The Hitchhiker’s Guide to Online Anonymity", "type": "url", "url": "https://anonymousplanet.org/guide/" }, @@ -18148,4 +21173,4 @@ ] } ] -} \ No newline at end of file +}