From c0fbb9a7d3e58ea272e3b83dbabe44a94a18c494 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 01:45:34 -0400 Subject: [PATCH] Enrich Domain Name tools batch 3 with OSINT metadata (25 tools) Populated enrichment fields for 25 Domain Name tools across Certificate Search, PassiveDNS, Reputation, and Discovery subsections: - Certificate Search: Google's CT, Spyse, crt.sh, CertKit, certgraph, Netlas.io - PassiveDNS: Mnemonic, DNS Dumpster, Deteque - Reputation: UrlQuery, URL Void, FortiGuard, Trend Micro, WatchGuard, Sucuri, ThreatMiner, BlueCoat WebPulse, Zscaler Zulu, Joe Sandbox, Deepviz, AVG Threat Labs, Webroot BrightCloud - Discovery: ZoomEye.ai Each tool now includes description, status, pricing, bestFor, input/output, opsec classification, and feature badges. Co-Authored-By: Paperclip --- public/arf.json | 391 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 368 insertions(+), 23 deletions(-) diff --git a/public/arf.json b/public/arf.json index 5f0ab28..70e60b2 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1269,7 +1269,22 @@ { "name": "ZoomEye.ai", "type": "url", - "url": "https://www.zoomeye.org/" + "url": "https://www.zoomeye.org/", + "description": "Cyberspace search engine indexing internet-connected devices, services, and vulnerabilities globally. Provides AI-powered search via ZoomEyeGPT with support for ZoomEye dorks for targeted reconnaissance.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet device discovery, service enumeration, vulnerability mapping, attack surface assessment", + "input": "Domain, IP, port, service, or natural language query", + "output": "Device list, port data, banner info, vulnerability details, geographic distribution", + "opsec": "passive", + "opsecNote": "Queries ZoomEye's pre-scanned internet data; does not probe targets during search.", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1285,12 +1300,42 @@ { "name": "Google's Certificate Transparency", "type": "url", - "url": "https://www.certificate-transparency.org/known-logs" + "url": "https://www.certificate-transparency.org/known-logs", + "description": "Directory of all known Certificate Transparency logs monitored by Chrome and other browsers. Browse CT log records to discover issued certificates, identify unauthorized domain certificates, and monitor for certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate discovery, unauthorized cert detection, domain monitoring", + "input": "Domain name or certificate fingerprint", + "output": "List of CT logs and certificates issued for the specified domain", + "opsec": "passive", + "opsecNote": "Queries public certificate logs without contacting the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/certificate" + "url": "https://spyse.com/search/certificate", + "description": "Internet assets registry providing certificate search, domain intelligence, and vulnerability discovery. Scans domains, subdomains, certificates, emails, and open ports across the global internet.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain intelligence, certificate discovery, subdomain enumeration, vulnerability identification", + "input": "Domain, IP, certificate, email, or organization name", + "output": "Domain details, subdomains, certificates, WHOIS info, CVEs, open ports, scraped emails", + "opsec": "passive", + "opsecNote": "Queries Spyse's pre-scanned database; does not contact the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Censys", @@ -1315,22 +1360,82 @@ { "name": "crt.sh - Certificate Search", "type": "url", - "url": "https://crt.sh/?" + "url": "https://crt.sh/?", + "description": "CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate search, subdomain discovery via CT logs, detecting unauthorized certificates", + "input": "Domain name (with or without wildcard)", + "output": "List of certificates issued to the domain with Subject Alternative Names and issue/expiry dates", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CertKit - Certificate Transparency Log Search", "type": "url", - "url": "https://www.certkit.io/tools/ct-logs/" + "url": "https://www.certkit.io/tools/ct-logs/", + "description": "Fast Certificate Transparency log search tool using Clickhouse for sub-second queries. Discover all certificates issued to a domain, including Subject Alternative Names, to reveal hidden infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "CT certificate search, subdomain enumeration, certificate misuse detection", + "input": "Domain name", + "output": "List of certificates with issuance dates, expiry dates, and Subject Alternative Names", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "certgraph (T)", "type": "url", - "url": "https://github.com/lanrat/certgraph" + "url": "https://github.com/lanrat/certgraph", + "description": "CLI tool that crawls SSL certificates via Certificate Transparency logs to create a directed graph of domain relationships. Supports multiple drivers including crt.sh, Censys, HTTPS, and SMTP.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate mapping, domain relationship discovery, hostname enumeration via SSL certificates", + "input": "Hostname or domain name", + "output": "Directed graph showing domain nodes and certificate alternative name connections between domains", + "opsec": "passive", + "opsecNote": "Default HTTPS driver can make connections to hosts; alternative drivers query CT logs passively. Use CT drivers for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/certs/" + "url": "https://app.netlas.io/certs/", + "description": "Internet-wide scanning platform providing SSL certificate search, WHOIS lookups, DNS records, and IP reputation data. Includes web, console, and API access.", + "status": "live", + "pricing": "freemium", + "bestFor": "Certificate search, OSINT investigation, internet asset discovery, exposure monitoring", + "input": "Domain, IP, certificate fingerprint, or search query", + "output": "Certificate details, WHOIS info, DNS records, IP reputation, linked domains", + "opsec": "passive", + "opsecNote": "Queries Netlas's pre-scanned internet data without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1341,17 +1446,62 @@ { "name": "Mnemonic", "type": "url", - "url": "https://passivedns.mnemonic.no/" + "url": "https://passivedns.mnemonic.no/", + "description": "Mnemonic's public PassiveDNS service providing historical and current DNS records collected from global sensor networks. Unauthenticated queries available with rate limiting.", + "status": "live", + "pricing": "free", + "bestFor": "Passive DNS lookups, historical domain resolutions, DNS reconnaissance", + "input": "Domain or IP address", + "output": "DNS query history with timestamps, associated IPs, and historical resolutions", + "opsec": "passive", + "opsecNote": "Queries a passive database of DNS records; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Dumpster", "type": "url", - "url": "https://dnsdumpster.com/" + "url": "https://dnsdumpster.com/", + "description": "Free domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Subdomain enumeration, DNS reconnaissance, infrastructure mapping", + "input": "Domain name", + "output": "MX records, TXT records, Host records, subdomains, infrastructure map", + "opsec": "passive", + "opsecNote": "Passive DNS research without sending direct DNS requests or probing the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Deteque (R)", "type": "url", - "url": "https://www.deteque.com/" + "url": "https://www.deteque.com/", + "description": "Real-time IP, domain, and threat intelligence from Spamhaus and abuse.ch alliance. Provides comprehensive malware, botnet, and abuse data with diverse IOC coverage (IPs, domains, URLs, files, cryptos).", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware tracking, botnet detection, abuse data", + "input": "Domain, IP, URL, file hash, or AS number", + "output": "Threat classification, malware associations, botnet data, historical records (up to 12 months)", + "opsec": "passive", + "opsecNote": "Queries threat intelligence database; does not contact or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1362,67 +1512,262 @@ { "name": "UrlQuery.net", "type": "url", - "url": "https://urlquery.net/" + "url": "https://urlquery.net/", + "description": "Free online URL scanner that analyzes webpages for malware, suspicious elements, and phishing threats. Provides comprehensive threat detection reports with threat briefs on emerging campaigns.", + "status": "live", + "pricing": "free", + "bestFor": "URL reputation scanning, malware detection, phishing detection, threat analysis", + "input": "URL or webpage", + "output": "Threat report, detected threats, malicious behavior, anomalies, security assessment", + "opsec": "active", + "opsecNote": "Visits and analyzes the submitted URL; the target server may detect the scan.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Void", "type": "url", - "url": "https://www.urlvoid.com/" + "url": "https://www.urlvoid.com/", + "description": "Free website reputation checker that scans URLs against 30+ blocklist engines and reputation services. Detects fraudulent and malicious websites with browser extension available.", + "status": "live", + "pricing": "free", + "bestFor": "Website reputation checking, malware/phishing detection, threat analysis", + "input": "Website URL", + "output": "Safety report from 30+ blocklists, IP details, domain age, server location, threat indicators", + "opsec": "passive", + "opsecNote": "Queries blocklist and reputation services; does not directly visit or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FortiGuard Reputation Service", "type": "url", - "url": "https://fortiguard.com/iprep" + "url": "https://fortiguard.com/iprep", + "description": "Fortinet's IP reputation service aggregating malicious source IP data from global threat sensors and collaborators. Blocks botnets, DDoS sources, and IPs associated with phishing, scanning, and malware.", + "status": "live", + "pricing": "free", + "bestFor": "IP reputation lookup, botnet/malware source identification, threat intelligence", + "input": "IP address or IP range", + "output": "IP reputation score, threat categories, malware associations, botnet status", + "opsec": "passive", + "opsecNote": "Queries Fortinet's IP reputation database without contacting the target IP.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Trend Micro Site Safety Center", "type": "url", - "url": "https://global.sitesafety.trendmicro.com/" + "url": "https://global.sitesafety.trendmicro.com/", + "description": "Free service that checks website safety ratings from Trend Micro's research and reputation sources. Identifies websites with malware, phishing activity, or suspicious behavior.", + "status": "live", + "pricing": "free", + "bestFor": "Website safety verification, malware/phishing detection, threat assessment", + "input": "Website URL", + "output": "Safety rating, category classification, threat indicators, historical data", + "opsec": "passive", + "opsecNote": "Queries Trend Micro's pre-scanned website reputation database without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchGuard ReputationAuthority", "type": "url", - "url": "https://www.reputationauthority.org/" + "url": "https://www.reputationauthority.org/", + "description": "In-the-cloud reputation monitoring service analyzing URL and IP threat risk. Assigns reputation scores between 1-100 using data from global sources and deployed systems.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation scoring, threat risk assessment, malicious source identification", + "input": "URL or IP address", + "output": "Reputation score (1-100), threat risk level, URL category, blocking recommendations", + "opsec": "passive", + "opsecNote": "Queries WatchGuard's reputation servers without contacting the target directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sucuri SiteCheck", "type": "url", - "url": "https://sitecheck.sucuri.net/" + "url": "https://sitecheck.sucuri.net/", + "description": "Free remote website scanner that checks for malware, security threats, blacklisting, and vulnerabilities. Detects outdated CMS versions, insecure configurations, and security anomalies.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning, vulnerability detection, security assessment", + "input": "Website URL", + "output": "Security scan report, malware detection, blacklist status, vulnerable plugin/CMS details", + "opsec": "active", + "opsecNote": "Remotely visits the website to check source code and security; may be detectable by WAF/IDS.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThreatMiner.org", "type": "url", - "url": "https://www.threatminer.org/" + "url": "https://www.threatminer.org/", + "description": "Non-profit threat intelligence portal providing IOC research including domains, IPs, malware samples, SSL certificates, WHOIS data, and malicious URLs under Creative Commons license.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence research, IOC investigation, malware/phishing link analysis", + "input": "Domain, IP, file hash (MD5/SHA1/SHA256), SSL certificate, or URL", + "output": "Threat reports, IOC data, WHOIS info, malware associations, related indicators", + "opsec": "passive", + "opsecNote": "Queries aggregated threat intelligence data from multiple sources; does not probe targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BlueCoat WebPulse", "type": "url", - "url": "https://sitereview.bluecoat.com/sitereview.jsp" + "url": "https://sitereview.bluecoat.com/sitereview.jsp", + "description": "Web reputation filtering service rating URLs with 50+ language support. Processes 180+ million rating requests daily with Dynamic Link Analysis for attack injection detection.", + "status": "live", + "pricing": "free", + "bestFor": "URL categorization, website reputation filtering, malicious link detection", + "input": "Website URL", + "output": "URL category, reputation rating, threat indicators, web content classification", + "opsec": "passive", + "opsecNote": "Queries Blue Coat's cloud-based URL reputation database without directly probing targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Zscaler Zulu URL Risk Analyzer", "type": "url", - "url": "https://zulu.zscaler.com/" + "url": "https://zulu.zscaler.com/", + "description": "Free dynamic risk scoring engine for web content analysis. Assesses URLs from multiple perspectives: content analysis, URL patterns, and host reputation using machine learning.", + "status": "live", + "pricing": "free", + "bestFor": "URL risk scoring, web threat detection, malicious content analysis", + "input": "Website URL", + "output": "Risk score, threat assessment at content/URL/host levels, malicious behavior detection", + "opsec": "active", + "opsecNote": "Uses sandboxing to execute URLs in an isolated environment; may detect analysis activity.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe Sandbox Url Analyzer", "type": "url", - "url": "https://www.url-analyzer.net/" + "url": "https://www.url-analyzer.net/", + "description": "Deep URL and document analysis using real browser execution in isolated environments. Detects malware, phishing, and suspicious behavior with detailed system/network monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware/phishing analysis, URL behavior detection, deep web threat investigation", + "input": "URL or document file", + "output": "Detailed behavior analysis, DOM tree, browser data, network capture, threat assessment", + "opsec": "active", + "opsecNote": "Executes URLs in real browsers; detectable by advanced anti-analysis techniques.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Deepviz Domain Search", "type": "url", - "url": "https://search.deepviz.com/" + "url": "https://search.deepviz.com/", + "description": "Threat intelligence platform providing domain, IP, and malware sample search with daily threat feeds. Includes similar sample finding, malware family clustering, and API/Splunk integration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware analysis, threat feed subscription", + "input": "Domain, IP, file hash (MD5), or malware sample", + "output": "Threat intelligence data, malware associations, related IOCs, daily threat feeds", + "opsec": "passive", + "opsecNote": "Queries threat intelligence databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "AVG Threat Labs", "type": "url", - "url": "https://www.avg.com/en/signal/website-safety" + "url": "https://www.avg.com/en/signal/website-safety", + "description": "Website security analysis tool providing instant safety assessment of sites. Merges quantitative threat detection from 100M AVG users with LinkScanner technology in graphical reports.", + "status": "degraded", + "pricing": "free", + "bestFor": "Website safety assessment, threat detection reports, website popularity tracking", + "input": "Website URL", + "output": "Safety analysis, threat report, popularity status, server location, detection timeline", + "opsec": "passive", + "opsecNote": "Queries AVG's threat detection database; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Webroot BrightCloud URL/IP Lookup", "type": "url", - "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" + "url": "https://www.brightcloud.com/tools/url-ip-lookup.php", + "description": "Web classification and reputation tool providing URL/IP threat and content analysis. Uses machine learning reputation scoring across 82 content categories with IP risk tiering.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation lookup, web classification, threat intelligence, web categorization", + "input": "URL or IP address", + "output": "Threat assessment, content category, reputation score, WHOIS data, risk level", + "opsec": "passive", + "opsecNote": "Queries BrightCloud's reputation database without directly contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "vURL Online",