From e20fdcd9ddce9768d2839fbf3960ccade86b529f Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 02:11:39 -0400 Subject: [PATCH] Enrich 56 IP & MAC Address tools with OSINT metadata - Added comprehensive enrichment fields for all tools in IP & MAC Address category - Populated: description, status, pricing, bestFor, input, output, opsec, opsecNote - Added badges: localInstall, googleDork, registration, editUrl, api, invitationOnly, deprecated - Coverage includes: Geolocation, Host/Port Discovery, IPv4, IPv6, BGP, Reputation, Blacklists, Neighbor Domains, Cloud Services, Wireless, Network Analysis, IP Loggers Co-Authored-By: Paperclip --- public/arf.json | 1243 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 1169 insertions(+), 74 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..428cb8e 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1352,22 +1352,82 @@ { "name": "Follow That Page", "type": "url", - "url": "https://www.followthatpage.com/" + "url": "https://www.followthatpage.com/", + "description": "Website monitoring service that checks pages for changes and sends alerts when tracked content updates. Supports keyword-based notifications for focused monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Tracking updates on specific web pages by keyword", + "input": "Target page URL and optional keyword filters", + "output": "Email alerts showing detected page changes", + "opsec": "passive", + "opsecNote": "Monitoring requests are performed by Follow That Page infrastructure rather than directly from the investigator's workstation.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Urlwatch", "type": "url", - "url": "https://github.com/thp/urlwatch" + "url": "https://github.com/thp/urlwatch", + "description": "Open-source Python CLI tool for monitoring webpages and feeds for changes. Supports multiple filters, reporters, and scheduled checks via local automation.", + "status": "live", + "pricing": "free", + "bestFor": "Self-hosted web page change monitoring automation", + "input": "URLs, feeds, and local watch configuration", + "output": "Diffs and alerts through email, console, or integrations", + "opsec": "passive", + "opsecNote": "Can run locally or on controlled infrastructure, allowing investigators to manage request origin and monitoring cadence.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchThatPage", "type": "url", - "url": "https://watchthatpage.com/" + "url": "https://watchthatpage.com/", + "description": "Web-based page monitoring platform that detects content changes and notifies users by email. Useful for tracking updates on websites without RSS feeds.", + "status": "live", + "pricing": "freemium", + "bestFor": "Monitoring static web pages for updates over time", + "input": "Web page URL and watch configuration", + "output": "Email notifications and change history snapshots", + "opsec": "passive", + "opsecNote": "Page checks originate from WatchThatPage systems instead of directly from the investigator.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ChangeDetect", "type": "url", - "url": "https://www.eatgrainmaker.com/home/" + "url": "https://changedetection.io/", + "description": "Open-source website change detection platform with both self-hosted and hosted options. Supports visual diffs, notifications, and automation workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Flexible page change monitoring with self-hosted control", + "input": "Target URL and optional monitoring rules/selectors", + "output": "Change alerts, snapshots, and webhook/integration notifications", + "opsec": "passive", + "opsecNote": "When self-hosted, investigators control infrastructure and request origin; hosted mode proxies checks through provider systems.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1378,7 +1438,22 @@ { "name": "Google Trends", "type": "url", - "url": "https://trends.google.com/trends/" + "url": "https://trends.google.com/trends/", + "description": "Google analytics interface for comparing search interest trends across terms, regions, and time windows. Includes related queries and topic momentum insights.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking public interest shifts in terms and topics", + "input": "Keywords, geography, category, and date range filters", + "output": "Relative search-interest graphs and related-query suggestions", + "opsec": "passive", + "opsecNote": "Queries are conducted within Google's public trends interface and do not directly interact with investigation targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1394,7 +1469,22 @@ { "name": "DNSViz", "type": "url", - "url": "https://dnsviz.net/" + "url": "https://dnsviz.net/", + "description": "DNS and DNSSEC analysis platform that visualizes delegation chains and cryptographic validation paths. Helps diagnose trust and signing issues in domain configurations.", + "status": "live", + "pricing": "free", + "bestFor": "Visual DNSSEC validation and DNS misconfiguration analysis", + "input": "Domain name", + "output": "DNS resolution graphs, DNSSEC status, and validation diagnostics", + "opsec": "passive", + "opsecNote": "Analysis runs against public DNS infrastructure without direct interaction with domain owners.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1409,12 +1499,42 @@ { "name": "Sn1per (T)", "type": "url", - "url": "https://github.com/1N3/Sn1per" + "url": "https://github.com/1N3/Sn1per", + "description": "Automated reconnaissance and penetration testing framework that orchestrates vulnerability scans and attack-surface discovery workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Automated offensive security reconnaissance pipelines", + "input": "Target domains, hosts, ranges, or web applications", + "output": "Consolidated scan findings, vulnerabilities, and recon artifacts", + "opsec": "active", + "opsecNote": "Directly probes target infrastructure and can generate detectable scanning traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Web-based interface for running Nikto vulnerability checks against web servers. Provides quick external testing without local deployment.", + "status": "live", + "pricing": "free", + "bestFor": "Quick browser-based web server vulnerability scanning", + "input": "Target website URL or host", + "output": "Nikto scan report of detected web server issues", + "opsec": "active", + "opsecNote": "Initiates direct security probing of target web servers and is likely to be logged by defenders.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WDES - Web Data Exposure Scanner (T)", @@ -1430,14 +1550,44 @@ { "name": "Zone-H.org", "type": "url", - "url": "https://zone-h.org/archive" + "url": "https://zone-h.org/archive", + "description": "Archive of reported website defacements and related incident metadata maintained by the Zone-H community.", + "status": "live", + "pricing": "free", + "bestFor": "Historical tracking of website defacement incidents", + "input": "Search terms, domains, or browsing archive filters", + "output": "Defacement records with timestamps and mirrored evidence", + "opsec": "passive", + "opsecNote": "Uses a third-party archive and does not require direct interaction with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "RobotsDisallowed", "type": "url", - "url": "https://github.com/danielmiessler/RobotsDisallowed" + "url": "https://github.com/danielmiessler/RobotsDisallowed", + "description": "Curated wordlist derived from robots.txt disallow paths, used for discovery and content enumeration in security testing.", + "status": "live", + "pricing": "free", + "bestFor": "Directory and content discovery wordlist generation", + "input": "Wordlist consumption by scanners/fuzzers", + "output": "Path candidates likely to expose sensitive or hidden content", + "opsec": "passive", + "opsecNote": "Repository usage is passive; OPSEC risk comes from downstream active scanning tools that consume the list.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1448,32 +1598,122 @@ { "name": "Belati (T)", "type": "url", - "url": "https://github.com/aancw/Belati" + "url": "https://github.com/aancw/Belati", + "description": "Python OSINT framework that aggregates data from multiple online sources and automates collection workflows for investigations.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-based multi-source OSINT collection automation", + "input": "Investigation keywords, handles, domains, or entity identifiers", + "output": "Collected artifacts from integrated OSINT data sources", + "opsec": "passive", + "opsecNote": "Collection relies on public-source queries; risk depends on enabled modules and target-facing lookups.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Burp Suite (T)", "type": "url", - "url": "https://portswigger.net/burp" + "url": "https://portswigger.net/burp", + "description": "Web security testing suite for intercepting, manipulating, and scanning HTTP(S) traffic in web application assessments.", + "status": "live", + "pricing": "freemium", + "bestFor": "Manual and automated web application security testing", + "input": "Target web application traffic and scan targets", + "output": "Intercepted requests, vulnerability findings, and test artifacts", + "opsec": "active", + "opsecNote": "Active testing traffic is sent to targets and can trigger alerts or defensive controls.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "EyeWitness (T)", "type": "url", - "url": "https://github.com/ChrisTruncer/EyeWitness" + "url": "https://github.com/ChrisTruncer/EyeWitness", + "description": "Reconnaissance tool that captures screenshots of web services and helps identify technologies and exposed login interfaces at scale.", + "status": "live", + "pricing": "free", + "bestFor": "Visual triage of large target lists and exposed services", + "input": "List of URLs, hosts, or network service endpoints", + "output": "Screenshots, service metadata, and summary HTML reports", + "opsec": "passive", + "opsecNote": "Primarily collects presentation-layer snapshots; network requests are still sent to targets but with lower interaction depth than exploit scans.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunting-New-Registered-Domains (T)", "type": "url", - "url": "https://github.com/gfek/Hunting-New-Registered-Domains" + "url": "https://github.com/gfek/Hunting-New-Registered-Domains", + "description": "OSINT workflow and scripts focused on identifying newly registered domains likely associated with phishing and brand abuse.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting suspicious newly registered domains for threat hunting", + "input": "Keywords, domain feeds, and candidate domain lists", + "output": "Prioritized domain candidates for further investigation", + "opsec": "passive", + "opsecNote": "Analysis is based on external data sources and does not require direct target interaction by default.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "International Domain Name Conversion Tool", "type": "url", - "url": "https://mct.verisign-grs.com/" + "url": "https://mct.verisign-grs.com/", + "description": "Web utility for converting internationalized domain names between Unicode and Punycode representations.", + "status": "live", + "pricing": "free", + "bestFor": "IDN normalization and Unicode/Punycode translation", + "input": "Domain name in Unicode or Punycode format", + "output": "Converted domain representation in alternate encoding", + "opsec": "passive", + "opsecNote": "Conversion operations are deterministic and do not involve contacting investigation targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Browser-based Nikto scanning endpoint for identifying common web server misconfigurations and known weaknesses.", + "status": "live", + "pricing": "free", + "bestFor": "Fast external vulnerability checks against web targets", + "input": "Website URL or host target", + "output": "Web vulnerability scan results and issue summary", + "opsec": "active", + "opsecNote": "Performs active probing against target systems that may be detected and logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1687,42 +1927,162 @@ { "name": "MaxMind Demo", "type": "url", - "url": "https://www.maxmind.com/en/home" + "url": "https://www.maxmind.com/en/home", + "description": "Web-based IP geolocation demo with location, ASN, and network data from MaxMind's GeoIP database.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP geolocation", + "input": "IP address", + "output": "Country, region, city, coordinates, ASN", + "opsec": "passive", + "opsecNote": "Queries MaxMind; submissions logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4/IPv6 lists by country code", "type": "url", - "url": "https://github.com/ipverse/" + "url": "https://github.com/ipverse/", + "description": "Database of IPv4 and IPv6 address ranges organized by country for geographic IP filtering.", + "status": "live", + "pricing": "free", + "bestFor": "Country-level IP enumeration", + "input": "Country code", + "output": "IP ranges in CIDR notation", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP allocations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2Location.com", "type": "url", - "url": "https://www.ip2location.com/demo" + "url": "https://www.ip2location.com/demo", + "description": "Commercial IP geolocation service with free demo and database. Provides location, proxy detection, and network data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate geolocation with proxy detection", + "input": "IP address", + "output": "Location, ASN, proxy type, VPN status, timezone", + "opsec": "passive", + "opsecNote": "Passive database lookup; free tier limited.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Fingerprints", "type": "url", - "url": "https://ipfingerprints.com/" + "url": "https://ipfingerprints.com/", + "description": "Reverse IP lookup service identifying all domains hosted on a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Uses public DNS reverse lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DB-IP", "type": "url", - "url": "https://db-ip.com/" + "url": "https://db-ip.com/", + "description": "Lightweight IP geolocation API covering 46M+ IPv4/IPv6 blocks with city-level accuracy.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate IP geolocation with developer API", + "input": "IP address", + "output": "Location, timezone, ISP, coordinates", + "opsec": "passive", + "opsecNote": "Passive database lookup; free API rate limited.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Location Finder", "type": "url", - "url": "https://www.iplocation.net/" + "url": "https://www.iplocation.net/", + "description": "Web-based tool for IP geolocation with maps and detailed location information.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP location with maps", + "input": "IP address", + "output": "City, coordinates, ISP, hostname", + "opsec": "passive", + "opsecNote": "Passive lookup; no notification to target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Info Sniper", "type": "url", - "url": "https://www.infosniper.net/" + "url": "https://www.infosniper.net/", + "description": "Multi-field reverse OSINT tool for IP, email, phone lookups with social media enumeration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-field reverse lookup (IP/email/phone)", + "input": "IP, email, or phone", + "output": "Associated accounts and social profiles", + "opsec": "passive", + "opsecNote": "Correlates public data; paid features available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "utrace", "type": "url", - "url": "https://en.utrace.de/" + "url": "https://en.utrace.de/", + "description": "IP geolocation and reverse DNS lookup tool with network traceroute visualization.", + "status": "live", + "pricing": "free", + "bestFor": "IP location and traceroute", + "input": "IP or hostname", + "output": "Location, ASN, reverse DNS, route path", + "opsec": "active", + "opsecNote": "Traceroute is active; geolocation is passive.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1733,67 +2093,262 @@ { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "Website scanner analyzing URLs and domains for malicious content with infrastructure intelligence.", + "status": "live", + "pricing": "freemium", + "bestFor": "URL/domain scanning for malware and phishing", + "input": "URL or domain", + "output": "Screenshot, DNS, IP, certificates, cookies", + "opsec": "passive", + "opsecNote": "Passive scanning; no direct contact with target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/ip" + "url": "https://spyse.com/search/ip", + "description": "Internet assets search engine collecting and analyzing public data for attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and reconnaissance", + "input": "IP, domain, email, organization", + "output": "Subdomains, services, vulnerabilities, data breaches", + "opsec": "passive", + "opsecNote": "Passive data collection; requires account for full access.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Shodan", "type": "url", - "url": "https://www.shodan.io/" + "url": "https://www.shodan.io/", + "description": "Search engine for internet-connected devices, providing visibility into exposed services and vulnerabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Find exposed IoT and network services", + "input": "IP, port, service type", + "output": "Service banners, open ports, vulnerabilities, location", + "opsec": "passive", + "opsecNote": "Passive data collection; InternetDB API free for non-commercial use.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://netlas.io/" + "url": "https://netlas.io/", + "description": "Comprehensive internet scanning platform with OSINT, DNS, and WHOIS data. Free tier: 50 requests/day.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset reconnaissance with web, DNS, WHOIS", + "input": "IP, domain, ASN", + "output": "Open ports, services, certificates, DNS records, WHOIS", + "opsec": "passive", + "opsecNote": "Passive scanning with account-based rate limits.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Portmap", "type": "url", - "url": "https://portmap.com/" + "url": "https://portmap.com/", + "description": "Port mapping tool that scans for open ports and services on target IP addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Port scanning and service discovery", + "input": "IP address or hostname", + "output": "Open ports, service types, versions", + "opsec": "active", + "opsecNote": "Active port scanning probes target network.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Scans.io", "type": "url", - "url": "https://scans.io/" + "url": "https://scans.io/", + "description": "Archive of internet-wide scan data including censys scans and other reconnaissance data.", + "status": "live", + "pricing": "free", + "bestFor": "Historical internet scan data access", + "input": "IP or domain", + "output": "Historical scan results, service history", + "opsec": "passive", + "opsecNote": "Passive access to historical scanning archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Nmap (T)", "type": "url", - "url": "https://nmap.org/download.html" + "url": "https://nmap.org/download.html", + "description": "Open-source network mapping and port scanning tool with OS detection and service version identification.", + "status": "live", + "pricing": "free", + "bestFor": "Network reconnaissance and port scanning", + "input": "IP range or hostname", + "output": "Open ports, OS type, service versions, MAC addresses", + "opsec": "active", + "opsecNote": "Active scanning tool; generates network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Port scanner", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Web-based port scanner checking open ports on target IP addresses without installation.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port scanning without tools", + "input": "IP address and port range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active port scanning; limited to common ports on free tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Internet Census Search", "type": "url", - "url": "https://www.exfiltrated.com/querystart.php" + "url": "https://www.exfiltrated.com/querystart.php", + "description": "Search interface for the Shodan-like internet census data and open services.", + "status": "live", + "pricing": "free", + "bestFor": "Search open services and devices", + "input": "Service type, IP range, port", + "output": "List of exposed services and IPs", + "opsec": "passive", + "opsecNote": "Passive data search of known internet census.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "IP reputation and threat intelligence platform analyzing malicious IP addresses and attacks.", + "status": "live", + "pricing": "freemium", + "bestFor": "IP reputation and malicious activity analysis", + "input": "IP address", + "output": "Threat reports, activity logs, attack types", + "opsec": "passive", + "opsecNote": "Passive threat intelligence lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Scanless (T)", "type": "url", - "url": "https://github.com/vesche/scanless" + "url": "https://github.com/vesche/scanless", + "description": "Command-line tool for port scanning without leaving traces on target using third-party services.", + "status": "live", + "pricing": "free", + "bestFor": "Stealthy port scanning via proxies", + "input": "IP and port", + "output": "Open port results", + "opsec": "passive", + "opsecNote": "Routes scans through third-party services for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BinaryEdge (R)", "type": "url", - "url": "https://www.binaryedge.io/" + "url": "https://www.binaryedge.io/", + "description": "Commercial security research platform with internet-wide scanning and module-based detection.", + "status": "live", + "pricing": "paid", + "bestFor": "Commercial internet threat intelligence", + "input": "IP, domain, query", + "output": "Services, vulnerabilities, threat modules", + "opsec": "passive", + "opsecNote": "Commercial threat intelligence requiring subscription.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Masscan (T)", "type": "url", - "url": "https://github.com/robertdavidgraham/masscan" + "url": "https://github.com/robertdavidgraham/masscan", + "description": "Ultra-fast TCP port scanner designed for scanning large IP ranges and entire networks.", + "status": "live", + "pricing": "free", + "bestFor": "Large-scale network port scanning", + "input": "IP range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active scanner; generates significant network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1804,42 +2359,162 @@ { "name": "ASlookup.com", "type": "url", - "url": "https://aslookup.com/" + "url": "https://aslookup.com/", + "description": "BGP and autonomous system lookup tool for finding IP ranges and ownership information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP and ASN lookup", + "input": "ASN or IP address", + "output": "IP ranges, organization, peering info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Port scanner Online", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Simple web-based port scanner for checking common ports on target IPs.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port availability checks", + "input": "IP and port", + "output": "Port status (open/closed)", + "opsec": "active", + "opsecNote": "Active probing; may be logged by firewalls.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Onyphe", "type": "url", - "url": "https://www.onyphe.io/" + "url": "https://www.onyphe.io/", + "description": "Cyber defense search engine with internet scanning, threat intelligence, and attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and threat intel", + "input": "IP, domain, CVE", + "output": "Services, vulnerabilities, certificates, datasources", + "opsec": "passive", + "opsecNote": "Passive intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/as2.0/" + "url": "https://www.cidr-report.org/as2.0/", + "description": "Tool for analyzing IPv4 CIDR blocks and finding contained IP addresses and subnets.", + "status": "live", + "pricing": "free", + "bestFor": "CIDR block analysis and subnet enumeration", + "input": "CIDR block", + "output": "IP ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IP allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reverse.report", "type": "url", - "url": "https://reverse.report/" + "url": "https://reverse.report/", + "description": "Comprehensive reverse lookup tool for IP to domain, email, and phone number associations.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse IP and domain lookups", + "input": "IP address or domain", + "output": "Associated domains, subdomains, history", + "opsec": "passive", + "opsecNote": "Passive lookup of DNS and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Team Cymru IP to ASN", "type": "url", - "url": "https://asn.cymru.com/" + "url": "https://asn.cymru.com/", + "description": "IP to ASN mapping tool providing autonomous system ownership and prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN mapping", + "input": "IP address", + "output": "ASN, organization, prefix", + "opsec": "passive", + "opsecNote": "Passive lookup of BGP and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP to ASN DB", "type": "url", - "url": "https://iptoasn.com/" + "url": "https://iptoasn.com/", + "description": "Database and API service for looking up which ASN owns a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN lookup with historical data", + "input": "IP address", + "output": "ASN, organization, prefix, company info", + "opsec": "passive", + "opsecNote": "Passive database lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hacker Target - Reverse DNS", "type": "url", - "url": "https://hackertarget.com/reverse-dns-lookup/" + "url": "https://hackertarget.com/reverse-dns-lookup/", + "description": "Reverse DNS lookup tool and API finding domain names associated with IP addresses.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse DNS lookup of IP addresses", + "input": "IP address or range", + "output": "Associated domains and PTR records", + "opsec": "passive", + "opsecNote": "Passive DNS lookup; includes free API tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1850,7 +2525,22 @@ { "name": "IPv6 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/v6/as2.0/" + "url": "https://www.cidr-report.org/v6/as2.0/", + "description": "CIDR block analysis tool for IPv6 address ranges and subnet enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "IPv6 CIDR block analysis", + "input": "IPv6 CIDR block", + "output": "IPv6 ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IPv6 allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1861,22 +2551,82 @@ { "name": "Hurricane Electric BGP Toolkit", "type": "url", - "url": "https://bgp.he.net/" + "url": "https://bgp.he.net/", + "description": "BGP and network routing analysis tools including AS to prefix lookup and BGP prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP analysis and routing intelligence", + "input": "ASN, IP range, or prefix", + "output": "BGP routes, peering, organization info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Malicious Content Ranking", "type": "url", - "url": "https://bgpranking.circl.lu/" + "url": "https://bgpranking.circl.lu/", + "description": "Platform ranking ASNs and BGP prefixes by malicious content and security threats.", + "status": "live", + "pricing": "free", + "bestFor": "Identify malicious ASNs and networks", + "input": "ASN or prefix", + "output": "Threat ranking, malicious activity metrics", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PeeringDB", "type": "url", - "url": "https://www.peeringdb.com/advanced_search" + "url": "https://www.peeringdb.com/advanced_search", + "description": "Database of internet exchange points, member networks, and AS relationships for network mapping.", + "status": "live", + "pricing": "free", + "bestFor": "Internet peering and AS relationship mapping", + "input": "ASN, organization, or IX", + "output": "Peering relationships, exchange points, contacts", + "opsec": "passive", + "opsecNote": "Passive lookup of public peering data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Tools", "type": "url", - "url": "https://www.bgp4.as/tools" + "url": "https://www.bgp4.as/tools", + "description": "Collection of BGP analysis and AS number lookup tools for network intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "BGP routing and AS analysis", + "input": "ASN, IP, or prefix", + "output": "Routes, prefixes, organizations", + "opsec": "passive", + "opsecNote": "Passive analysis of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1887,17 +2637,62 @@ { "name": "IP Void", "type": "url", - "url": "https://www.ipvoid.com/" + "url": "https://www.ipvoid.com/", + "description": "IP reputation and threat intelligence service analyzing blacklist status and security risks.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP reputation and blacklist status", + "input": "IP address", + "output": "Threat score, blacklist status, reports", + "opsec": "passive", + "opsecNote": "Passive reputation lookup; account needed for full data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExoneraTor", "type": "url", - "url": "https://exonerator.torproject.org/" + "url": "https://exonerator.torproject.org/", + "description": "Tool for checking if an IP address belonged to Tor at a specific date.", + "status": "live", + "pricing": "free", + "bestFor": "Verify Tor relay membership by date", + "input": "IP address and date", + "output": "Tor exit/entry node status confirmation", + "opsec": "passive", + "opsecNote": "Passive historical Tor relay lookup from public archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grey Noise", "type": "url", - "url": "https://viz.greynoise.io/" + "url": "https://viz.greynoise.io/", + "description": "Platform for analyzing internet background noise and identifying benign scanning activity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Distinguish malicious from benign internet activity", + "input": "IP address", + "output": "Classification, scanner type, threat assessment", + "opsec": "passive", + "opsecNote": "Passive threat intelligence; free tier available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1908,22 +2703,82 @@ { "name": "Blocklist.de", "type": "url", - "url": "https://www.blocklist.de/en/index.html" + "url": "https://www.blocklist.de/en/index.html", + "description": "Community-contributed blocklist of IP addresses involved in attacks and malicious activity.", + "status": "live", + "pricing": "free", + "bestFor": "Check IP blacklist status", + "input": "IP address", + "output": "Blacklist status, attack types logged", + "opsec": "passive", + "opsecNote": "Passive lookup of community blocklist.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DShield API", "type": "url", - "url": "https://isc.sans.edu/api/" + "url": "https://isc.sans.edu/api/", + "description": "API and database of security events and IPs involved in attacks monitored by SANS.", + "status": "live", + "pricing": "free", + "bestFor": "Query IPs involved in attacks", + "input": "IP address", + "output": "Attack reports, threat activity", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from SANS monitored networks.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Project Honey Pot", "type": "url", - "url": "https://www.projecthoneypot.org/list_of_ips.php" + "url": "https://www.projecthoneypot.org/list_of_ips.php", + "description": "Global honeypot network collecting spam and attack data with IP reputation service.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP for spam and attack history", + "input": "IP address", + "output": "Threat score, spam reports, attack activity", + "opsec": "passive", + "opsecNote": "Passive lookup of honeypot-collected threat data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1934,22 +2789,82 @@ { "name": "IP Fingerprints - Reverse IP Lookup", "type": "url", - "url": "https://ipfingerprints.com/reverseip.php" + "url": "https://ipfingerprints.com/reverseip.php", + "description": "Find all domains hosted on a shared IP address through reverse IP lookup.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bing IP Search (D)", "type": "url", - "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" + "url": "https://www.bing.com/search?q=ip%3A8.8.8.8", + "description": "Bing search operator for finding domains and subdomains hosted on a specific IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on IP using Bing index", + "input": "IP address", + "output": "Domains indexed by Bing on that IP", + "opsec": "passive", + "opsecNote": "Passive search using Bing's public index.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TCP/IP Utils - Domain Neighbors", "type": "url", - "url": "https://dnslytics.com/" + "url": "https://dnslytics.com/", + "description": "Find all domains on the same IP and subdomain information via reverse IP lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Identify related domains on same IP", + "input": "Domain or IP", + "output": "Neighbor domains, IP info", + "opsec": "passive", + "opsecNote": "Passive DNS and IP lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MyIPNeighbors", "type": "url", - "url": "https://www.my-ip-neighbors.com/" + "url": "https://www.my-ip-neighbors.com/", + "description": "Reverse IP lookup tool for discovering all domains and subdomains on an IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find all domains on same shared IP", + "input": "IP address", + "output": "List of domains on IP, subdomains", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1960,12 +2875,42 @@ { "name": "CloudFlare Watch", "type": "url", - "url": "https://www.crimeflare.com/" + "url": "https://www.crimeflare.com/", + "description": "Tool for identifying and analyzing websites protected by Cloudflare's CDN and security services.", + "status": "live", + "pricing": "free", + "bestFor": "Identify Cloudflare-protected sites", + "input": "Domain or IP", + "output": "Cloudflare status, origin IP (if discoverable)", + "opsec": "passive", + "opsecNote": "Passive lookup of Cloudflare configurations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CloudFail (T)", "type": "url", - "url": "https://github.com/m0rtem/CloudFail" + "url": "https://github.com/m0rtem/CloudFail", + "description": "Tool for finding origin IPs of Cloudflare-protected websites through enumeration techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Bypass Cloudflare to find origin IP", + "input": "Domain protected by Cloudflare", + "output": "Origin IP address (if discoverable)", + "opsec": "active", + "opsecNote": "Uses active enumeration and DNS history techniques.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1976,12 +2921,42 @@ { "name": "WiGLE: Wireless Network Mapping", "type": "url", - "url": "https://wigle.net/" + "url": "https://wigle.net/", + "description": "Global database of wireless networks (WiFi, Bluetooth, cellular) with mapping and signal strength data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Map wireless networks and find signal coverage", + "input": "Location, SSID, or BSSID", + "output": "Network locations, signal maps, network details", + "opsec": "passive", + "opsecNote": "Crowdsourced wireless network data; passive lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenCellid: Database of Cell Towers", "type": "url", - "url": "https://opencellid.org/" + "url": "https://opencellid.org/", + "description": "Open database of cellular tower locations and coverage for mobile network geolocation.", + "status": "live", + "pricing": "free", + "bestFor": "Find cellular tower locations and coverage", + "input": "Cell tower ID or location", + "output": "Tower coordinates, operator, coverage area", + "opsec": "passive", + "opsecNote": "Passive lookup of public cellular network data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1992,22 +2967,82 @@ { "name": "Wireshark", "type": "url", - "url": "https://www.wireshark.org/download.html" + "url": "https://www.wireshark.org/download.html", + "description": "Open-source network packet analyzer for deep packet inspection and network troubleshooting.", + "status": "live", + "pricing": "free", + "bestFor": "Network packet analysis and protocol debugging", + "input": "Network traffic capture file", + "output": "Detailed packet analysis, protocol breakdown", + "opsec": "Unknown", + "opsecNote": "Tool-dependent; passive capture or active sniffing possible.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NetworkMiner", "type": "url", - "url": "https://www.netresec.com/?page=Networkminer" + "url": "https://www.netresec.com/?page=Networkminer", + "description": "Passive network forensics tool for extracting files and data from network traffic captures.", + "status": "live", + "pricing": "free", + "bestFor": "Network forensics and file extraction from traffic", + "input": "PCAP network traffic files", + "output": "Extracted files, metadata, network sessions", + "opsec": "passive", + "opsecNote": "Passive analysis of already-captured traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Packet Total", "type": "url", - "url": "https://www.packettotal.com/" + "url": "https://www.packettotal.com/", + "description": "Online platform for uploading and analyzing network packet captures (PCAP files).", + "status": "live", + "pricing": "free", + "bestFor": "Cloud-based network forensics analysis", + "input": "PCAP files", + "output": "Traffic analysis, threat indicators, IoCs", + "opsec": "Unknown", + "opsecNote": "Passive analysis of PCAP; consider privacy of uploaded data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "checkip (T)", "type": "url", - "url": "https://github.com/jreisinger/checkip" + "url": "https://github.com/jreisinger/checkip", + "description": "Command-line utility for checking local machine IP address and network connectivity.", + "status": "live", + "pricing": "free", + "bestFor": "Display local IP and network info", + "input": "Local system (no input needed)", + "output": "Local IP, gateway, DNS servers", + "opsec": "passive", + "opsecNote": "Passive system utility; local only.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2018,17 +3053,62 @@ { "name": "Ki.tc", "type": "url", - "url": "https://ki.tc" + "url": "https://ki.tc", + "description": "IP logging service that generates trackable links for IP/browser info collection.", + "status": "live", + "pricing": "free", + "bestFor": "Generate trackable links to log visitor IPs", + "input": "Target URL or destination", + "output": "Tracker link, IP logs, browser info", + "opsec": "Unknown", + "opsecNote": "Creates tracking mechanism; detection depends on how link is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grabify", "type": "url", - "url": "https://grabify.link" + "url": "https://grabify.link", + "description": "URL shortener service that logs IP addresses and device information of link clickers.", + "status": "live", + "pricing": "free", + "bestFor": "Shorten URLs and log visitor IPs", + "input": "URL to shorten", + "output": "Short URL with IP logging", + "opsec": "Unknown", + "opsecNote": "Creates tracking link; malicious uses common.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Logger", "type": "url", - "url": "https://iplogger.com/" + "url": "https://iplogger.com/", + "description": "IP logging and URL shortening service tracking visitor IP, location, and browser data.", + "status": "live", + "pricing": "free", + "bestFor": "Track visitor IPs through shortened links", + "input": "URL to wrap", + "output": "Logging URL, visitor IP/location data", + "opsec": "Unknown", + "opsecNote": "Tracking service; ethical and legal concerns apply.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -7376,7 +8456,22 @@ { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Maltiverse", @@ -7909,4 +9004,4 @@ ] } ] -} +} \ No newline at end of file