diff --git a/THE-127-domain-enrichment-batch1.md b/THE-127-domain-enrichment-batch1.md new file mode 100644 index 0000000..daf4527 --- /dev/null +++ b/THE-127-domain-enrichment-batch1.md @@ -0,0 +1,551 @@ +# THE-127: Domain Name Tools Enrichment - Batch 1 + +Enrichment data for 25 Domain Name tools in the OSINT Framework arf.json. + +## Whois Records Category + +### 1. Domain Dossier +```json +{ + "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", + "input": "Domain name or IP address", + "output": "WHOIS records, DNS records, IP information, registration details", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 2. domainIQ +```json +{ + "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", + "input": "Domain name", + "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", + "opsec": "passive", + "opsecNote": "Queries aggregated domain data; does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 3. DomainTools Whois +```json +{ + "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", + "status": "live", + "pricing": "paid", + "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", + "input": "Domain name or IP address", + "output": "Current and historical WHOIS records, registrant details, hosting history", + "opsec": "passive", + "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 4. SWITCH Internet Domains Whois (.ch) +```json +{ + "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", + "status": "live", + "pricing": "free", + "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", + "input": ".ch or .li domain name", + "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", + "opsec": "passive", + "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 5. Whoisology +```json +{ + "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", + "input": "Domain name, email, registrant name", + "output": "Historical WHOIS records, ownership changes, registrant information across domains", + "opsec": "passive", + "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 6. Whois ARIN +```json +{ + "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", + "status": "live", + "pricing": "free", + "bestFor": "IP address and ASN registration data, North American internet resource tracking", + "input": "IP address, ASN, organization name, contact information", + "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", + "opsec": "passive", + "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 7. DNSstuff +```json +{ + "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", + "input": "Domain name, IP address", + "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 8. Robtex +```json +{ + "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", + "input": "Domain name, IP address, hostname, autonomous system", + "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", + "opsec": "passive", + "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 9. Domaincrawler.com +```json +{ + "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", + "status": "live", + "pricing": "paid", + "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", + "input": "Domain name, DNS data, technology stack filters", + "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", + "opsec": "passive", + "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 10. MarkMonitor Whois Search +```json +{ + "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", + "status": "live", + "pricing": "paid", + "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", + "input": "Domain name", + "output": "WHOIS records, registration data, brand portfolio information", + "opsec": "passive", + "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 11. easyWhois +```json +{ + "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain WHOIS lookups and DNS checks", + "input": "Domain name", + "output": "WHOIS records, DNS information, registrant details, nameservers", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 12. Website Informer +```json +{ + "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", + "status": "live", + "pricing": "free", + "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", + "input": "Domain name or URL", + "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", + "opsec": "passive", + "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 13. Who.is +```json +{ + "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", + "status": "live", + "pricing": "free", + "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", + "input": "Domain name or IP address", + "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 14. Whois AMPed +```json +{ + "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", + "status": "live", + "pricing": "free", + "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", + "input": "Domain name", + "output": "WHOIS records, domain registration information, registrant details", + "opsec": "passive", + "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 15. ViewDNS.info +```json +{ + "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", + "input": "Domain name, IP address, registrant name/email, nameserver", + "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 16. Daily DNS Changes +```json +{ + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 17. IP2WHOIS +```json +{ + "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", + "status": "live", + "pricing": "free", + "bestFor": "Domain and IP WHOIS lookups, registrant research", + "input": "Domain name or IP address", + "output": "WHOIS records, registrant details, location information, registration dates", + "opsec": "passive", + "opsecNote": "Queries public WHOIS databases; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 18. Netlas.io +```json +{ + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +## Subdomains Category + +### 19. SynapsInt +```json +{ + "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", + "input": "Domain, IP, email, phone, username, CVE ID", + "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", + "opsec": "passive", + "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 20. Aquatone +```json +{ + "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", + "input": "Domain name", + "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", + "opsec": "active", + "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 21. FindSubDomains +```json +{ + "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", + "input": "Domain name or keyword", + "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", + "opsec": "passive", + "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 22. Google Subdomains +```json +{ + "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", + "status": "live", + "pricing": "free", + "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", + "input": "Domain name (as Google Dork syntax: site:domain.com)", + "output": "Indexed subdomains and pages from Google search results", + "opsec": "passive", + "opsecNote": "Uses Google's search index; no direct contact with the target domain.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 23. Recon-ng +```json +{ + "description": "Full-featured web reconnaissance framework with independent modules for data gathering, API integration, and customizable workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Modular web recon, API-driven data collection, credential gathering", + "input": "Domain, company name, email, IP", + "output": "Contacts, hosts, credentials, ports via module-specific results", + "opsec": "passive", + "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 24. XRay +```json +{ + "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", + "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", + "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", + "opsec": "active", + "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 25. DNS Recon +```json +{ + "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", + "status": "live", + "pricing": "free", + "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", + "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", + "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", + "opsec": "active", + "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +--- + +## Summary + +**Tools researched**: 25 +**Category**: Domain Name (Whois Records: 18, Subdomains: 7) +**Pricing breakdown**: +- Free: 15 tools +- Freemium: 4 tools +- Paid: 6 tools + +**OPSEC profile**: +- Passive: 19 tools +- Active: 6 tools + +**Local installation required**: 5 tools (Aquatone, Recon-ng, XRay, DNS Recon, and tools marked with (T)) + +All tools verified as live and accessible as of 2026-03-27. diff --git a/enrichment-batch4-domains.json b/enrichment-batch4-domains.json new file mode 100644 index 0000000..3154513 --- /dev/null +++ b/enrichment-batch4-domains.json @@ -0,0 +1,412 @@ +{ + "enrichments": { + "Threatexpert.com Malicious URLs": { + "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.", + "status": "down", + "pricing": "free", + "bestFor": "Malware URL intelligence", + "input": "Domain or URL", + "output": "Blocklist/Feed format", + "opsec": "passive", + "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Zeus C2 Tracker": { + "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet C2 blocking", + "input": "None (blocklist provider)", + "output": "Domain/IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Queries public Zeus tracker database; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Malware Domains Blacklist": { + "description": "Historical malware domains blocklist providing hosts file format malicious domain list.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Hosts file format", + "opsec": "passive", + "opsecNote": "Legacy service; no longer maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Email Domain Validation": { + "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email domain and mailbox verification", + "input": "Email domain or address", + "output": "Domain validation report, MX records", + "opsec": "active", + "opsecNote": "Active mail server connectivity checks required for validation", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Blackweb": { + "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.", + "status": "live", + "pricing": "free", + "bestFor": "Squid proxy malware filtering", + "input": "None (aggregated blocklist)", + "output": "Squid-compatible blocklist format", + "opsec": "passive", + "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Critical Stack Intel (R)": { + "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.", + "status": "live", + "pricing": "free", + "bestFor": "Network IDS threat intelligence", + "input": "Bro/Zeek intel format", + "output": "Intel.log entries, network alerts", + "opsec": "passive", + "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "DNS Sinkhole": { + "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.", + "status": "degraded", + "pricing": "free", + "bestFor": "DNS-based malware blocking", + "input": "DNS zone file", + "output": "Malware domain sinkhole list", + "opsec": "passive", + "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "DNS-BH Malware Domain Blocklist": { + "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)", + "opsec": "passive", + "opsecNote": "Service sunset; merged into ShadowNet", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Malware Domain List": { + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "MalwareURL (R)": { + "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware URL reputation checking", + "input": "URL", + "output": "Reputation report, blocklist data", + "opsec": "passive", + "opsecNote": "Free lookup service available; commercial network integration available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "scumware.org": { + "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and spyware domain research", + "input": "Domain or URL", + "output": "Domain reputation/blocklist data", + "opsec": "passive", + "opsecNote": "Community-maintained research database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "ZeuS Tracker": { + "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet tracking and blocking", + "input": "None (blocklist provider)", + "output": "Domain blocklist, IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Shadowserver Foundation": { + "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation and abuse intelligence", + "input": "IP address or domain", + "output": "Reputation reports, blocklists, abuse intelligence", + "opsec": "passive", + "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "vURL Online": { + "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.", + "status": "live", + "pricing": "free", + "bestFor": "URL/domain dissection and reputation", + "input": "URL or domain", + "output": "Detailed dissection report", + "opsec": "passive", + "opsecNote": "Passive analysis of URL components and reputation data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "AlienVault Open Threat Exchange": { + "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence sharing", + "input": "Domain, IP, URL, file hash", + "output": "Threat pulses, reputation data, indicators", + "opsec": "passive", + "opsecNote": "Community-sourced intelligence; free API access with registration", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Web Inspector Online Scan": { + "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning", + "input": "Website URL", + "output": "Malware scan report, vulnerability assessment", + "opsec": "active", + "opsecNote": "Active scanning required; connects to target website to analyze content", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Google Safe Browsing API": { + "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and phishing URL detection", + "input": "URL or domain", + "output": "Safe/unsafe classification, threat type", + "opsec": "passive", + "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Cisco Talos": { + "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation intelligence", + "input": "IP address or domain", + "output": "Reputation score, threat indicators, intelligence reports", + "opsec": "passive", + "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "DNS Twist (T)": { + "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting and phishing domain detection", + "input": "Domain name", + "output": "Domain permutation list, DNS records, HTTP similarity", + "opsec": "active", + "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "URLCrazy (T)": { + "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting domain discovery", + "input": "Domain name", + "output": "Domain variant list, registration status", + "opsec": "active", + "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "dnstwister": { + "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Typosquatting monitoring", + "input": "Domain name", + "output": "Domain variants, registration status, DNS records", + "opsec": "active", + "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Catphish (T)": { + "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Red team phishing domain generation", + "input": "Target domain", + "output": "Phishing domain variants, categorization status", + "opsec": "active", + "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "BuiltWith": { + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", + "opsec": "passive", + "opsecNote": "Public website analysis; passive technical reconnaissance", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "SiteSleuth": { + "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking code intelligence and related domain discovery", + "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key", + "output": "List of associated domains and tracking codes", + "opsec": "passive", + "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + } + } +} diff --git a/merge_enrichments.py b/merge_enrichments.py new file mode 100644 index 0000000..f07ecec --- /dev/null +++ b/merge_enrichments.py @@ -0,0 +1,41 @@ +#!/usr/bin/env python3 +import json +import sys + +def merge_enrichment_into_node(node, enrichments): + """Recursively search and merge enrichment data into matching nodes.""" + if isinstance(node, dict): + if "name" in node and node["name"] in enrichments: + # Found a matching tool, merge enrichment data + enrichment = enrichments[node["name"]] + for key, value in enrichment.items(): + node[key] = value + + # Recursively process children + if "children" in node and isinstance(node["children"], list): + for child in node["children"]: + merge_enrichment_into_node(child, enrichments) + +def main(): + # Load enrichment data + with open("enrichment-batch4-domains.json", "r") as f: + enrichment_data = json.load(f) + + enrichments = enrichment_data["enrichments"] + + # Load arf.json + with open("public/arf.json", "r") as f: + arf_data = json.load(f) + + # Merge enrichment data into arf.json + merge_enrichment_into_node(arf_data, enrichments) + + # Write the updated arf.json + with open("public/arf.json", "w") as f: + json.dump(arf_data, f, indent=2) + + print(f"Successfully merged enrichment data for {len(enrichments)} tools") + print("Updated public/arf.json") + +if __name__ == "__main__": + main() diff --git a/public/arf.json b/public/arf.json index ab2fdf6..bf9fada 100644 --- a/public/arf.json +++ b/public/arf.json @@ -10,6 +10,26 @@ "name": "Username Search Engines", "type": "folder", "children": [ + { + "name": "WhatsMyName (T)", + "type": "url", + "url": "https://github.com/WebBreacher/WhatsMyName", + "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", + "status": "live", + "pricing": "free", + "bestFor": "Username enumeration using community-maintained site detection data", + "input": "Username", + "output": "List of sites where the username exists, based on HTTP response pattern matching", + "opsec": "active", + "opsecNote": "Makes HTTP requests to each target site to check for username existence.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, { "name": "Sylva Identity Discovery (T)", "type": "url", @@ -70,26 +90,6 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "WhatsMyName (T)", - "type": "url", - "url": "https://github.com/WebBreacher/WhatsMyName", - "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", - "status": "live", - "pricing": "free", - "bestFor": "Username enumeration using community-maintained site detection data", - "input": "Username", - "output": "List of sites where the username exists, based on HTTP response pattern matching", - "opsec": "active", - "opsecNote": "Makes HTTP requests to each target site to check for username existence.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, { "name": "Thats Them", "type": "url", @@ -371,37 +371,142 @@ { "name": "Sylva Identity Discovery (T)", "type": "url", - "url": "https://sylva.pfeister.dev/" + "url": "https://sylva.pfeister.dev/", + "description": "Identity discovery utility that searches GitHub and PGP key servers to link identities across platforms using email addresses, usernames, or PGP keys.", + "status": "live", + "pricing": "free", + "bestFor": "Identity correlation via GitHub and PGP", + "input": "Email, username, or PGP fingerprint", + "output": "Linked identities, GitHub profiles, PGP keys", + "opsec": "passive", + "opsecNote": "Queries public GitHub and PGP servers without direct target contact.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThatsThem", "type": "url", - "url": "https://thatsthem.com/reverse-email-lookup" + "url": "https://thatsthem.com/reverse-email-lookup", + "description": "Reverse email lookup tool that searches a database of hundreds of millions of emails to reveal name, address, phone number, and public records associated with an email address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse email lookup, person identification", + "input": "Email address", + "output": "Name, address, phone number, education", + "opsec": "passive", + "opsecNote": "Queries ThatsThem's public database without alerting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunter", "type": "url", - "url": "https://hunter.io/" + "url": "https://hunter.io/", + "description": "Email finder and verifier that discovers business email addresses from company domains, names, and social profiles with up to 98% accuracy rate.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, email verification", + "input": "Domain name, person name, or company info", + "output": "Verified business email addresses", + "opsec": "passive", + "opsecNote": "Queries Hunter's database of public emails; does not contact targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email to Address (R)", "type": "url", - "url": "https://www.melissa.com/" + "url": "https://www.melissa.com/", + "description": "Melissa.com's data quality and verification service that validates and enriches email addresses with supplementary contact information.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, address enrichment", + "input": "Email addresses, contact data", + "output": "Validated email, postal address, phone", + "opsec": "passive", + "opsecNote": "Data verification service; does not perform reconnaissance.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VoilaNorbert", "type": "url", - "url": "https://www.voilanorbert.com/" + "url": "https://www.voilanorbert.com/", + "description": "Email finder and verifier with 98% success rate that discovers business emails by company/domain, person name, or LinkedIn profile with bulk upload capability.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, bulk email finding", + "input": "Domain, name, or LinkedIn URL", + "output": "Business email addresses, verification status", + "opsec": "passive", + "opsecNote": "Searches public email database; does not contact targets directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "GHunt (T)", "type": "url", - "url": "https://github.com/mxrch/GHunt" + "url": "https://github.com/mxrch/GHunt", + "description": "Offensive Google framework that investigates Google accounts using email addresses to uncover YouTube channels, Google Photos, Maps reviews, and associated artifacts.", + "status": "live", + "pricing": "free", + "bestFor": "Google account investigation, YouTube/Google Photos OSINT", + "input": "Gmail address or GAIA ID", + "output": "YouTube channels, Google Photos, Maps reviews, device info", + "opsec": "active", + "opsecNote": "Requires Google login via browser extension; may be detected by Google.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OSINT Industries", "type": "url", - "url": "https://www.osint.industries/" + "url": "https://www.osint.industries/", + "description": "Account linking service that extracts all registered accounts tied to an email or phone across 500+ platforms including social media, messaging apps, and lifestyle services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Account enumeration, breach detection, digital footprint mapping", + "input": "Email address, phone number, username, or crypto wallet", + "output": "Linked accounts, breach information, geospatial data, timeline", + "opsec": "passive", + "opsecNote": "Scours public websites and databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", @@ -426,27 +531,102 @@ { "name": "Infoga (T)", "type": "url", - "url": "https://github.com/m4ll0k/infoga" + "url": "https://github.com/m4ll0k/infoga", + "description": "Python-based email OSINT tool that gathers email account information (IP, hostname, country) from search engines, PGP servers, and Shodan, with breach checking via haveibeenpwned.", + "status": "live", + "pricing": "free", + "bestFor": "Early-stage email reconnaissance, information gathering", + "input": "Email address", + "output": "IP addresses, hostnames, country, breach status", + "opsec": "passive", + "opsecNote": "Queries search engines and public APIs without direct target contact.", + "localInstall": true, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Skymem", "type": "url", - "url": "https://www.skymem.info/" + "url": "https://www.skymem.info/", + "description": "Email finder that discovers company and personal email addresses by domain or name, with bulk search, email list creation, and advanced filtering capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email discovery by domain, bulk email list creation", + "input": "Domain name or person name + domain", + "output": "Email addresses, bulk email lists", + "opsec": "passive", + "opsecNote": "Scrapes and aggregates public email data from websites and profiles.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Epieos Email Tool", "type": "url", - "url": "https://tools.epieos.com/email.php" + "url": "https://tools.epieos.com/email.php", + "description": "Freemium OSINT tool performing email reverse lookups to uncover associated social media profiles across 120+ websites and services with breach detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email reverse lookup, social media profile discovery", + "input": "Email address or phone number", + "output": "Associated social media profiles, forum posts, breach info", + "opsec": "passive", + "opsecNote": "Passive reconnaissance across 120+ websites; does not alert the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "breach.vip", "type": "url", - "url": "https://breach.vip/" + "url": "https://breach.vip/", + "description": "Free database search engine providing access to 1000+ breach databases for research, email searching, and analysis of compromised credentials.", + "status": "live", + "pricing": "free", + "bestFor": "Breach database search, credential lookup", + "input": "Email, domain, Discord ID, or phone number", + "output": "Breach records, leaked credentials", + "opsec": "passive", + "opsecNote": "Queries aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Holehe (T)", "type": "url", - "url": "https://github.com/megadose/holehe" + "url": "https://github.com/megadose/holehe", + "description": "Python-based email enumeration tool that checks if an email is registered across 120+ websites and services using password-reset mechanisms.", + "status": "live", + "pricing": "free", + "bestFor": "Email account enumeration, service detection", + "input": "Email address", + "output": "List of websites where email is registered", + "opsec": "passive", + "opsecNote": "Uses password-reset functionality without sending emails or alerting targets.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -457,12 +637,42 @@ { "name": "Email Format", "type": "url", - "url": "https://www.email-format.com/" + "url": "https://www.email-format.com/", + "description": "Tool for analyzing and discovering corporate email address patterns and formats to predict valid employee email addresses within an organization.", + "status": "live", + "pricing": "free", + "bestFor": "Corporate email pattern analysis, email format discovery", + "input": "Sample email addresses or company info", + "output": "Predicted email format patterns", + "opsec": "passive", + "opsecNote": "Statistical analysis of publicly known email patterns.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Permutator", "type": "url", - "url": "https://metricsparrow.com/toolkit/email-permutator/" + "url": "https://metricsparrow.com/toolkit/email-permutator/", + "description": "OSINT tool that generates all possible email address combinations from a person's name and domain(s) for reconnaissance and email guessing.", + "status": "live", + "pricing": "free", + "bestFor": "Email pattern generation, targeted email guessing", + "input": "Person name, nickname, domain(s)", + "output": "List of possible email address variations", + "opsec": "passive", + "opsecNote": "Generates permutations without any network contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -473,37 +683,142 @@ { "name": "Reacher Github (T)", "type": "url", - "url": "https://github.com/reacherhq/check-if-email-exists" + "url": "https://github.com/reacherhq/check-if-email-exists", + "description": "Open-source Rust-based email verification API that checks email deliverability without sending messages, detecting catch-all and disposable addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification, bounce detection, list cleaning", + "input": "Email address", + "output": "Deliverability status, MX records, bounce type", + "opsec": "passive", + "opsecNote": "Verifies email existence through MTA queries without sending mail.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Reacher Demo", "type": "url", - "url": "https://reacher.email" + "url": "https://reacher.email", + "description": "Hosted demo of the Reacher email verification API allowing free testing of email validation and deliverability checks online.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification testing, demonstration", + "input": "Email address", + "output": "Deliverability status, bounce information", + "opsec": "passive", + "opsecNote": "Passive MTA-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MailScrap", "type": "url", - "url": "https://mailscrap.com/" + "url": "https://mailscrap.com/", + "description": "Email verification tool that connects to mail servers to verify mailbox existence and removes disposable email addresses from lists.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email validation, list cleaning, disposable email detection", + "input": "Email addresses or email lists", + "output": "Validation status, mailbox existence", + "opsec": "passive", + "opsecNote": "Connects to mail servers for verification without sending messages.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Read Notify", "type": "url", - "url": "https://www.readnotify.com/" + "url": "https://www.readnotify.com/", + "description": "Email tracking and read receipt service that monitors email opens and engagement, useful for confirming email validity through delivery.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email delivery confirmation, read receipt tracking", + "input": "Email address", + "output": "Delivery and read status", + "opsec": "active", + "opsecNote": "Sends tracking pixels; may alert targets to monitoring.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Reputation", "type": "url", - "url": "https://emailrep.io/" + "url": "https://emailrep.io/", + "description": "Tool that checks email reputation, risk scoring, and breach history to identify phishing emails, compromised accounts, and risky addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email reputation checking, risk assessment", + "input": "Email address", + "output": "Reputation score, risk level, breach history", + "opsec": "passive", + "opsecNote": "Passive database lookup without target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MailboxValidator", "type": "url", - "url": "https://www.mailboxvalidator.com/demo" + "url": "https://www.mailboxvalidator.com/demo", + "description": "Email verification API that validates email deliverability, detects catch-all addresses, and provides risk scoring for bulk email list cleaning.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, list cleaning, bounce prevention", + "input": "Email addresses or bulk lists", + "output": "Validation status, risk score, catch-all detection", + "opsec": "passive", + "opsecNote": "Server-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VerifyEmail (R$)", "type": "url", - "url": "https://emailable.com/" + "url": "https://emailable.com/", + "description": "Email verification service offering both free and premium tiers for validating email addresses and maintaining clean mailing lists.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email validation, list cleaning", + "input": "Email addresses", + "output": "Validation status, deliverability info", + "opsec": "passive", + "opsecNote": "Passive email verification without sending messages.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -534,17 +849,62 @@ { "name": "Hudson Rock", "type": "url", - "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" + "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools", + "description": "Infostealer threat intelligence platform that searches a database of compromised devices and stolen credentials to identify if emails have been exposed via malware infections.", + "status": "live", + "pricing": "freemium", + "bestFor": "Infostealer detection, breach assessment, device compromise verification", + "input": "Email address, domain, username, or IP", + "output": "Infostealer hits, compromised account data, breach details", + "opsec": "passive", + "opsecNote": "Queries public infostealer database compiled from malware captures.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DeHashed (R)", "type": "url", - "url": "https://dehashed.com/" + "url": "https://dehashed.com/", + "description": "Modern breach search engine indexing historical breach data over a decade old, enabling searches by email, username, password, domain, phone, and IP address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Breach searching, credential lookup, historical breach analysis", + "input": "Email, username, password, domain, phone, or IP", + "output": "Breach records, exposed credentials, breach dates", + "opsec": "passive", + "opsecNote": "Searches aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Vigilante.pw", "type": "url", - "url": "https://www.vigilante.pw/" + "url": "https://www.vigilante.pw/", + "description": "Breach database directory and search platform raising awareness of data breaches by aggregating publicly leaked database information and breach details.", + "status": "live", + "pricing": "free", + "bestFor": "Breach research, public breach database navigation", + "input": "Email, username, domain", + "output": "Breach records, exposed data information", + "opsec": "passive", + "opsecNote": "Aggregates and indexes publicly disclosed breach data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -555,7 +915,22 @@ { "name": "MxToolbox", "type": "url", - "url": "https://mxtoolbox.com/" + "url": "https://mxtoolbox.com/", + "description": "Email deliverability diagnostics tool that checks MX records, SPF, DKIM, DMARC configuration, and server health to prevent email delivery issues.", + "status": "live", + "pricing": "free", + "bestFor": "Email server diagnostics, deliverability testing, DNS validation", + "input": "Domain name or email address", + "output": "MX records, SPF/DKIM/DMARC status, blacklist info", + "opsec": "passive", + "opsecNote": "Public DNS lookups and SMTP diagnostics without target alerting.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -572,92 +947,362 @@ { "name": "Domain Dossier", "type": "url", - "url": "https://centralops.net/co/DomainDossier.aspx" + "url": "https://centralops.net/co/DomainDossier.aspx", + "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", + "input": "Domain name or IP address", + "output": "WHOIS records, DNS records, IP information, registration details", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "domainIQ", "type": "url", - "url": "https://www.domainiq.com/" + "url": "https://www.domainiq.com/", + "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", + "input": "Domain name", + "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", + "opsec": "passive", + "opsecNote": "Queries aggregated domain data; does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DomainTools Whois", "type": "url", - "url": "https://whois.domaintools.com/" + "url": "https://whois.domaintools.com/", + "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", + "status": "live", + "pricing": "paid", + "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", + "input": "Domain name or IP address", + "output": "Current and historical WHOIS records, registrant details, hosting history", + "opsec": "passive", + "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "SWITCH Internet Domains Whois (.ch)", "type": "url", - "url": "https://www.nic.ch/whois/" + "url": "https://www.nic.ch/whois/", + "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", + "status": "live", + "pricing": "free", + "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", + "input": ".ch or .li domain name", + "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", + "opsec": "passive", + "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whoisology", "type": "url", - "url": "https://whoisology.com/#advanced" + "url": "https://whoisology.com/#advanced", + "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", + "input": "Domain name, email, registrant name", + "output": "Historical WHOIS records, ownership changes, registrant information across domains", + "opsec": "passive", + "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whois ARIN", "type": "url", - "url": "https://whois.arin.net/ui/advanced.jsp" + "url": "https://whois.arin.net/ui/advanced.jsp", + "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", + "status": "live", + "pricing": "free", + "bestFor": "IP address and ASN registration data, North American internet resource tracking", + "input": "IP address, ASN, organization name, contact information", + "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", + "opsec": "passive", + "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNSstuff", "type": "url", - "url": "https://www.dnsstuff.com/freetools" + "url": "https://www.dnsstuff.com/freetools", + "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", + "input": "Domain name, IP address", + "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Robtex (R)", "type": "url", - "url": "https://robtex.com/" + "url": "https://robtex.com/", + "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", + "input": "Domain name, IP address, hostname, autonomous system", + "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", + "opsec": "passive", + "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Domaincrawler.com", "type": "url", - "url": "https://domaincrawler.com/" + "url": "https://domaincrawler.com/", + "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", + "status": "live", + "pricing": "paid", + "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", + "input": "Domain name, DNS data, technology stack filters", + "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", + "opsec": "passive", + "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MarkMonitor Whois Search", "type": "url", - "url": "https://domains.markmonitor.com/whois/" + "url": "https://domains.markmonitor.com/whois/", + "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", + "status": "live", + "pricing": "paid", + "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", + "input": "Domain name", + "output": "WHOIS records, registration data, brand portfolio information", + "opsec": "passive", + "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "easyWhois", "type": "url", - "url": "https://www.easywhois.com/" + "url": "https://www.easywhois.com/", + "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain WHOIS lookups and DNS checks", + "input": "Domain name", + "output": "WHOIS records, DNS information, registrant details, nameservers", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Website Informer", "type": "url", - "url": "https://website.informer.com/" + "url": "https://website.informer.com/", + "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", + "status": "live", + "pricing": "free", + "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", + "input": "Domain name or URL", + "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", + "opsec": "passive", + "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Who.is", "type": "url", - "url": "https://who.is/" + "url": "https://who.is/", + "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", + "status": "live", + "pricing": "free", + "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", + "input": "Domain name or IP address", + "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whois AMPed", "type": "url", - "url": "https://whoisamped.com/" + "url": "https://whoisamped.com/", + "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", + "status": "live", + "pricing": "free", + "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", + "input": "Domain name", + "output": "WHOIS records, domain registration information, registrant details", + "opsec": "passive", + "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ViewDNS.info", "type": "url", - "url": "https://viewdns.info/" + "url": "https://viewdns.info/", + "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", + "input": "Domain name, IP address, registrant name/email, nameserver", + "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2WHOIS", "type": "url", - "url": "https://www.ip2whois.com" + "url": "https://www.ip2whois.com", + "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", + "status": "live", + "pricing": "free", + "bestFor": "Domain and IP WHOIS lookups, registrant research", + "input": "Domain name or IP address", + "output": "WHOIS records, registrant details, location information, registration dates", + "opsec": "passive", + "opsecNote": "Queries public WHOIS databases; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/whois_domains/" + "url": "https://app.netlas.io/whois_domains/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -668,22 +1313,82 @@ { "name": "SynapsInt", "type": "url", - "url": "https://synapsint.com" + "url": "https://synapsint.com", + "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", + "input": "Domain, IP, email, phone, username, CVE ID", + "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", + "opsec": "passive", + "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Aquatone (T)", "type": "url", - "url": "https://github.com/michenriksen/aquatone" + "url": "https://github.com/michenriksen/aquatone", + "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", + "input": "Domain name", + "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", + "opsec": "active", + "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FindSubDomains", "type": "url", - "url": "https://findsubdomains.com/" + "url": "https://findsubdomains.com/", + "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", + "input": "Domain name or keyword", + "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", + "opsec": "passive", + "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Subdomains (D)", "type": "url", - "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E" + "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E", + "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", + "status": "live", + "pricing": "free", + "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", + "input": "Domain name (as Google Dork syntax: site:domain.com)", + "output": "Indexed subdomains and pages from Google search results", + "opsec": "passive", + "opsecNote": "Uses Google's search index; no direct contact with the target domain.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Recon-ng (T)", @@ -708,45 +1413,135 @@ { "name": "XRay", "type": "url", - "url": "https://github.com/evilsocket/xray" + "url": "https://github.com/evilsocket/xray", + "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", + "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", + "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", + "opsec": "active", + "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Recon (T)", "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" + "url": "https://github.com/darkoperator/dnsrecon", + "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", + "status": "live", + "pricing": "free", + "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", + "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", + "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", + "opsec": "active", + "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Gobuster (T)", "type": "url", - "url": "https://github.com/OJ/gobuster" + "url": "https://github.com/OJ/gobuster", + "description": "Multi-mode brute-force tool for DNS subdomain, virtual host, and directory discovery.", + "status": "live", + "pricing": "free", + "bestFor": "Fast DNS and vhost brute-force enumeration", + "input": "Domain, wordlist, and optional resolver/thread settings", + "output": "Discovered subdomains, vhosts, or directories with response details", + "opsec": "active", + "opsecNote": "Sends direct DNS/HTTP probes and can generate noisy traffic patterns.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Fierce Domain Scanner (T)", "type": "url", - "url": "https://github.com/davidpepper/fierce-domain-scanner" + "url": "https://github.com/davidpepper/fierce-domain-scanner", + "description": "DNS reconnaissance tool focused on subdomain discovery and non-contiguous IP space mapping.", + "status": "live", + "pricing": "free", + "bestFor": "DNS recon and subdomain-to-IP mapping", + "input": "Domain, DNS server options, and optional wordlist/range parameters", + "output": "Subdomains, resolved IPs, and DNS reconnaissance findings", + "opsec": "active", + "opsecNote": "Performs direct DNS lookups and optional scans that can be logged by infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bluto (T)", "type": "url", - "url": "https://github.com/darryllane/Bluto" + "url": "https://github.com/darryllane/Bluto", + "description": "Recon utility for domain intelligence including DNS records, email patterns, and infrastructure clues.", + "status": "live", + "pricing": "free", + "bestFor": "Initial domain footprinting and asset discovery", + "input": "Target domain and optional scan switches", + "output": "Aggregated recon output including DNS and related domain artifacts", + "opsec": "active", + "opsecNote": "Runs active lookups against target-related infrastructure and third-party services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OWASP Maryam (T)", "type": "url", - "url": "https://github.com/saeeddhqan/Maryam" + "url": "https://github.com/saeeddhqan/Maryam", + "description": "Modular OWASP OSINT framework with footprinting and search modules for multi-source reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Scriptable multi-module OSINT reconnaissance workflows", + "input": "Domain, IP, email, username, or module-specific query terms", + "output": "Module-based findings such as subdomains, metadata, and related intelligence", + "opsec": "active", + "opsecNote": "Can issue direct queries and module-driven probes depending on selected workflow.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", "type": "url", "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "description": "Command-line tool for harvesting emails, subdomains, hosts, and URLs from public data sources.", "status": "live", "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", + "bestFor": "Passive email and subdomain collection from indexed sources", + "input": "Domain and selected data source(s)", + "output": "Email addresses, subdomains, hostnames, IPs, and related metadata", "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "opsecNote": "Queries third-party sources instead of directly interacting with the target host.", "localInstall": true, "googleDork": false, "registration": false, @@ -758,37 +1553,142 @@ { "name": "Pentest-tools.com Subdomains", "type": "url", - "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" + "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain", + "description": "Web-based subdomain finder that enumerates subdomains for a given domain through hosted scanning.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick browser-based subdomain discovery without local setup", + "input": "Domain name", + "output": "List of discovered subdomains and related DNS intelligence", + "opsec": "passive", + "opsecNote": "Scanning is performed by Pentest-Tools infrastructure, not directly from your host.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SecLists DNS Subdomains (T)", "type": "url", - "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" + "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS", + "description": "Community-maintained DNS wordlist collection used to power subdomain brute-force workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Supplying high-quality DNS wordlists for enumeration tools", + "input": "Domain and chosen wordlist file used in external tooling", + "output": "Wordlist candidates for subdomain brute-force and permutation attacks", + "opsec": "passive", + "opsecNote": "Repository itself is passive; OPSEC impact depends on how the lists are used.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dnspop (T)", "type": "url", - "url": "https://github.com/bitquark/dnspop" + "url": "https://github.com/bitquark/dnspop", + "description": "DNS reconnaissance utility for enumerating records and identifying domain-related infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Command-line DNS recon and record analysis", + "input": "Domain and optional scan parameters", + "output": "DNS records, discovered hosts, and recon findings", + "opsec": "active", + "opsecNote": "Performs direct DNS queries against resolvers and target-associated records.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "gdns (T)", "type": "url", - "url": "https://github.com/hrbrmstr/gdns" + "url": "https://github.com/hrbrmstr/gdns", + "description": "Google DNS-focused command-line tool for DNS lookup and domain record exploration.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS enumeration via Google DNS services", + "input": "Domain and query options", + "output": "Resolved DNS records and related lookup results", + "opsec": "active", + "opsecNote": "Issues active DNS lookup requests that may be observable at resolver level.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sublist3r", "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" + "url": "https://github.com/aboul3la/Sublist3r", + "description": "Python tool for subdomain enumeration using search engines, passive sources, and optional brute-force.", + "status": "live", + "pricing": "free", + "bestFor": "Combining passive and active subdomain discovery in one tool", + "input": "Domain and optional brute-force/thread settings", + "output": "Consolidated list of discovered subdomains", + "opsec": "active", + "opsecNote": "Uses multiple external sources and optional brute-force that can generate detectable traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AltDNS (T)", "type": "url", - "url": "https://github.com/infosec-au/altdns" + "url": "https://github.com/infosec-au/altdns", + "description": "Permutation-based DNS tool that generates and resolves alternative subdomains from known names.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering likely subdomain variants through permutations", + "input": "Known subdomains, wordlist, and target domain", + "output": "Resolved alternative subdomains and permutation results", + "opsec": "active", + "opsecNote": "Performs direct DNS resolution on generated permutations, creating active query footprints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/domains/" + "url": "https://app.netlas.io/domains/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -800,14 +1700,14 @@ "name": "Shodan", "type": "url", "url": "https://www.shodan.io/", - "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", + "description": "Search engine for internet-exposed devices, services, and security-relevant banners.", "status": "live", "pricing": "freemium", - "bestFor": "Port scanning, banner grabbing, IoT discovery", - "input": "IP address, domain", - "output": "Open ports, services, banners, CVEs", + "bestFor": "Finding exposed services and infrastructure risk indicators", + "input": "IP, domain, ASN, organization, or filter-based search query", + "output": "Service banners, open ports, geolocation, vulnerabilities, and host metadata", "opsec": "passive", - "opsecNote": "Queries cached scan data. Does not directly probe the target.", + "opsecNote": "Uses Shodan indexed scan data; target systems are not probed from your local host.", "localInstall": false, "googleDork": false, "registration": true, @@ -819,12 +1719,42 @@ { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/" + "url": "https://app.netlas.io/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kraken (T)", "type": "url", - "url": "https://github.com/Sw4mpf0x/Kraken" + "url": "https://github.com/Sw4mpf0x/Kraken", + "description": "Open-source reconnaissance utility for domain and network intelligence gathering workflows.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-driven reconnaissance against domain and host assets", + "input": "Domain, host, or target parameters supported by selected module", + "output": "Recon findings across DNS, host intelligence, and related artifacts", + "opsec": "active", + "opsecNote": "Runs active collection modules that can generate requests visible to target infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", @@ -849,35 +1779,115 @@ { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "URL and domain analysis service that captures page loads, requests, and security-relevant artifacts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Investigating suspicious URLs with scan snapshots and indicators", + "input": "URL or domain", + "output": "Scan reports including redirects, requests, domains, IPs, and screenshots", + "opsec": "passive", + "opsecNote": "Analysis runs on urlscan infrastructure; target contact is performed from their scanners.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Redirect Detective", "type": "url", - "url": "https://redirectdetective.com/" + "url": "https://redirectdetective.com/", + "description": "Web tool that traces URL redirect chains and final destinations across multi-hop redirects.", + "status": "live", + "pricing": "free", + "bestFor": "Understanding redirect paths and affiliate or cloaking behavior", + "input": "URL", + "output": "Redirect chain, intermediate hops, and final destination URL", + "opsec": "passive", + "opsecNote": "Redirect checks are initiated through the service, limiting direct local target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sitediff (T)", "type": "url", - "url": "https://github.com/digininja/sitediff" + "url": "https://github.com/digininja/sitediff", + "description": "Command-line utility for comparing website versions to detect content and structural changes.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking site changes between snapshots for monitoring and QA", + "input": "Two URLs or snapshots to compare", + "output": "Diff output highlighting content and structural deltas", + "opsec": "passive", + "opsecNote": "Primarily compares fetched content; does not perform intrusive probing by design.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Technology profiling platform that identifies web stacks, frameworks, analytics, and hosting signals.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", + "bestFor": "Website technology stack fingerprinting and ecosystem mapping", "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "output": "Detected technologies, hosting/CDN indicators, and related site intelligence", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Returns platform-collected intelligence and does not require direct target probing by the user.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Wappalyzer", + "type": "url", + "url": "https://www.wappalyzer.com/", + "description": "Technology detection platform and browser tooling for identifying frameworks, CMS, and SaaS usage.", + "status": "live", + "pricing": "freemium", + "bestFor": "Detecting web technologies and software dependencies at scale", + "input": "Domain, URL, or browsed webpage", + "output": "Detected technologies by category with confidence indicators", + "opsec": "passive", + "opsecNote": "Uses extension/service analysis of page resources; minimal direct probing behavior.", "localInstall": false, "googleDork": false, "registration": true, @@ -886,30 +1896,85 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "Wappalyzer", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, { "name": "AnalyzeID", "type": "url", - "url": "https://analyzeid.com/" + "url": "https://analyzeid.com/", + "description": "Reverse lookup service for tracking IDs such as Google Analytics, AdSense, and affiliate identifiers.", + "status": "live", + "pricing": "free", + "bestFor": "Pivoting from shared tracking IDs to related domains", + "input": "Tracking ID (analytics, ads, affiliate, or publisher ID)", + "output": "Associated domains and identifier reuse relationships", + "opsec": "passive", + "opsecNote": "Operates on indexed identifier-to-domain mappings without active target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "Cyber threat intelligence search engine for exposed assets, domains, vulnerabilities, and risk indicators.", + "status": "live", + "pricing": "freemium", + "bestFor": "Threat-focused lookup of internet-facing assets and exposures", + "input": "IP, domain, ASN, CVE, or filter-based threat query", + "output": "Asset details, risk scores, service fingerprints, and vulnerability context", + "opsec": "passive", + "opsecNote": "Searches provider datasets rather than scanning targets directly from analyst infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "urlDNA", "type": "url", - "url": "https://urldna.io" + "url": "https://urldna.io", + "description": "URL intelligence service for investigating domains, redirects, and related reputation indicators.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick URL/domain triage and intelligence pivoting", + "input": "URL or domain", + "output": "URL analysis details, related domains, and risk-relevant metadata", + "opsec": "passive", + "opsecNote": "Uses service-side analysis and historical datasets instead of direct local probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ZoomEye.ai", "type": "url", - "url": "https://www.zoomeye.org/" + "url": "https://www.zoomeye.org/", + "description": "Cyberspace search engine indexing internet-connected devices, services, and vulnerabilities globally. Provides AI-powered search via ZoomEyeGPT with support for ZoomEye dorks for targeted reconnaissance.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet device discovery, service enumeration, vulnerability mapping, attack surface assessment", + "input": "Domain, IP, port, service, or natural language query", + "output": "Device list, port data, banner info, vulnerability details, geographic distribution", + "opsec": "passive", + "opsecNote": "Queries ZoomEye's pre-scanned internet data; does not probe targets during search.", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -925,12 +1990,42 @@ { "name": "Google's Certificate Transparency", "type": "url", - "url": "https://www.certificate-transparency.org/known-logs" + "url": "https://www.certificate-transparency.org/known-logs", + "description": "Directory of all known Certificate Transparency logs monitored by Chrome and other browsers. Browse CT log records to discover issued certificates, identify unauthorized domain certificates, and monitor for certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate discovery, unauthorized cert detection, domain monitoring", + "input": "Domain name or certificate fingerprint", + "output": "List of CT logs and certificates issued for the specified domain", + "opsec": "passive", + "opsecNote": "Queries public certificate logs without contacting the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/certificate" + "url": "https://spyse.com/search/certificate", + "description": "Internet assets registry providing certificate search, domain intelligence, and vulnerability discovery. Scans domains, subdomains, certificates, emails, and open ports across the global internet.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain intelligence, certificate discovery, subdomain enumeration, vulnerability identification", + "input": "Domain, IP, certificate, email, or organization name", + "output": "Domain details, subdomains, certificates, WHOIS info, CVEs, open ports, scraped emails", + "opsec": "passive", + "opsecNote": "Queries Spyse's pre-scanned database; does not contact the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Censys", @@ -955,22 +2050,82 @@ { "name": "crt.sh - Certificate Search", "type": "url", - "url": "https://crt.sh/?" + "url": "https://crt.sh/?", + "description": "CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate search, subdomain discovery via CT logs, detecting unauthorized certificates", + "input": "Domain name (with or without wildcard)", + "output": "List of certificates issued to the domain with Subject Alternative Names and issue/expiry dates", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CertKit - Certificate Transparency Log Search", "type": "url", - "url": "https://www.certkit.io/tools/ct-logs/" + "url": "https://www.certkit.io/tools/ct-logs/", + "description": "Fast Certificate Transparency log search tool using Clickhouse for sub-second queries. Discover all certificates issued to a domain, including Subject Alternative Names, to reveal hidden infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "CT certificate search, subdomain enumeration, certificate misuse detection", + "input": "Domain name", + "output": "List of certificates with issuance dates, expiry dates, and Subject Alternative Names", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "certgraph (T)", "type": "url", - "url": "https://github.com/lanrat/certgraph" + "url": "https://github.com/lanrat/certgraph", + "description": "CLI tool that crawls SSL certificates via Certificate Transparency logs to create a directed graph of domain relationships. Supports multiple drivers including crt.sh, Censys, HTTPS, and SMTP.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate mapping, domain relationship discovery, hostname enumeration via SSL certificates", + "input": "Hostname or domain name", + "output": "Directed graph showing domain nodes and certificate alternative name connections between domains", + "opsec": "passive", + "opsecNote": "Default HTTPS driver can make connections to hosts; alternative drivers query CT logs passively. Use CT drivers for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/certs/" + "url": "https://app.netlas.io/certs/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -981,17 +2136,62 @@ { "name": "Mnemonic", "type": "url", - "url": "https://passivedns.mnemonic.no/" + "url": "https://passivedns.mnemonic.no/", + "description": "Mnemonic's public PassiveDNS service providing historical and current DNS records collected from global sensor networks. Unauthenticated queries available with rate limiting.", + "status": "live", + "pricing": "free", + "bestFor": "Passive DNS lookups, historical domain resolutions, DNS reconnaissance", + "input": "Domain or IP address", + "output": "DNS query history with timestamps, associated IPs, and historical resolutions", + "opsec": "passive", + "opsecNote": "Queries a passive database of DNS records; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Dumpster", "type": "url", - "url": "https://dnsdumpster.com/" + "url": "https://dnsdumpster.com/", + "description": "Free domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Subdomain enumeration, DNS reconnaissance, infrastructure mapping", + "input": "Domain name", + "output": "MX records, TXT records, Host records, subdomains, infrastructure map", + "opsec": "passive", + "opsecNote": "Passive DNS research without sending direct DNS requests or probing the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Deteque (R)", "type": "url", - "url": "https://www.deteque.com/" + "url": "https://www.deteque.com/", + "description": "Real-time IP, domain, and threat intelligence from Spamhaus and abuse.ch alliance. Provides comprehensive malware, botnet, and abuse data with diverse IOC coverage (IPs, domains, URLs, files, cryptos).", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware tracking, botnet detection, abuse data", + "input": "Domain, IP, URL, file hash, or AS number", + "output": "Threat classification, malware associations, botnet data, historical records (up to 12 months)", + "opsec": "passive", + "opsecNote": "Queries threat intelligence database; does not contact or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1002,97 +2202,382 @@ { "name": "UrlQuery.net", "type": "url", - "url": "https://urlquery.net/" + "url": "https://urlquery.net/", + "description": "Free online URL scanner that analyzes webpages for malware, suspicious elements, and phishing threats. Provides comprehensive threat detection reports with threat briefs on emerging campaigns.", + "status": "live", + "pricing": "free", + "bestFor": "URL reputation scanning, malware detection, phishing detection, threat analysis", + "input": "URL or webpage", + "output": "Threat report, detected threats, malicious behavior, anomalies, security assessment", + "opsec": "active", + "opsecNote": "Visits and analyzes the submitted URL; the target server may detect the scan.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Void", "type": "url", - "url": "https://www.urlvoid.com/" + "url": "https://www.urlvoid.com/", + "description": "Free website reputation checker that scans URLs against 30+ blocklist engines and reputation services. Detects fraudulent and malicious websites with browser extension available.", + "status": "live", + "pricing": "free", + "bestFor": "Website reputation checking, malware/phishing detection, threat analysis", + "input": "Website URL", + "output": "Safety report from 30+ blocklists, IP details, domain age, server location, threat indicators", + "opsec": "passive", + "opsecNote": "Queries blocklist and reputation services; does not directly visit or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FortiGuard Reputation Service", "type": "url", - "url": "https://fortiguard.com/iprep" + "url": "https://fortiguard.com/iprep", + "description": "Fortinet's IP reputation service aggregating malicious source IP data from global threat sensors and collaborators. Blocks botnets, DDoS sources, and IPs associated with phishing, scanning, and malware.", + "status": "live", + "pricing": "free", + "bestFor": "IP reputation lookup, botnet/malware source identification, threat intelligence", + "input": "IP address or IP range", + "output": "IP reputation score, threat categories, malware associations, botnet status", + "opsec": "passive", + "opsecNote": "Queries Fortinet's IP reputation database without contacting the target IP.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Trend Micro Site Safety Center", "type": "url", - "url": "https://global.sitesafety.trendmicro.com/" + "url": "https://global.sitesafety.trendmicro.com/", + "description": "Free service that checks website safety ratings from Trend Micro's research and reputation sources. Identifies websites with malware, phishing activity, or suspicious behavior.", + "status": "live", + "pricing": "free", + "bestFor": "Website safety verification, malware/phishing detection, threat assessment", + "input": "Website URL", + "output": "Safety rating, category classification, threat indicators, historical data", + "opsec": "passive", + "opsecNote": "Queries Trend Micro's pre-scanned website reputation database without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchGuard ReputationAuthority", "type": "url", - "url": "https://www.reputationauthority.org/" + "url": "https://www.reputationauthority.org/", + "description": "In-the-cloud reputation monitoring service analyzing URL and IP threat risk. Assigns reputation scores between 1-100 using data from global sources and deployed systems.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation scoring, threat risk assessment, malicious source identification", + "input": "URL or IP address", + "output": "Reputation score (1-100), threat risk level, URL category, blocking recommendations", + "opsec": "passive", + "opsecNote": "Queries WatchGuard's reputation servers without contacting the target directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sucuri SiteCheck", "type": "url", - "url": "https://sitecheck.sucuri.net/" + "url": "https://sitecheck.sucuri.net/", + "description": "Free remote website scanner that checks for malware, security threats, blacklisting, and vulnerabilities. Detects outdated CMS versions, insecure configurations, and security anomalies.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning, vulnerability detection, security assessment", + "input": "Website URL", + "output": "Security scan report, malware detection, blacklist status, vulnerable plugin/CMS details", + "opsec": "active", + "opsecNote": "Remotely visits the website to check source code and security; may be detectable by WAF/IDS.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThreatMiner.org", "type": "url", - "url": "https://www.threatminer.org/" + "url": "https://www.threatminer.org/", + "description": "Non-profit threat intelligence portal providing IOC research including domains, IPs, malware samples, SSL certificates, WHOIS data, and malicious URLs under Creative Commons license.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence research, IOC investigation, malware/phishing link analysis", + "input": "Domain, IP, file hash (MD5/SHA1/SHA256), SSL certificate, or URL", + "output": "Threat reports, IOC data, WHOIS info, malware associations, related indicators", + "opsec": "passive", + "opsecNote": "Queries aggregated threat intelligence data from multiple sources; does not probe targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BlueCoat WebPulse", "type": "url", - "url": "https://sitereview.bluecoat.com/sitereview.jsp" + "url": "https://sitereview.bluecoat.com/sitereview.jsp", + "description": "Web reputation filtering service rating URLs with 50+ language support. Processes 180+ million rating requests daily with Dynamic Link Analysis for attack injection detection.", + "status": "live", + "pricing": "free", + "bestFor": "URL categorization, website reputation filtering, malicious link detection", + "input": "Website URL", + "output": "URL category, reputation rating, threat indicators, web content classification", + "opsec": "passive", + "opsecNote": "Queries Blue Coat's cloud-based URL reputation database without directly probing targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Zscaler Zulu URL Risk Analyzer", "type": "url", - "url": "https://zulu.zscaler.com/" + "url": "https://zulu.zscaler.com/", + "description": "Free dynamic risk scoring engine for web content analysis. Assesses URLs from multiple perspectives: content analysis, URL patterns, and host reputation using machine learning.", + "status": "live", + "pricing": "free", + "bestFor": "URL risk scoring, web threat detection, malicious content analysis", + "input": "Website URL", + "output": "Risk score, threat assessment at content/URL/host levels, malicious behavior detection", + "opsec": "active", + "opsecNote": "Uses sandboxing to execute URLs in an isolated environment; may detect analysis activity.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe Sandbox Url Analyzer", "type": "url", - "url": "https://www.url-analyzer.net/" + "url": "https://www.url-analyzer.net/", + "description": "Deep URL and document analysis using real browser execution in isolated environments. Detects malware, phishing, and suspicious behavior with detailed system/network monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware/phishing analysis, URL behavior detection, deep web threat investigation", + "input": "URL or document file", + "output": "Detailed behavior analysis, DOM tree, browser data, network capture, threat assessment", + "opsec": "active", + "opsecNote": "Executes URLs in real browsers; detectable by advanced anti-analysis techniques.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Deepviz Domain Search", "type": "url", - "url": "https://search.deepviz.com/" + "url": "https://search.deepviz.com/", + "description": "Threat intelligence platform providing domain, IP, and malware sample search with daily threat feeds. Includes similar sample finding, malware family clustering, and API/Splunk integration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware analysis, threat feed subscription", + "input": "Domain, IP, file hash (MD5), or malware sample", + "output": "Threat intelligence data, malware associations, related IOCs, daily threat feeds", + "opsec": "passive", + "opsecNote": "Queries threat intelligence databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "AVG Threat Labs", "type": "url", - "url": "https://www.avg.com/en/signal/website-safety" + "url": "https://www.avg.com/en/signal/website-safety", + "description": "Website security analysis tool providing instant safety assessment of sites. Merges quantitative threat detection from 100M AVG users with LinkScanner technology in graphical reports.", + "status": "degraded", + "pricing": "free", + "bestFor": "Website safety assessment, threat detection reports, website popularity tracking", + "input": "Website URL", + "output": "Safety analysis, threat report, popularity status, server location, detection timeline", + "opsec": "passive", + "opsecNote": "Queries AVG's threat detection database; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Webroot BrightCloud URL/IP Lookup", "type": "url", - "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" + "url": "https://www.brightcloud.com/tools/url-ip-lookup.php", + "description": "Web classification and reputation tool providing URL/IP threat and content analysis. Uses machine learning reputation scoring across 82 content categories with IP risk tiering.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation lookup, web classification, threat intelligence, web categorization", + "input": "URL or IP address", + "output": "Threat assessment, content category, reputation score, WHOIS data, risk level", + "opsec": "passive", + "opsecNote": "Queries BrightCloud's reputation database without directly contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "vURL Online", "type": "url", - "url": "https://vurldissect.co.uk/" + "url": "https://vurldissect.co.uk/", + "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.", + "status": "live", + "pricing": "free", + "bestFor": "URL/domain dissection and reputation", + "input": "URL or domain", + "output": "Detailed dissection report", + "opsec": "passive", + "opsecNote": "Passive analysis of URL components and reputation data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AlienVault Open Threat Exchange", "type": "url", - "url": "https://otx.alienvault.com/browse/pulses/" + "url": "https://otx.alienvault.com/browse/pulses/", + "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence sharing", + "input": "Domain, IP, URL, file hash", + "output": "Threat pulses, reputation data, indicators", + "opsec": "passive", + "opsecNote": "Community-sourced intelligence; free API access with registration", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Domain List", "type": "url", - "url": "https://www.malwaredomainlist.com/mdl.php" + "url": "https://www.malwaredomainlist.com/mdl.php", + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Web Inspector Online Scan", "type": "url", - "url": "https://www.webinspector.com/website-malware-scanner/" + "url": "https://www.webinspector.com/website-malware-scanner/", + "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning", + "input": "Website URL", + "output": "Malware scan report, vulnerability assessment", + "opsec": "active", + "opsecNote": "Active scanning required; connects to target website to analyze content", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Safe Browsing API", "type": "url", - "url": "https://developers.google.com/safe-browsing/?csw=1" + "url": "https://developers.google.com/safe-browsing/?csw=1", + "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and phishing URL detection", + "input": "URL or domain", + "output": "Safe/unsafe classification, threat type", + "opsec": "passive", + "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cisco Talos", "type": "url", - "url": "https://talosintelligence.com/" + "url": "https://talosintelligence.com/", + "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation intelligence", + "input": "IP address or domain", + "output": "Reputation score, threat indicators, intelligence reports", + "opsec": "passive", + "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1103,67 +2588,262 @@ { "name": "Threatexpert.com Malicious URLs", "type": "url", - "url": "https://www.networksec.org/grabbho/block.txt" + "url": "https://www.networksec.org/grabbho/block.txt", + "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.", + "status": "down", + "pricing": "free", + "bestFor": "Malware URL intelligence", + "input": "Domain or URL", + "output": "Blocklist/Feed format", + "opsec": "passive", + "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Zeus C2 Tracker", "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" + "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist", + "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet C2 blocking", + "input": "None (blocklist provider)", + "output": "Domain/IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Queries public Zeus tracker database; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Domains Blacklist", "type": "url", - "url": "https://mirror1.malwaredomains.com/files/domains.txt" + "url": "https://mirror1.malwaredomains.com/files/domains.txt", + "description": "Historical malware domains blocklist providing hosts file format malicious domain list.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Hosts file format", + "opsec": "passive", + "opsecNote": "Legacy service; no longer maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Blackweb", "type": "url", - "url": "https://github.com/maravento/blackweb" + "url": "https://github.com/maravento/blackweb", + "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.", + "status": "live", + "pricing": "free", + "bestFor": "Squid proxy malware filtering", + "input": "None (aggregated blocklist)", + "output": "Squid-compatible blocklist format", + "opsec": "passive", + "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Critical Stack Intel (R)", "type": "url", - "url": "https://intel.criticalstack.com/" + "url": "https://intel.criticalstack.com/", + "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.", + "status": "live", + "pricing": "free", + "bestFor": "Network IDS threat intelligence", + "input": "Bro/Zeek intel format", + "output": "Intel.log entries, network alerts", + "opsec": "passive", + "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Sinkhole", "type": "url", - "url": "https://malc0de.com/bl/" + "url": "https://malc0de.com/bl/", + "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.", + "status": "degraded", + "pricing": "free", + "bestFor": "DNS-based malware blocking", + "input": "DNS zone file", + "output": "Malware domain sinkhole list", + "opsec": "passive", + "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS-BH Malware Domain Blocklist", "type": "url", - "url": "https://www.malwaredomains.com/wordpress/?page_id=66" + "url": "https://www.malwaredomains.com/wordpress/?page_id=66", + "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)", + "opsec": "passive", + "opsecNote": "Service sunset; merged into ShadowNet", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Malware Domain List", "type": "url", - "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" + "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt", + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MalwareURL (R)", "type": "url", - "url": "https://www.malwareurl.com/index.php" + "url": "https://www.malwareurl.com/index.php", + "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware URL reputation checking", + "input": "URL", + "output": "Reputation report, blocklist data", + "opsec": "passive", + "opsecNote": "Free lookup service available; commercial network integration available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "scumware.org", "type": "url", - "url": "https://www.scumware.org/" + "url": "https://www.scumware.org/", + "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and spyware domain research", + "input": "Domain or URL", + "output": "Domain reputation/blocklist data", + "opsec": "passive", + "opsecNote": "Community-maintained research database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ZeuS Tracker", "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php" + "url": "https://zeustracker.abuse.ch/blocklist.php", + "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet tracking and blocking", + "input": "None (blocklist provider)", + "output": "Domain blocklist, IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Shadowserver Foundation", "type": "url", - "url": "https://www.shadowserver.org/" + "url": "https://www.shadowserver.org/", + "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation and abuse intelligence", + "input": "IP address or domain", + "output": "Reputation reports, blocklists, abuse intelligence", + "opsec": "passive", + "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Domain Validation", "type": "url", - "url": "https://www.mailboxvalidator.com/domain" + "url": "https://www.mailboxvalidator.com/domain", + "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email domain and mailbox verification", + "input": "Email domain or address", + "output": "Domain validation report, MX records", + "opsec": "active", + "opsecNote": "Active mail server connectivity checks required for validation", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1174,22 +2854,82 @@ { "name": "DNS Twist (T)", "type": "url", - "url": "https://github.com/elceef/dnstwist" + "url": "https://github.com/elceef/dnstwist", + "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting and phishing domain detection", + "input": "Domain name", + "output": "Domain permutation list, DNS records, HTTP similarity", + "opsec": "active", + "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URLCrazy (T)", "type": "url", - "url": "https://www.morningstarsecurity.com/research/urlcrazy" + "url": "https://www.morningstarsecurity.com/research/urlcrazy", + "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting domain discovery", + "input": "Domain name", + "output": "Domain variant list, registration status", + "opsec": "active", + "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dnstwister", "type": "url", - "url": "https://dnstwister.report/" + "url": "https://dnstwister.report/", + "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Typosquatting monitoring", + "input": "Domain name", + "output": "Domain variants, registration status, DNS records", + "opsec": "active", + "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Catphish (T)", "type": "url", - "url": "https://github.com/ring0lab/catphish" + "url": "https://github.com/ring0lab/catphish", + "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Red team phishing domain generation", + "input": "Target domain", + "output": "Phishing domain variants, categorization status", + "opsec": "active", + "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1201,14 +2941,74 @@ "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Public website analysis; passive technical reconnaissance", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SiteSleuth", + "type": "url", + "url": "https://www.sitesleuth.io/", + "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking code intelligence and related domain discovery", + "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key", + "output": "List of associated domains and tracking codes", + "opsec": "passive", + "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Wappalyzer (T)", + "type": "url", + "url": "https://www.wappalyzer.com/", + "description": "Technology stack profiler that identifies CMS, frameworks, analytics, and infrastructure used by a website.", + "status": "live", + "pricing": "freemium", + "bestFor": "Technology stack fingerprinting and recon", + "input": "Domain or URL", + "output": "Detected technologies, categories, versions, and metadata", + "opsec": "active", + "opsecNote": "Performs direct analysis of target pages when scanning live URLs.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SEMrush", + "type": "url", + "url": "https://www.semrush.com/", + "description": "SEO intelligence platform for domain analytics, keyword intelligence, backlinks, and competitor profiling.", + "status": "live", + "pricing": "paid", + "bestFor": "Traffic and backlink competitive analysis", + "input": "Domain", + "output": "Keywords, backlinks, ranking trends, and traffic estimates", + "opsec": "passive", + "opsecNote": "Uses provider-side indexed datasets and does not require direct probing by the user.", "localInstall": false, "googleDork": false, "registration": true, @@ -1217,100 +3017,325 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "SiteSleuth", - "type": "url", - "url": "https://www.sitesleuth.io/" - }, - { - "name": "Wappalyzer (T)", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, - { - "name": "SEMrush", - "type": "url", - "url": "https://www.semrush.com/" - }, { "name": "Moonsearch", "type": "url", - "url": "https://moonsearch.com/" + "url": "https://moonsearch.com/", + "description": "Legacy reverse-WHOIS style domain correlation service with unclear current availability.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical domain ownership correlation", + "input": "Domain or registrant details", + "output": "Potentially related domains and ownership links", + "opsec": "unknown", + "opsecNote": "Service availability is inconsistent; treat results as unverified and re-check before use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Ewhois", "type": "url", - "url": "https://ewhois.com/" + "url": "https://www.ewhois.com/", + "description": "Web WHOIS lookup utility for registration, registrar, and nameserver details.", + "status": "live", + "pricing": "free", + "bestFor": "Quick WHOIS lookups", + "input": "Domain", + "output": "Registrant, registrar, dates, and nameserver records", + "opsec": "passive", + "opsecNote": "Performs standard registration lookups with low operational risk.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "StatsCrop", "type": "url", - "url": "https://www.statscrop.com/" + "url": "https://www.statscrop.com/", + "description": "Website statistics portal with traffic rank snapshots and related metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Quick website popularity snapshots", + "input": "Domain", + "output": "Traffic rank estimates and summary site stats", + "opsec": "passive", + "opsecNote": "Reads provider-side metrics without direct target interaction by the user.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Open Site Explorer", "type": "url", - "url": "https://moz.com/link-explorer" + "url": "https://moz.com/link-explorer", + "description": "Legacy Moz Open Site Explorer entry now represented by Moz Link Explorer for backlink analysis.", + "status": "degraded", + "pricing": "freemium", + "bestFor": "Backlink and linking-domain analysis", + "input": "Domain or URL", + "output": "Backlinks, authority-style metrics, and linking domains", + "opsec": "passive", + "opsecNote": "Modern functionality persists under Moz Link Explorer; legacy naming retained for framework continuity.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": true }, { "name": "SpyOnWeb", "type": "url", - "url": "https://www.spyonweb.com/" + "url": "https://www.spyonweb.com/", + "description": "Correlation tool that links domains by shared tracking and advertising identifiers.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding related infrastructure via shared IDs", + "input": "Domain or analytics/ad IDs", + "output": "Related domains and shared identifier pivots", + "opsec": "passive", + "opsecNote": "Uses indexed identifier data and does not require active probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Keyword Density", "type": "url", - "url": "https://tools.seobook.com/general/keyword-density/" + "url": "https://tools.seobook.com/general/keyword-density/", + "description": "Text and page analyzer that measures keyword frequency and relative density.", + "status": "live", + "pricing": "free", + "bestFor": "On-page keyword frequency analysis", + "input": "URL or text", + "output": "Keyword counts and density metrics", + "opsec": "active", + "opsecNote": "May fetch target content directly for analysis when URL input is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Alexa Site Statistics", "type": "url", - "url": "https://alexa.amazon.com/about" + "url": "https://alexa.amazon.com/about", + "description": "Historical Alexa Internet traffic-statistics entry; service was discontinued in 2022.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Domain", + "output": "Legacy traffic ranking context (archival)", + "opsec": "unknown", + "opsecNote": "Alexa Internet shut down on May 1, 2022; keep as deprecated reference only.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Cisco Umbrella Popularity List", "type": "url", - "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" + "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html", + "description": "Domain popularity ranking based on Cisco Umbrella DNS telemetry.", + "status": "live", + "pricing": "free", + "bestFor": "Top-domain popularity and DNS trend context", + "input": "Domain or list lookup", + "output": "Popularity ranking and related DNS-derived context", + "opsec": "passive", + "opsecNote": "Consumes published ranking data with low direct exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Alexa Top 500 Global Sites", "type": "url", - "url": "https://alexa.amazon.com/about" + "url": "https://alexa.amazon.com/about", + "description": "Historical Alexa Top Sites list reference; no longer maintained after Alexa shutdown.", + "status": "down", + "pricing": "free", + "bestFor": "Historical popularity-list reference", + "input": "N/A", + "output": "Legacy ranking context only", + "opsec": "unknown", + "opsecNote": "Alexa Internet ended on May 1, 2022; this entry is retained only as deprecated legacy context.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Sitedossier", "type": "url", - "url": "https://www.sitedossier.com/" + "url": "https://www.sitedossier.com/", + "description": "Domain dossier aggregator with WHOIS, DNS, and linked infrastructure context.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain intelligence aggregation", + "input": "Domain or IP", + "output": "WHOIS, DNS, and related-site context", + "opsec": "passive", + "opsecNote": "Aggregates public records and indexed data with limited operator exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Visual Site Mapper", "type": "url", - "url": "https://github.com/alentum/sitemapper-nodejs" + "url": "https://github.com/alentum/sitemapper-nodejs", + "description": "Site-crawling mapper used to visualize website structure and page relationships.", + "status": "live", + "pricing": "free", + "bestFor": "Generating website structure maps", + "input": "Domain or URL seed", + "output": "Crawl graph and site map structure", + "opsec": "active", + "opsecNote": "Actively crawls target pages and generates repeated requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ClearWebStats.com", "type": "url", - "url": "https://www.clearwebstats.com/" + "url": "https://www.clearwebstats.com/", + "description": "Public site-statistics index showing traffic and rank snapshots for domains.", + "status": "live", + "pricing": "free", + "bestFor": "Lightweight web popularity lookups", + "input": "Domain", + "output": "Estimated rank and summary traffic metrics", + "opsec": "passive", + "opsecNote": "Uses provider-collected analytics rather than direct target scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PubDB", "type": "url", - "url": "https://pub-db.com/" + "url": "https://pub-db.com/", + "description": "Legacy public-database lookup entry with expired or unavailable service state.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Query terms", + "output": "Unavailable/legacy output", + "opsec": "unknown", + "opsecNote": "Service appears expired or defunct; verify alternatives before operational use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "SimilarWeb", "type": "url", - "url": "https://www.similarweb.com/" + "url": "https://www.similarweb.com/", + "description": "Digital intelligence platform for traffic estimates, referrals, and audience insights.", + "status": "live", + "pricing": "freemium", + "bestFor": "Competitor traffic and referral analysis", + "input": "Domain", + "output": "Traffic channels, engagement, and competitor benchmarking", + "opsec": "passive", + "opsecNote": "Relies on provider-side datasets and panels; no active probing required by user.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Siteliner", "type": "url", - "url": "https://www.siteliner.com/" + "url": "https://www.siteliner.com/", + "description": "Website crawler that highlights duplicate content, broken links, and SEO quality issues.", + "status": "live", + "pricing": "freemium", + "bestFor": "Duplicate-content and link-health audits", + "input": "Domain", + "output": "Duplicate-content metrics, broken links, and crawl summaries", + "opsec": "active", + "opsecNote": "Performs active crawl requests against the target site.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WhatWeb", "type": "url", - "url": "https://github.com/urbanadventurer/WhatWeb" + "url": "https://github.com/urbanadventurer/WhatWeb", + "description": "Open-source fingerprinting scanner for identifying technologies, frameworks, and server-side indicators.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-based web technology fingerprinting", + "input": "Domain or URL", + "output": "Detected technologies, headers, and fingerprint matches", + "opsec": "active", + "opsecNote": "Directly scans target endpoints and can be noisy depending on scan options.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1321,27 +3346,102 @@ { "name": "Link Expander", "type": "url", - "url": "https://www.linkexpander.com/" + "url": "https://www.linkexpander.com/", + "description": "Short-link expansion tool that resolves redirects to destination URLs.", + "status": "live", + "pricing": "free", + "bestFor": "Expanding shortened links safely", + "input": "Shortened URL", + "output": "Resolved destination URL and redirect behavior", + "opsec": "passive", + "opsecNote": "Uses preview/expansion workflows and avoids direct navigation in the browser.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CheckShortURL", "type": "url", - "url": "https://checkshorturl.com/" + "url": "https://checkshorturl.com/", + "description": "Preview service for shortened URLs with destination and threat-check context.", + "status": "live", + "pricing": "free", + "bestFor": "Safe short-link destination checks", + "input": "Shortened URL", + "output": "Expanded destination and warning context", + "opsec": "passive", + "opsecNote": "Passively expands links before user navigation.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Expander", "type": "url", - "url": "https://urlex.org/" + "url": "https://urlex.org/", + "description": "Link resolver for unshortening and inspecting redirect destination chains.", + "status": "live", + "pricing": "free", + "bestFor": "Resolving opaque short links", + "input": "Shortened URL", + "output": "Expanded URL and redirect details", + "opsec": "passive", + "opsecNote": "Primarily destination resolution with low direct operational exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Where Does This Link Go?", "type": "url", - "url": "https://wheregoes.com/" + "url": "https://wheregoes.com/", + "description": "Redirect-chain inspector that traces and visualizes final destination paths.", + "status": "live", + "pricing": "free", + "bestFor": "Tracing redirect chains for suspicious links", + "input": "URL", + "output": "Redirect hops, response codes, and final destination", + "opsec": "passive", + "opsecNote": "Provides passive redirect tracing before manual browser interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "KnowURL", "type": "url", - "url": "https://www.knowurl.com/" + "url": "https://www.knowurl.com/", + "description": "Legacy URL intelligence entry with uncertain availability and reliability.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "URL", + "output": "Unreliable or unavailable metadata", + "opsec": "unknown", + "opsecNote": "Current service status is unclear; verify manually before relying on output.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -1352,12 +3452,42 @@ { "name": "VisualPing", "type": "url", - "url": "https://visualping.io:443/" + "url": "https://visualping.io/", + "description": "Website monitoring platform that alerts on page content or visual changes.", + "status": "live", + "pricing": "freemium", + "bestFor": "Automated webpage change monitoring", + "input": "URL and watch settings", + "output": "Change alerts with visual or text diffs", + "opsec": "active", + "opsecNote": "Performs recurring fetches of target pages based on monitoring cadence.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Change Detection", "type": "url", - "url": "https://visualping.io/" + "url": "https://changedetection.io/", + "description": "Open-source change-monitoring system for tracking updates on websites over time.", + "status": "live", + "pricing": "free", + "bestFor": "Self-hosted page change monitoring", + "input": "URL and monitoring rules", + "output": "Diffs and notifications when monitored content changes", + "opsec": "active", + "opsecNote": "Generates recurring requests to monitored targets; tune intervals for OPSEC.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "UPcheck", @@ -1383,14 +3513,14 @@ "name": "Follow That Page", "type": "url", "url": "https://www.followthatpage.com/", - "description": "Website change detection service that monitors pages for updates and sends email notifications.", + "description": "Website monitoring service that checks pages for changes and sends alerts when tracked content updates. Supports keyword-based notifications for focused monitoring.", "status": "live", - "pricing": "free", - "bestFor": "Website monitoring for content changes", - "input": "URLs", - "output": "Change alerts via email", + "pricing": "freemium", + "bestFor": "Tracking updates on specific web pages by keyword", + "input": "Target page URL and optional keyword filters", + "output": "Email alerts showing detected page changes", "opsec": "passive", - "opsecNote": "No direct identification risk; third-party service tracks monitored URLs", + "opsecNote": "Monitoring requests are performed by Follow That Page infrastructure rather than directly from the investigator's workstation.", "localInstall": false, "googleDork": false, "registration": true, @@ -1403,19 +3533,19 @@ "name": "Urlwatch", "type": "url", "url": "https://github.com/thp/urlwatch", - "description": "Open-source Python CLI tool for monitoring websites and local documents for changes with flexible notification options.", + "description": "Open-source Python CLI tool for monitoring webpages and feeds for changes. Supports multiple filters, reporters, and scheduled checks via local automation.", "status": "live", "pricing": "free", - "bestFor": "Automated change monitoring with custom notifications", - "input": "URLs or local files", - "output": "Change reports and diffs", + "bestFor": "Self-hosted web page change monitoring automation", + "input": "URLs, feeds, and local watch configuration", + "output": "Diffs and alerts through email, console, or integrations", "opsec": "passive", - "opsecNote": "Local execution only; no external tracking of monitored targets", + "opsecNote": "Can run locally or on controlled infrastructure, allowing investigators to manage request origin and monitoring cadence.", "localInstall": true, "googleDork": false, "registration": false, - "editUrl": false, - "api": true, + "editUrl": true, + "api": false, "invitationOnly": false, "deprecated": false }, @@ -1423,14 +3553,14 @@ "name": "WatchThatPage", "type": "url", "url": "https://watchthatpage.com/", - "description": "Web-based page monitoring service with keyword filtering and change notification alerts.", + "description": "Web-based page monitoring platform that detects content changes and notifies users by email. Useful for tracking updates on websites without RSS feeds.", "status": "live", "pricing": "freemium", - "bestFor": "Change detection with keyword filtering", - "input": "URLs and keywords", - "output": "Change alerts", + "bestFor": "Monitoring static web pages for updates over time", + "input": "Web page URL and watch configuration", + "output": "Email notifications and change history snapshots", "opsec": "passive", - "opsecNote": "No direct identification; third-party service stores monitored URLs", + "opsecNote": "Page checks originate from WatchThatPage systems instead of directly from the investigator.", "localInstall": false, "googleDork": false, "registration": true, @@ -1443,18 +3573,18 @@ "name": "ChangeDetect", "type": "url", "url": "https://changedetection.io/", - "description": "SaaS and self-hosted website monitoring platform with 85+ notification integrations.", + "description": "Open-source website change detection platform with both self-hosted and hosted options. Supports visual diffs, notifications, and automation workflows.", "status": "live", "pricing": "freemium", - "bestFor": "Scalable change detection with broad notification support", - "input": "URLs", - "output": "Change notifications", + "bestFor": "Flexible page change monitoring with self-hosted control", + "input": "Target URL and optional monitoring rules/selectors", + "output": "Change alerts, snapshots, and webhook/integration notifications", "opsec": "passive", - "opsecNote": "No identification risk; can be self-hosted for full control", + "opsecNote": "When self-hosted, investigators control infrastructure and request origin; hosted mode proxies checks through provider systems.", "localInstall": true, "googleDork": false, "registration": false, - "editUrl": false, + "editUrl": true, "api": true, "invitationOnly": false, "deprecated": false @@ -1481,7 +3611,7 @@ "googleDork": false, "registration": false, "editUrl": false, - "api": true, + "api": false, "invitationOnly": false, "deprecated": false } @@ -1515,19 +3645,19 @@ "name": "DNSViz", "type": "url", "url": "https://dnsviz.net/", - "description": "Open-source web-based DNSSEC visualization tool that maps the DNS delegation chain and trust anchors.", + "description": "DNS and DNSSEC analysis platform that visualizes delegation chains and cryptographic validation paths. Helps diagnose trust and signing issues in domain configurations.", "status": "live", "pricing": "free", - "bestFor": "Visual DNSSEC debugging and delegation chain analysis", - "input": "Domain names", - "output": "Interactive DNS chain diagrams", + "bestFor": "Visual DNSSEC validation and DNS misconfiguration analysis", + "input": "Domain name", + "output": "DNS resolution graphs, DNSSEC status, and validation diagnostics", "opsec": "passive", - "opsecNote": "No identification risk; passive DNS query", + "opsecNote": "Analysis runs against public DNS infrastructure without direct interaction with domain owners.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, - "api": true, + "api": false, "invitationOnly": false, "deprecated": false } @@ -1611,19 +3741,19 @@ "name": "Zone-H.org", "type": "url", "url": "https://zone-h.org/archive", - "description": "Website defacement archive and defacer tracking database with historical records of compromised sites.", + "description": "Archive of reported website defacements and related incident metadata maintained by the Zone-H community.", "status": "live", "pricing": "free", - "bestFor": "Defacement history and attacker identification", - "input": "Domains", - "output": "Defacement records and defacer profiles", + "bestFor": "Historical tracking of website defacement incidents", + "input": "Search terms, domains, or browsing archive filters", + "output": "Defacement records with timestamps and mirrored evidence", "opsec": "passive", - "opsecNote": "Historical archive lookup; no active probing of targets", + "opsecNote": "Uses a third-party archive and does not require direct interaction with target infrastructure.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, - "api": true, + "api": false, "invitationOnly": false, "deprecated": false } @@ -2017,42 +4147,162 @@ { "name": "MaxMind Demo", "type": "url", - "url": "https://www.maxmind.com/en/home" + "url": "https://www.maxmind.com/en/home", + "description": "Web-based IP geolocation demo with location, ASN, and network data from MaxMind's GeoIP database.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP geolocation", + "input": "IP address", + "output": "Country, region, city, coordinates, ASN", + "opsec": "passive", + "opsecNote": "Queries MaxMind; submissions logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4/IPv6 lists by country code", "type": "url", - "url": "https://github.com/ipverse/" + "url": "https://github.com/ipverse/", + "description": "Database of IPv4 and IPv6 address ranges organized by country for geographic IP filtering.", + "status": "live", + "pricing": "free", + "bestFor": "Country-level IP enumeration", + "input": "Country code", + "output": "IP ranges in CIDR notation", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP allocations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2Location.com", "type": "url", - "url": "https://www.ip2location.com/demo" + "url": "https://www.ip2location.com/demo", + "description": "Commercial IP geolocation service with free demo and database. Provides location, proxy detection, and network data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate geolocation with proxy detection", + "input": "IP address", + "output": "Location, ASN, proxy type, VPN status, timezone", + "opsec": "passive", + "opsecNote": "Passive database lookup; free tier limited.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Fingerprints", "type": "url", - "url": "https://ipfingerprints.com/" + "url": "https://ipfingerprints.com/", + "description": "Reverse IP lookup service identifying all domains hosted on a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Uses public DNS reverse lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DB-IP", "type": "url", - "url": "https://db-ip.com/" + "url": "https://db-ip.com/", + "description": "Lightweight IP geolocation API covering 46M+ IPv4/IPv6 blocks with city-level accuracy.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate IP geolocation with developer API", + "input": "IP address", + "output": "Location, timezone, ISP, coordinates", + "opsec": "passive", + "opsecNote": "Passive database lookup; free API rate limited.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Location Finder", "type": "url", - "url": "https://www.iplocation.net/" + "url": "https://www.iplocation.net/", + "description": "Web-based tool for IP geolocation with maps and detailed location information.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP location with maps", + "input": "IP address", + "output": "City, coordinates, ISP, hostname", + "opsec": "passive", + "opsecNote": "Passive lookup; no notification to target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Info Sniper", "type": "url", - "url": "https://www.infosniper.net/" + "url": "https://www.infosniper.net/", + "description": "Multi-field reverse OSINT tool for IP, email, phone lookups with social media enumeration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-field reverse lookup (IP/email/phone)", + "input": "IP, email, or phone", + "output": "Associated accounts and social profiles", + "opsec": "passive", + "opsecNote": "Correlates public data; paid features available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "utrace", "type": "url", - "url": "https://en.utrace.de/" + "url": "https://en.utrace.de/", + "description": "IP geolocation and reverse DNS lookup tool with network traceroute visualization.", + "status": "live", + "pricing": "free", + "bestFor": "IP location and traceroute", + "input": "IP or hostname", + "output": "Location, ASN, reverse DNS, route path", + "opsec": "active", + "opsecNote": "Traceroute is active; geolocation is passive.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2063,67 +4313,262 @@ { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "Website scanner analyzing URLs and domains for malicious content with infrastructure intelligence.", + "status": "live", + "pricing": "freemium", + "bestFor": "URL/domain scanning for malware and phishing", + "input": "URL or domain", + "output": "Screenshot, DNS, IP, certificates, cookies", + "opsec": "passive", + "opsecNote": "Passive scanning; no direct contact with target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/ip" + "url": "https://spyse.com/search/ip", + "description": "Internet assets search engine collecting and analyzing public data for attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and reconnaissance", + "input": "IP, domain, email, organization", + "output": "Subdomains, services, vulnerabilities, data breaches", + "opsec": "passive", + "opsecNote": "Passive data collection; requires account for full access.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Shodan", "type": "url", - "url": "https://www.shodan.io/" + "url": "https://www.shodan.io/", + "description": "Search engine for internet-connected devices, providing visibility into exposed services and vulnerabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Find exposed IoT and network services", + "input": "IP, port, service type", + "output": "Service banners, open ports, vulnerabilities, location", + "opsec": "passive", + "opsecNote": "Passive data collection; InternetDB API free for non-commercial use.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://netlas.io/" + "url": "https://netlas.io/", + "description": "Comprehensive internet scanning platform with OSINT, DNS, and WHOIS data. Free tier: 50 requests/day.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset reconnaissance with web, DNS, WHOIS", + "input": "IP, domain, ASN", + "output": "Open ports, services, certificates, DNS records, WHOIS", + "opsec": "passive", + "opsecNote": "Passive scanning with account-based rate limits.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Portmap", "type": "url", - "url": "https://portmap.com/" + "url": "https://portmap.com/", + "description": "Port mapping tool that scans for open ports and services on target IP addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Port scanning and service discovery", + "input": "IP address or hostname", + "output": "Open ports, service types, versions", + "opsec": "active", + "opsecNote": "Active port scanning probes target network.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Scans.io", "type": "url", - "url": "https://scans.io/" + "url": "https://scans.io/", + "description": "Archive of internet-wide scan data including censys scans and other reconnaissance data.", + "status": "live", + "pricing": "free", + "bestFor": "Historical internet scan data access", + "input": "IP or domain", + "output": "Historical scan results, service history", + "opsec": "passive", + "opsecNote": "Passive access to historical scanning archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Nmap (T)", "type": "url", - "url": "https://nmap.org/download.html" + "url": "https://nmap.org/download.html", + "description": "Open-source network mapping and port scanning tool with OS detection and service version identification.", + "status": "live", + "pricing": "free", + "bestFor": "Network reconnaissance and port scanning", + "input": "IP range or hostname", + "output": "Open ports, OS type, service versions, MAC addresses", + "opsec": "active", + "opsecNote": "Active scanning tool; generates network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Port scanner", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Web-based port scanner checking open ports on target IP addresses without installation.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port scanning without tools", + "input": "IP address and port range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active port scanning; limited to common ports on free tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Internet Census Search", "type": "url", - "url": "https://www.exfiltrated.com/querystart.php" + "url": "https://www.exfiltrated.com/querystart.php", + "description": "Search interface for the Shodan-like internet census data and open services.", + "status": "live", + "pricing": "free", + "bestFor": "Search open services and devices", + "input": "Service type, IP range, port", + "output": "List of exposed services and IPs", + "opsec": "passive", + "opsecNote": "Passive data search of known internet census.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "IP reputation and threat intelligence platform analyzing malicious IP addresses and attacks.", + "status": "live", + "pricing": "freemium", + "bestFor": "IP reputation and malicious activity analysis", + "input": "IP address", + "output": "Threat reports, activity logs, attack types", + "opsec": "passive", + "opsecNote": "Passive threat intelligence lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Scanless (T)", "type": "url", - "url": "https://github.com/vesche/scanless" + "url": "https://github.com/vesche/scanless", + "description": "Command-line tool for port scanning without leaving traces on target using third-party services.", + "status": "live", + "pricing": "free", + "bestFor": "Stealthy port scanning via proxies", + "input": "IP and port", + "output": "Open port results", + "opsec": "passive", + "opsecNote": "Routes scans through third-party services for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BinaryEdge (R)", "type": "url", - "url": "https://www.binaryedge.io/" + "url": "https://www.binaryedge.io/", + "description": "Commercial security research platform with internet-wide scanning and module-based detection.", + "status": "live", + "pricing": "paid", + "bestFor": "Commercial internet threat intelligence", + "input": "IP, domain, query", + "output": "Services, vulnerabilities, threat modules", + "opsec": "passive", + "opsecNote": "Commercial threat intelligence requiring subscription.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Masscan (T)", "type": "url", - "url": "https://github.com/robertdavidgraham/masscan" + "url": "https://github.com/robertdavidgraham/masscan", + "description": "Ultra-fast TCP port scanner designed for scanning large IP ranges and entire networks.", + "status": "live", + "pricing": "free", + "bestFor": "Large-scale network port scanning", + "input": "IP range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active scanner; generates significant network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2134,42 +4579,162 @@ { "name": "ASlookup.com", "type": "url", - "url": "https://aslookup.com/" + "url": "https://aslookup.com/", + "description": "BGP and autonomous system lookup tool for finding IP ranges and ownership information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP and ASN lookup", + "input": "ASN or IP address", + "output": "IP ranges, organization, peering info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Port scanner Online", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Simple web-based port scanner for checking common ports on target IPs.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port availability checks", + "input": "IP and port", + "output": "Port status (open/closed)", + "opsec": "active", + "opsecNote": "Active probing; may be logged by firewalls.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Onyphe", "type": "url", - "url": "https://www.onyphe.io/" + "url": "https://www.onyphe.io/", + "description": "Cyber defense search engine with internet scanning, threat intelligence, and attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and threat intel", + "input": "IP, domain, CVE", + "output": "Services, vulnerabilities, certificates, datasources", + "opsec": "passive", + "opsecNote": "Passive intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/as2.0/" + "url": "https://www.cidr-report.org/as2.0/", + "description": "Tool for analyzing IPv4 CIDR blocks and finding contained IP addresses and subnets.", + "status": "live", + "pricing": "free", + "bestFor": "CIDR block analysis and subnet enumeration", + "input": "CIDR block", + "output": "IP ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IP allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reverse.report", "type": "url", - "url": "https://reverse.report/" + "url": "https://reverse.report/", + "description": "Comprehensive reverse lookup tool for IP to domain, email, and phone number associations.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse IP and domain lookups", + "input": "IP address or domain", + "output": "Associated domains, subdomains, history", + "opsec": "passive", + "opsecNote": "Passive lookup of DNS and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Team Cymru IP to ASN", "type": "url", - "url": "https://asn.cymru.com/" + "url": "https://asn.cymru.com/", + "description": "IP to ASN mapping tool providing autonomous system ownership and prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN mapping", + "input": "IP address", + "output": "ASN, organization, prefix", + "opsec": "passive", + "opsecNote": "Passive lookup of BGP and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP to ASN DB", "type": "url", - "url": "https://iptoasn.com/" + "url": "https://iptoasn.com/", + "description": "Database and API service for looking up which ASN owns a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN lookup with historical data", + "input": "IP address", + "output": "ASN, organization, prefix, company info", + "opsec": "passive", + "opsecNote": "Passive database lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hacker Target - Reverse DNS", "type": "url", - "url": "https://hackertarget.com/reverse-dns-lookup/" + "url": "https://hackertarget.com/reverse-dns-lookup/", + "description": "Reverse DNS lookup tool and API finding domain names associated with IP addresses.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse DNS lookup of IP addresses", + "input": "IP address or range", + "output": "Associated domains and PTR records", + "opsec": "passive", + "opsecNote": "Passive DNS lookup; includes free API tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2180,7 +4745,22 @@ { "name": "IPv6 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/v6/as2.0/" + "url": "https://www.cidr-report.org/v6/as2.0/", + "description": "CIDR block analysis tool for IPv6 address ranges and subnet enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "IPv6 CIDR block analysis", + "input": "IPv6 CIDR block", + "output": "IPv6 ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IPv6 allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2191,22 +4771,82 @@ { "name": "Hurricane Electric BGP Toolkit", "type": "url", - "url": "https://bgp.he.net/" + "url": "https://bgp.he.net/", + "description": "BGP and network routing analysis tools including AS to prefix lookup and BGP prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP analysis and routing intelligence", + "input": "ASN, IP range, or prefix", + "output": "BGP routes, peering, organization info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Malicious Content Ranking", "type": "url", - "url": "https://bgpranking.circl.lu/" + "url": "https://bgpranking.circl.lu/", + "description": "Platform ranking ASNs and BGP prefixes by malicious content and security threats.", + "status": "live", + "pricing": "free", + "bestFor": "Identify malicious ASNs and networks", + "input": "ASN or prefix", + "output": "Threat ranking, malicious activity metrics", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PeeringDB", "type": "url", - "url": "https://www.peeringdb.com/advanced_search" + "url": "https://www.peeringdb.com/advanced_search", + "description": "Database of internet exchange points, member networks, and AS relationships for network mapping.", + "status": "live", + "pricing": "free", + "bestFor": "Internet peering and AS relationship mapping", + "input": "ASN, organization, or IX", + "output": "Peering relationships, exchange points, contacts", + "opsec": "passive", + "opsecNote": "Passive lookup of public peering data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Tools", "type": "url", - "url": "https://www.bgp4.as/tools" + "url": "https://www.bgp4.as/tools", + "description": "Collection of BGP analysis and AS number lookup tools for network intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "BGP routing and AS analysis", + "input": "ASN, IP, or prefix", + "output": "Routes, prefixes, organizations", + "opsec": "passive", + "opsecNote": "Passive analysis of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2217,17 +4857,62 @@ { "name": "IP Void", "type": "url", - "url": "https://www.ipvoid.com/" + "url": "https://www.ipvoid.com/", + "description": "IP reputation and threat intelligence service analyzing blacklist status and security risks.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP reputation and blacklist status", + "input": "IP address", + "output": "Threat score, blacklist status, reports", + "opsec": "passive", + "opsecNote": "Passive reputation lookup; account needed for full data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExoneraTor", "type": "url", - "url": "https://exonerator.torproject.org/" + "url": "https://exonerator.torproject.org/", + "description": "Tool for checking if an IP address belonged to Tor at a specific date.", + "status": "live", + "pricing": "free", + "bestFor": "Verify Tor relay membership by date", + "input": "IP address and date", + "output": "Tor exit/entry node status confirmation", + "opsec": "passive", + "opsecNote": "Passive historical Tor relay lookup from public archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grey Noise", "type": "url", - "url": "https://viz.greynoise.io/" + "url": "https://viz.greynoise.io/", + "description": "Platform for analyzing internet background noise and identifying benign scanning activity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Distinguish malicious from benign internet activity", + "input": "IP address", + "output": "Classification, scanner type, threat assessment", + "opsec": "passive", + "opsecNote": "Passive threat intelligence; free tier available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2238,22 +4923,82 @@ { "name": "Blocklist.de", "type": "url", - "url": "https://www.blocklist.de/en/index.html" + "url": "https://www.blocklist.de/en/index.html", + "description": "Community-contributed blocklist of IP addresses involved in attacks and malicious activity.", + "status": "live", + "pricing": "free", + "bestFor": "Check IP blacklist status", + "input": "IP address", + "output": "Blacklist status, attack types logged", + "opsec": "passive", + "opsecNote": "Passive lookup of community blocklist.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DShield API", "type": "url", - "url": "https://isc.sans.edu/api/" + "url": "https://isc.sans.edu/api/", + "description": "API and database of security events and IPs involved in attacks monitored by SANS.", + "status": "live", + "pricing": "free", + "bestFor": "Query IPs involved in attacks", + "input": "IP address", + "output": "Attack reports, threat activity", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from SANS monitored networks.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Project Honey Pot", "type": "url", - "url": "https://www.projecthoneypot.org/list_of_ips.php" + "url": "https://www.projecthoneypot.org/list_of_ips.php", + "description": "Global honeypot network collecting spam and attack data with IP reputation service.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP for spam and attack history", + "input": "IP address", + "output": "Threat score, spam reports, attack activity", + "opsec": "passive", + "opsecNote": "Passive lookup of honeypot-collected threat data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2264,22 +5009,82 @@ { "name": "IP Fingerprints - Reverse IP Lookup", "type": "url", - "url": "https://ipfingerprints.com/reverseip.php" + "url": "https://ipfingerprints.com/reverseip.php", + "description": "Find all domains hosted on a shared IP address through reverse IP lookup.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bing IP Search (D)", "type": "url", - "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" + "url": "https://www.bing.com/search?q=ip%3A8.8.8.8", + "description": "Bing search operator for finding domains and subdomains hosted on a specific IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on IP using Bing index", + "input": "IP address", + "output": "Domains indexed by Bing on that IP", + "opsec": "passive", + "opsecNote": "Passive search using Bing's public index.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TCP/IP Utils - Domain Neighbors", "type": "url", - "url": "https://dnslytics.com/" + "url": "https://dnslytics.com/", + "description": "Find all domains on the same IP and subdomain information via reverse IP lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Identify related domains on same IP", + "input": "Domain or IP", + "output": "Neighbor domains, IP info", + "opsec": "passive", + "opsecNote": "Passive DNS and IP lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MyIPNeighbors", "type": "url", - "url": "https://www.my-ip-neighbors.com/" + "url": "https://www.my-ip-neighbors.com/", + "description": "Reverse IP lookup tool for discovering all domains and subdomains on an IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find all domains on same shared IP", + "input": "IP address", + "output": "List of domains on IP, subdomains", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2290,12 +5095,42 @@ { "name": "CloudFlare Watch", "type": "url", - "url": "https://www.crimeflare.com/" + "url": "https://www.crimeflare.com/", + "description": "Tool for identifying and analyzing websites protected by Cloudflare's CDN and security services.", + "status": "live", + "pricing": "free", + "bestFor": "Identify Cloudflare-protected sites", + "input": "Domain or IP", + "output": "Cloudflare status, origin IP (if discoverable)", + "opsec": "passive", + "opsecNote": "Passive lookup of Cloudflare configurations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CloudFail (T)", "type": "url", - "url": "https://github.com/m0rtem/CloudFail" + "url": "https://github.com/m0rtem/CloudFail", + "description": "Tool for finding origin IPs of Cloudflare-protected websites through enumeration techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Bypass Cloudflare to find origin IP", + "input": "Domain protected by Cloudflare", + "output": "Origin IP address (if discoverable)", + "opsec": "active", + "opsecNote": "Uses active enumeration and DNS history techniques.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2306,12 +5141,42 @@ { "name": "WiGLE: Wireless Network Mapping", "type": "url", - "url": "https://wigle.net/" + "url": "https://wigle.net/", + "description": "Global database of wireless networks (WiFi, Bluetooth, cellular) with mapping and signal strength data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Map wireless networks and find signal coverage", + "input": "Location, SSID, or BSSID", + "output": "Network locations, signal maps, network details", + "opsec": "passive", + "opsecNote": "Crowdsourced wireless network data; passive lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenCellid: Database of Cell Towers", "type": "url", - "url": "https://opencellid.org/" + "url": "https://opencellid.org/", + "description": "Open database of cellular tower locations and coverage for mobile network geolocation.", + "status": "live", + "pricing": "free", + "bestFor": "Find cellular tower locations and coverage", + "input": "Cell tower ID or location", + "output": "Tower coordinates, operator, coverage area", + "opsec": "passive", + "opsecNote": "Passive lookup of public cellular network data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2322,22 +5187,82 @@ { "name": "Wireshark", "type": "url", - "url": "https://www.wireshark.org/download.html" + "url": "https://www.wireshark.org/download.html", + "description": "Open-source network packet analyzer for deep packet inspection and network troubleshooting.", + "status": "live", + "pricing": "free", + "bestFor": "Network packet analysis and protocol debugging", + "input": "Network traffic capture file", + "output": "Detailed packet analysis, protocol breakdown", + "opsec": "Unknown", + "opsecNote": "Tool-dependent; passive capture or active sniffing possible.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NetworkMiner", "type": "url", - "url": "https://www.netresec.com/?page=Networkminer" + "url": "https://www.netresec.com/?page=Networkminer", + "description": "Passive network forensics tool for extracting files and data from network traffic captures.", + "status": "live", + "pricing": "free", + "bestFor": "Network forensics and file extraction from traffic", + "input": "PCAP network traffic files", + "output": "Extracted files, metadata, network sessions", + "opsec": "passive", + "opsecNote": "Passive analysis of already-captured traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Packet Total", "type": "url", - "url": "https://www.packettotal.com/" + "url": "https://www.packettotal.com/", + "description": "Online platform for uploading and analyzing network packet captures (PCAP files).", + "status": "live", + "pricing": "free", + "bestFor": "Cloud-based network forensics analysis", + "input": "PCAP files", + "output": "Traffic analysis, threat indicators, IoCs", + "opsec": "Unknown", + "opsecNote": "Passive analysis of PCAP; consider privacy of uploaded data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "checkip (T)", "type": "url", - "url": "https://github.com/jreisinger/checkip" + "url": "https://github.com/jreisinger/checkip", + "description": "Command-line utility for checking local machine IP address and network connectivity.", + "status": "live", + "pricing": "free", + "bestFor": "Display local IP and network info", + "input": "Local system (no input needed)", + "output": "Local IP, gateway, DNS servers", + "opsec": "passive", + "opsecNote": "Passive system utility; local only.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2348,17 +5273,62 @@ { "name": "Ki.tc", "type": "url", - "url": "https://ki.tc" + "url": "https://ki.tc", + "description": "IP logging service that generates trackable links for IP/browser info collection.", + "status": "live", + "pricing": "free", + "bestFor": "Generate trackable links to log visitor IPs", + "input": "Target URL or destination", + "output": "Tracker link, IP logs, browser info", + "opsec": "Unknown", + "opsecNote": "Creates tracking mechanism; detection depends on how link is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grabify", "type": "url", - "url": "https://grabify.link" + "url": "https://grabify.link", + "description": "URL shortener service that logs IP addresses and device information of link clickers.", + "status": "live", + "pricing": "free", + "bestFor": "Shorten URLs and log visitor IPs", + "input": "URL to shorten", + "output": "Short URL with IP logging", + "opsec": "Unknown", + "opsecNote": "Creates tracking link; malicious uses common.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Logger", "type": "url", - "url": "https://iplogger.com/" + "url": "https://iplogger.com/", + "description": "IP logging and URL shortening service tracking visitor IP, location, and browser data.", + "status": "live", + "pricing": "free", + "bestFor": "Track visitor IPs through shortened links", + "input": "URL to wrap", + "output": "Logging URL, visitor IP/location data", + "opsec": "Unknown", + "opsecNote": "Tracking service; ethical and legal concerns apply.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -4442,6 +7412,260 @@ "type": "url", "url": "https://www.opengov-muenchen.de/" }, + { + "name": "Searchable FCC ID Database", + "type": "url", + "url": "https://fccid.io/" + } + ] + }, + { + "name": "Compliance & Risk Intelligence", + "type": "folder", + "children": [ + { + "name": "Sanctions Screening", + "type": "folder", + "children": [ + { + "name": "OpenSanctions", + "type": "url", + "url": "https://www.opensanctions.org/", + "description": "Aggregated database of sanctioned entities, politically exposed persons, and persons of criminal interest from 329 global data sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bulk sanctions and PEP screening across consolidated global watchlists", + "input": "Person or entity name", + "output": "Entity profiles with sanctions designations, PEP flags, and source metadata", + "opsec": "passive", + "opsecNote": "Passive lookups against a public database; API usage requires an account and is logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OFAC Sanctions List Search", + "type": "url", + "url": "https://sanctionssearch.ofac.treas.gov/", + "description": "Official U.S. Treasury tool for searching OFAC Specially Designated Nationals and related sanctions lists with approximate string matching.", + "status": "live", + "pricing": "free", + "bestFor": "Checking individuals or entities against U.S. sanctions programs", + "input": "Name, address, entity type, ID number, or sanctions program", + "output": "Matched records with name, sanctions program, list designation, and confidence score", + "opsec": "passive", + "opsecNote": "Public U.S. government search tool; queries are submitted to a federal server and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "EU Sanctions Tool (D)", + "type": "url", + "url": "https://sanctions-tool.ec.europa.eu", + "description": "European Commission tool for searching EU restrictive measures and consolidated sanctions lists targeting persons, entities, and bodies.", + "status": "degraded", + "pricing": "free", + "bestFor": "Checking individuals or entities against EU sanctions regimes", + "input": "Person or entity name", + "output": "Matches against EU consolidated sanctions list with designation details", + "opsec": "passive", + "opsecNote": "Public EU government search tool; queries are submitted to an EU server and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "dilisense", + "type": "url", + "url": "https://dilisense.com/en", + "description": "AML compliance platform that screens individuals and entities against sanctions, PEP, and watchlist data sources with fuzzy matching and confidence scoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Commercial AML/KYC sanctions screening and PEP checks", + "input": "Name, date of birth, citizenship, or other identifying information", + "output": "Match results with entity details, list sources, and confidence scores", + "opsec": "passive", + "opsecNote": "Queries sent to dilisense servers; registration required so searches are tied to an account.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "KYC / AML Tools", + "type": "folder", + "children": [ + { + "name": "NameScan", + "type": "url", + "url": "https://namescan.io", + "description": "Compliance screening platform providing sanctions checks, PEP screenings, and adverse media searches against global government databases with a free tier.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick free sanctions and PEP screening with adverse media checks", + "input": "Individual or business name", + "output": "Screening reports with sanctions matches, PEP flags, and adverse media hits", + "opsec": "passive", + "opsecNote": "Free scans available without registration; full access requires account creation.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OpenScreening", + "type": "url", + "url": "https://resources.linkurious.com/openscreening", + "description": "Free graph-based PEP and sanctions screening tool by Linkurious that visualizes connections across persons of interest using OpenSanctions and ICIJ data.", + "status": "live", + "pricing": "free", + "bestFor": "Visualizing connections between sanctioned entities, PEPs, and offshore structures", + "input": "Individual or organization name", + "output": "Interactive graph visualizations showing entity relationships and sanctions connections", + "opsec": "passive", + "opsecNote": "Web-based search against public datasets hosted by Linkurious; queries are sent to their servers.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Companies House (R)", + "type": "url", + "url": "https://find-and-update.company-information.service.gov.uk/", + "description": "Official UK government register for searching company information, officer appointments, and disqualified directors across all UK-registered companies.", + "status": "live", + "pricing": "free", + "bestFor": "Looking up UK company details, officers, and filing history", + "input": "Company name, company number, or officer name", + "output": "Company profiles, registered addresses, officer appointments, filing history, and document images", + "opsec": "passive", + "opsecNote": "Public UK government service; searches are passive lookups against an open register.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "Beneficial Ownership Lookup", + "type": "folder", + "children": [ + { + "name": "OpenOwnership", + "type": "url", + "url": "https://www.openownership.org/en/", + "description": "Global hub for beneficial ownership transparency, providing data standards and a register linking corporate ownership data across jurisdictions.", + "status": "live", + "pricing": "free", + "bestFor": "Investigating beneficial ownership of corporate entities across jurisdictions", + "input": "Company name, jurisdiction, or person name", + "output": "Beneficial ownership chains, corporate structures, and linked entities across registers", + "opsec": "passive", + "opsecNote": "Public web queries against open data; no notification to subjects.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ICIJ Offshore Leaks Database", + "type": "url", + "url": "https://offshoreleaks.icij.org/", + "description": "Searchable database of 800,000+ offshore entities from ICIJ investigations including Panama Papers, Paradise Papers, and Pandora Papers.", + "status": "live", + "pricing": "free", + "bestFor": "Tracing offshore company structures and hidden ownership from leaked documents", + "input": "Person name, company name, address, or jurisdiction", + "output": "Entity records, officer relationships, intermediary connections, and network graphs", + "opsec": "passive", + "opsecNote": "Public database queries; no notification to subjects. Bulk data also available for download.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OCCRP Aleph (R)", + "type": "url", + "url": "https://aleph.occrp.org/", + "description": "Global archive of research material for investigative reporting, aggregating public records, court filings, company registries, and leaks from 200+ sources.", + "status": "live", + "pricing": "free", + "bestFor": "Cross-referencing persons and companies across public records, leaks, and investigative datasets", + "input": "Person name, company name, or document keywords", + "output": "Entity profiles, linked datasets, document matches, and relationship mappings", + "opsec": "passive", + "opsecNote": "Registration required for full access; queries are logged by OCCRP but subjects are not notified.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "Public Records?", + "type": "url", + "url": "https://publicrecords.searchsystems.net/" + }, + { + "name": "The World Bank Open Data Catalog", + "type": "url", + "url": "https://datacatalog.worldbank.org/" + }, + { + "name": "BRB Public Records", + "type": "url", + "url": "https://www.brbpub.com/" + }, + { + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", + "type": "url", + "url": "https://www.govdata.de/" + }, + { + "name": "Open-Data-Portal M\u00fcnchen (German)", + "type": "url", + "url": "https://www.opengov-muenchen.de/" + }, { "name": "Searchable FCC ID Database", "type": "url", @@ -4452,9 +7676,64 @@ "type": "folder", "children": [ { - "name": "OpenSanctions", + "name": "PepChecker (R)", "type": "url", - "url": "https://www.opensanctions.org/" + "url": "https://pepchecker.com", + "description": "PEP and sanctions screening tool offering checks against comprehensive PEP lists and global sanctions databases with a free tier of limited searches.", + "status": "live", + "pricing": "freemium", + "bestFor": "Screening individuals against PEP lists and international sanctions databases", + "input": "Person name", + "output": "PEP match results, sanctions list matches, risk indicators, and political exposure details", + "opsec": "passive", + "opsecNote": "Web-based queries; registration required for workspace features. Subjects are not notified.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Ukraine PEP Register (D)", + "type": "url", + "url": "https://pep.org.ua/en/", + "description": "Formerly a database of Ukrainian politically exposed persons maintained by civil society. Now redirects to a static wartime advocacy page.", + "status": "down", + "pricing": "free", + "bestFor": "Previously used for checking Ukrainian politically exposed persons", + "input": "Person name (when operational)", + "output": "PEP profiles and political positions (when operational)", + "opsec": "passive", + "opsecNote": "Site is no longer functional; original database was a public web lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + { + "name": "EveryPolitician", + "type": "url", + "url": "https://everypolitician.org/", + "description": "Global database of political office-holders now operated as part of the OpenSanctions project, providing structured data on politicians and public officials worldwide.", + "status": "live", + "pricing": "free", + "bestFor": "Looking up current and former political office-holders globally for PEP screening", + "input": "Person name, country, or political position", + "output": "Politician profiles, positions held, party affiliations, and jurisdictional data", + "opsec": "passive", + "opsecNote": "Public database queries against open data; no notification to subjects.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -5557,12 +8836,42 @@ { "name": "Live Journal Seek", "type": "url", - "url": "https://ljseek.com/" + "url": "https://ljseek.com/", + "description": "Search tool for LiveJournal journals and communities across public entries that are indexed.", + "status": "live", + "pricing": "free", + "bestFor": "Finding public LiveJournal entries and historical community discussions", + "input": "Keywords and search terms", + "output": "Matching journal entries with author, date, and snippets", + "opsec": "passive", + "opsecNote": "Searches publicly indexed content and does not contact journal owners directly; queries are likely logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Blog Search Engine", "type": "url", - "url": "https://www.blogsearchengine.org/" + "url": "https://www.blogsearchengine.org/", + "description": "Blog-focused search engine for discovering blog posts, directories, and RSS-connected content.", + "status": "live", + "pricing": "free", + "bestFor": "Blog discovery and topic-focused blog post searching", + "input": "Keywords and blog topics", + "output": "Matching blog posts, listings, and feed-linked results", + "opsec": "passive", + "opsecNote": "Aggregates publicly indexed blog data without direct user contact to target blogs; queries are logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5573,17 +8882,62 @@ { "name": "Discord Bot List", "type": "url", - "url": "https://discord.bots.gg/" + "url": "https://discord.bots.gg/", + "description": "Searchable directory of Discord bots with listings, categories, and discovery metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Discord bot discovery and ecosystem mapping", + "input": "Bot names, keywords, and categories", + "output": "Bot profiles with descriptions, ratings, and invite metadata", + "opsec": "passive", + "opsecNote": "Enumerates publicly listed bots and does not require direct Discord account interaction for browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "ReconXplorer (T)", "type": "url", - "url": "https://github.com/root7am/ReconXplorer" + "url": "https://github.com/root7am/ReconXplorer", + "description": "Open-source reconnaissance toolkit with modules for IP, email, and Discord-focused lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-input OSINT checks from a local scriptable toolkit", + "input": "IP addresses, emails, Discord tokens, and host data", + "output": "Recon results including geolocation, service, and account-related metadata", + "opsec": "active", + "opsecNote": "Runs direct external queries from the operator environment and may trigger service-side detection or logging.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Top.gg", "type": "url", - "url": "https://top.gg/" + "url": "https://top.gg/", + "description": "Large Discord bot and app discovery platform with ranking, filtering, and listing data.", + "status": "live", + "pricing": "free", + "bestFor": "Discord bot ranking analysis and app discovery", + "input": "Bot names, tags, and search filters", + "output": "Bot listings with popularity, server counts, and profile details", + "opsec": "passive", + "opsecNote": "Uses public listing data and does not require direct target interaction for standard browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5594,27 +8948,102 @@ { "name": "BoardReader", "type": "url", - "url": "https://boardreader.com/" + "url": "https://boardreader.com/", + "description": "Forum search engine that indexes discussions across message boards and community platforms.", + "status": "live", + "pricing": "free", + "bestFor": "Finding forum threads and topic-centric discussion history", + "input": "Keywords, forum names, and topical queries", + "output": "Indexed posts and thread references with source links", + "opsec": "passive", + "opsecNote": "Searches indexed forum content and avoids direct interaction with target forum users.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Omgili", "type": "url", - "url": "https://webz.io/" + "url": "https://webz.io/", + "description": "Forum and discussion search capability operated through Webz.io infrastructure and data products.", + "status": "live", + "pricing": "freemium", + "bestFor": "Forum discussion discovery with optional API-driven workflows", + "input": "Keywords and Boolean-style forum queries", + "output": "Discussion posts and thread-level matching results", + "opsec": "passive", + "opsecNote": "Uses indexed discussion datasets from a third-party provider; user-side browsing is passive.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Craigslist Forums", "type": "url", - "url": "https://forums.craigslist.org/" + "url": "https://forums.craigslist.org/", + "description": "Craigslist-hosted forum system for public community discussions and region-oriented threads.", + "status": "live", + "pricing": "free", + "bestFor": "Reviewing Craigslist community discussions and regional forum activity", + "input": "Forum categories, keywords, and regional navigation", + "output": "Forum threads, post content, and timing context", + "opsec": "passive", + "opsecNote": "Reads publicly visible forum content and does not require direct messaging or contact with users.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Delphi Forum Search", "type": "url", - "url": "https://www.delphiforums.com/" + "url": "https://www.delphiforums.com/", + "description": "Forum platform with searchable user communities across niche interest categories.", + "status": "live", + "pricing": "freemium", + "bestFor": "Niche forum discovery and historical community thread review", + "input": "Forum names, categories, and keywords", + "output": "Forum listings, thread titles, and message pages", + "opsec": "passive", + "opsecNote": "Public forum browsing is passive; some communities may require registration for deeper access.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Groups Search", "type": "url", - "url": "https://groups.google.com/forum/#!overview" + "url": "https://groups.google.com/forum/#!overview", + "description": "Search interface for Google Groups and archived discussion content, including historical threads.", + "status": "live", + "pricing": "free", + "bestFor": "Researching archived mailing-list and discussion-group content", + "input": "Keywords, group names, authors, and date ranges", + "output": "Thread messages and group-level discussion results", + "opsec": "passive", + "opsecNote": "Searches archived public discussions through Google-hosted infrastructure where activity is logged.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5625,22 +9054,82 @@ { "name": "Mibbit", "type": "url", - "url": "https://search.mibbit.com/" + "url": "https://search.mibbit.com/", + "description": "Former web IRC client and channel search service that is no longer operational.", + "status": "down", + "pricing": "free", + "bestFor": "Legacy reference for historical IRC channel search workflows", + "input": "Channel or keyword queries (historical behavior)", + "output": "No current output; service is discontinued", + "opsec": "Unknown", + "opsecNote": "Service shut down on August 30, 2024 and cannot be relied on for active workflows.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "IRCP (T)", "type": "url", - "url": "https://github.com/internet-relay-chat/IRCP" + "url": "https://github.com/internet-relay-chat/IRCP", + "description": "Python-based IRC probing utility for scanning servers and collecting network/channel metadata.", + "status": "live", + "pricing": "free", + "bestFor": "IRC server enumeration and protocol-level reconnaissance", + "input": "Target ranges, IRC ports, and server parameters", + "output": "Server and channel metadata in machine-readable output", + "opsec": "active", + "opsecNote": "Actively connects to IRC services and may be detectable by network monitoring and server logs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ircsnapshot (T)", "type": "url", - "url": "https://github.com/bwall/ircsnapshot" + "url": "https://github.com/bwall/ircsnapshot", + "description": "IRC data collection tool that connects bots to servers for user and channel mapping.", + "status": "live", + "pricing": "free", + "bestFor": "IRC topology mapping and user/channel relationship analysis", + "input": "IRC server details, bot config, and channel targets", + "output": "Collected user, hostmask, and channel affiliation data", + "opsec": "active", + "opsecNote": "Requires active network participation via bot accounts and is likely visible to channel operators.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "netsplit.de", "type": "url", - "url": "https://netsplit.de/channels/search.php" + "url": "https://netsplit.de/channels/search.php", + "description": "IRC directory and search portal for channel listings, network stats, and discovery workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Passive IRC channel discovery and network trend checks", + "input": "Channel names, keywords, and network filters", + "output": "Channel listings with network and user-count context", + "opsec": "passive", + "opsecNote": "Uses aggregated indexed IRC data and does not require direct IRC server interaction for searches.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5651,17 +9140,62 @@ { "name": "Arctic Shift", "type": "url", - "url": "https://arctic-shift.photon-reddit.com/" + "url": "https://arctic-shift.photon-reddit.com/", + "description": "Search and access layer for Reddit datasets with tools for historical content retrieval and analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical Reddit dataset analysis and subreddit research", + "input": "Search terms, dataset queries, or API-style requests", + "output": "Matching Reddit posts, comments, and metadata from indexed datasets", + "opsec": "passive", + "opsecNote": "Works against archived or indexed data sources without requiring direct engagement with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cama's Reddit Search", "type": "url", - "url": "https://camas.github.io/reddit-search/" + "url": "https://camas.github.io/reddit-search/", + "description": "Web tool for searching Reddit posts and comments by author, subreddit, text, and time filters.", + "status": "live", + "pricing": "free", + "bestFor": "Reddit user and subreddit content discovery", + "input": "Usernames, subreddits, keywords, and date constraints", + "output": "Filtered post/comment search results with metadata", + "opsec": "passive", + "opsecNote": "Uses public data indexing paths; original GitHub hosting was discontinued but alternative hosting remains available.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reveddit", "type": "url", - "url": "https://www.reveddit.com/" + "url": "https://www.reveddit.com/", + "description": "Interface for viewing Reddit content removals using archived and moderation-related visibility signals.", + "status": "live", + "pricing": "free", + "bestFor": "Investigating deleted or removed Reddit discussions", + "input": "Reddit URLs, usernames, or subreddit paths", + "output": "Recovered or flagged removed-content views with moderation indicators", + "opsec": "passive", + "opsecNote": "Queries archive-backed sources and public content pathways without direct contact to target users.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -7706,7 +11240,22 @@ { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Maltiverse",