diff --git a/THE-127-domain-enrichment-batch1.md b/THE-127-domain-enrichment-batch1.md new file mode 100644 index 0000000..daf4527 --- /dev/null +++ b/THE-127-domain-enrichment-batch1.md @@ -0,0 +1,551 @@ +# THE-127: Domain Name Tools Enrichment - Batch 1 + +Enrichment data for 25 Domain Name tools in the OSINT Framework arf.json. + +## Whois Records Category + +### 1. Domain Dossier +```json +{ + "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", + "input": "Domain name or IP address", + "output": "WHOIS records, DNS records, IP information, registration details", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 2. domainIQ +```json +{ + "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", + "input": "Domain name", + "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", + "opsec": "passive", + "opsecNote": "Queries aggregated domain data; does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 3. DomainTools Whois +```json +{ + "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", + "status": "live", + "pricing": "paid", + "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", + "input": "Domain name or IP address", + "output": "Current and historical WHOIS records, registrant details, hosting history", + "opsec": "passive", + "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 4. SWITCH Internet Domains Whois (.ch) +```json +{ + "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", + "status": "live", + "pricing": "free", + "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", + "input": ".ch or .li domain name", + "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", + "opsec": "passive", + "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 5. Whoisology +```json +{ + "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", + "input": "Domain name, email, registrant name", + "output": "Historical WHOIS records, ownership changes, registrant information across domains", + "opsec": "passive", + "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 6. Whois ARIN +```json +{ + "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", + "status": "live", + "pricing": "free", + "bestFor": "IP address and ASN registration data, North American internet resource tracking", + "input": "IP address, ASN, organization name, contact information", + "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", + "opsec": "passive", + "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 7. DNSstuff +```json +{ + "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", + "input": "Domain name, IP address", + "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 8. Robtex +```json +{ + "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", + "input": "Domain name, IP address, hostname, autonomous system", + "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", + "opsec": "passive", + "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 9. Domaincrawler.com +```json +{ + "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", + "status": "live", + "pricing": "paid", + "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", + "input": "Domain name, DNS data, technology stack filters", + "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", + "opsec": "passive", + "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 10. MarkMonitor Whois Search +```json +{ + "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", + "status": "live", + "pricing": "paid", + "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", + "input": "Domain name", + "output": "WHOIS records, registration data, brand portfolio information", + "opsec": "passive", + "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 11. easyWhois +```json +{ + "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain WHOIS lookups and DNS checks", + "input": "Domain name", + "output": "WHOIS records, DNS information, registrant details, nameservers", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 12. Website Informer +```json +{ + "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", + "status": "live", + "pricing": "free", + "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", + "input": "Domain name or URL", + "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", + "opsec": "passive", + "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 13. Who.is +```json +{ + "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", + "status": "live", + "pricing": "free", + "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", + "input": "Domain name or IP address", + "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 14. Whois AMPed +```json +{ + "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", + "status": "live", + "pricing": "free", + "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", + "input": "Domain name", + "output": "WHOIS records, domain registration information, registrant details", + "opsec": "passive", + "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 15. ViewDNS.info +```json +{ + "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", + "input": "Domain name, IP address, registrant name/email, nameserver", + "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 16. Daily DNS Changes +```json +{ + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 17. IP2WHOIS +```json +{ + "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", + "status": "live", + "pricing": "free", + "bestFor": "Domain and IP WHOIS lookups, registrant research", + "input": "Domain name or IP address", + "output": "WHOIS records, registrant details, location information, registration dates", + "opsec": "passive", + "opsecNote": "Queries public WHOIS databases; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 18. Netlas.io +```json +{ + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +## Subdomains Category + +### 19. SynapsInt +```json +{ + "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", + "input": "Domain, IP, email, phone, username, CVE ID", + "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", + "opsec": "passive", + "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 20. Aquatone +```json +{ + "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", + "input": "Domain name", + "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", + "opsec": "active", + "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 21. FindSubDomains +```json +{ + "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", + "input": "Domain name or keyword", + "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", + "opsec": "passive", + "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 22. Google Subdomains +```json +{ + "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", + "status": "live", + "pricing": "free", + "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", + "input": "Domain name (as Google Dork syntax: site:domain.com)", + "output": "Indexed subdomains and pages from Google search results", + "opsec": "passive", + "opsecNote": "Uses Google's search index; no direct contact with the target domain.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 23. Recon-ng +```json +{ + "description": "Full-featured web reconnaissance framework with independent modules for data gathering, API integration, and customizable workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Modular web recon, API-driven data collection, credential gathering", + "input": "Domain, company name, email, IP", + "output": "Contacts, hosts, credentials, ports via module-specific results", + "opsec": "passive", + "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 24. XRay +```json +{ + "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", + "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", + "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", + "opsec": "active", + "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 25. DNS Recon +```json +{ + "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", + "status": "live", + "pricing": "free", + "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", + "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", + "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", + "opsec": "active", + "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +--- + +## Summary + +**Tools researched**: 25 +**Category**: Domain Name (Whois Records: 18, Subdomains: 7) +**Pricing breakdown**: +- Free: 15 tools +- Freemium: 4 tools +- Paid: 6 tools + +**OPSEC profile**: +- Passive: 19 tools +- Active: 6 tools + +**Local installation required**: 5 tools (Aquatone, Recon-ng, XRay, DNS Recon, and tools marked with (T)) + +All tools verified as live and accessible as of 2026-03-27. diff --git a/enrichment-batch4-domains.json b/enrichment-batch4-domains.json new file mode 100644 index 0000000..3154513 --- /dev/null +++ b/enrichment-batch4-domains.json @@ -0,0 +1,412 @@ +{ + "enrichments": { + "Threatexpert.com Malicious URLs": { + "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.", + "status": "down", + "pricing": "free", + "bestFor": "Malware URL intelligence", + "input": "Domain or URL", + "output": "Blocklist/Feed format", + "opsec": "passive", + "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Zeus C2 Tracker": { + "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet C2 blocking", + "input": "None (blocklist provider)", + "output": "Domain/IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Queries public Zeus tracker database; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Malware Domains Blacklist": { + "description": "Historical malware domains blocklist providing hosts file format malicious domain list.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Hosts file format", + "opsec": "passive", + "opsecNote": "Legacy service; no longer maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Email Domain Validation": { + "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email domain and mailbox verification", + "input": "Email domain or address", + "output": "Domain validation report, MX records", + "opsec": "active", + "opsecNote": "Active mail server connectivity checks required for validation", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Blackweb": { + "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.", + "status": "live", + "pricing": "free", + "bestFor": "Squid proxy malware filtering", + "input": "None (aggregated blocklist)", + "output": "Squid-compatible blocklist format", + "opsec": "passive", + "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Critical Stack Intel (R)": { + "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.", + "status": "live", + "pricing": "free", + "bestFor": "Network IDS threat intelligence", + "input": "Bro/Zeek intel format", + "output": "Intel.log entries, network alerts", + "opsec": "passive", + "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "DNS Sinkhole": { + "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.", + "status": "degraded", + "pricing": "free", + "bestFor": "DNS-based malware blocking", + "input": "DNS zone file", + "output": "Malware domain sinkhole list", + "opsec": "passive", + "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "DNS-BH Malware Domain Blocklist": { + "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)", + "opsec": "passive", + "opsecNote": "Service sunset; merged into ShadowNet", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Malware Domain List": { + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "MalwareURL (R)": { + "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware URL reputation checking", + "input": "URL", + "output": "Reputation report, blocklist data", + "opsec": "passive", + "opsecNote": "Free lookup service available; commercial network integration available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "scumware.org": { + "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and spyware domain research", + "input": "Domain or URL", + "output": "Domain reputation/blocklist data", + "opsec": "passive", + "opsecNote": "Community-maintained research database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "ZeuS Tracker": { + "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet tracking and blocking", + "input": "None (blocklist provider)", + "output": "Domain blocklist, IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Shadowserver Foundation": { + "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation and abuse intelligence", + "input": "IP address or domain", + "output": "Reputation reports, blocklists, abuse intelligence", + "opsec": "passive", + "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "vURL Online": { + "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.", + "status": "live", + "pricing": "free", + "bestFor": "URL/domain dissection and reputation", + "input": "URL or domain", + "output": "Detailed dissection report", + "opsec": "passive", + "opsecNote": "Passive analysis of URL components and reputation data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "AlienVault Open Threat Exchange": { + "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence sharing", + "input": "Domain, IP, URL, file hash", + "output": "Threat pulses, reputation data, indicators", + "opsec": "passive", + "opsecNote": "Community-sourced intelligence; free API access with registration", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Web Inspector Online Scan": { + "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning", + "input": "Website URL", + "output": "Malware scan report, vulnerability assessment", + "opsec": "active", + "opsecNote": "Active scanning required; connects to target website to analyze content", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Google Safe Browsing API": { + "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and phishing URL detection", + "input": "URL or domain", + "output": "Safe/unsafe classification, threat type", + "opsec": "passive", + "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Cisco Talos": { + "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation intelligence", + "input": "IP address or domain", + "output": "Reputation score, threat indicators, intelligence reports", + "opsec": "passive", + "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "DNS Twist (T)": { + "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting and phishing domain detection", + "input": "Domain name", + "output": "Domain permutation list, DNS records, HTTP similarity", + "opsec": "active", + "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "URLCrazy (T)": { + "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting domain discovery", + "input": "Domain name", + "output": "Domain variant list, registration status", + "opsec": "active", + "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "dnstwister": { + "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Typosquatting monitoring", + "input": "Domain name", + "output": "Domain variants, registration status, DNS records", + "opsec": "active", + "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Catphish (T)": { + "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Red team phishing domain generation", + "input": "Target domain", + "output": "Phishing domain variants, categorization status", + "opsec": "active", + "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "BuiltWith": { + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", + "opsec": "passive", + "opsecNote": "Public website analysis; passive technical reconnaissance", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "SiteSleuth": { + "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking code intelligence and related domain discovery", + "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key", + "output": "List of associated domains and tracking codes", + "opsec": "passive", + "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + } + } +} diff --git a/merge_enrichments.py b/merge_enrichments.py new file mode 100644 index 0000000..f07ecec --- /dev/null +++ b/merge_enrichments.py @@ -0,0 +1,41 @@ +#!/usr/bin/env python3 +import json +import sys + +def merge_enrichment_into_node(node, enrichments): + """Recursively search and merge enrichment data into matching nodes.""" + if isinstance(node, dict): + if "name" in node and node["name"] in enrichments: + # Found a matching tool, merge enrichment data + enrichment = enrichments[node["name"]] + for key, value in enrichment.items(): + node[key] = value + + # Recursively process children + if "children" in node and isinstance(node["children"], list): + for child in node["children"]: + merge_enrichment_into_node(child, enrichments) + +def main(): + # Load enrichment data + with open("enrichment-batch4-domains.json", "r") as f: + enrichment_data = json.load(f) + + enrichments = enrichment_data["enrichments"] + + # Load arf.json + with open("public/arf.json", "r") as f: + arf_data = json.load(f) + + # Merge enrichment data into arf.json + merge_enrichment_into_node(arf_data, enrichments) + + # Write the updated arf.json + with open("public/arf.json", "w") as f: + json.dump(arf_data, f, indent=2) + + print(f"Successfully merged enrichment data for {len(enrichments)} tools") + print("Updated public/arf.json") + +if __name__ == "__main__": + main() diff --git a/public/arf.json b/public/arf.json index 385c075..b88c699 100644 --- a/public/arf.json +++ b/public/arf.json @@ -10,6 +10,26 @@ "name": "Username Search Engines", "type": "folder", "children": [ + { + "name": "WhatsMyName (T)", + "type": "url", + "url": "https://github.com/WebBreacher/WhatsMyName", + "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", + "status": "live", + "pricing": "free", + "bestFor": "Username enumeration using community-maintained site detection data", + "input": "Username", + "output": "List of sites where the username exists, based on HTTP response pattern matching", + "opsec": "active", + "opsecNote": "Makes HTTP requests to each target site to check for username existence.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, { "name": "Sylva Identity Discovery (T)", "type": "url", @@ -70,26 +90,6 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "WhatsMyName (T)", - "type": "url", - "url": "https://github.com/WebBreacher/WhatsMyName", - "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", - "status": "live", - "pricing": "free", - "bestFor": "Username enumeration using community-maintained site detection data", - "input": "Username", - "output": "List of sites where the username exists, based on HTTP response pattern matching", - "opsec": "active", - "opsecNote": "Makes HTTP requests to each target site to check for username existence.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, { "name": "Thats Them", "type": "url", @@ -371,37 +371,142 @@ { "name": "Sylva Identity Discovery (T)", "type": "url", - "url": "https://sylva.pfeister.dev/" + "url": "https://sylva.pfeister.dev/", + "description": "Identity discovery utility that searches GitHub and PGP key servers to link identities across platforms using email addresses, usernames, or PGP keys.", + "status": "live", + "pricing": "free", + "bestFor": "Identity correlation via GitHub and PGP", + "input": "Email, username, or PGP fingerprint", + "output": "Linked identities, GitHub profiles, PGP keys", + "opsec": "passive", + "opsecNote": "Queries public GitHub and PGP servers without direct target contact.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThatsThem", "type": "url", - "url": "https://thatsthem.com/reverse-email-lookup" + "url": "https://thatsthem.com/reverse-email-lookup", + "description": "Reverse email lookup tool that searches a database of hundreds of millions of emails to reveal name, address, phone number, and public records associated with an email address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse email lookup, person identification", + "input": "Email address", + "output": "Name, address, phone number, education", + "opsec": "passive", + "opsecNote": "Queries ThatsThem's public database without alerting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunter", "type": "url", - "url": "https://hunter.io/" + "url": "https://hunter.io/", + "description": "Email finder and verifier that discovers business email addresses from company domains, names, and social profiles with up to 98% accuracy rate.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, email verification", + "input": "Domain name, person name, or company info", + "output": "Verified business email addresses", + "opsec": "passive", + "opsecNote": "Queries Hunter's database of public emails; does not contact targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email to Address (R)", "type": "url", - "url": "https://www.melissa.com/" + "url": "https://www.melissa.com/", + "description": "Melissa.com's data quality and verification service that validates and enriches email addresses with supplementary contact information.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, address enrichment", + "input": "Email addresses, contact data", + "output": "Validated email, postal address, phone", + "opsec": "passive", + "opsecNote": "Data verification service; does not perform reconnaissance.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VoilaNorbert", "type": "url", - "url": "https://www.voilanorbert.com/" + "url": "https://www.voilanorbert.com/", + "description": "Email finder and verifier with 98% success rate that discovers business emails by company/domain, person name, or LinkedIn profile with bulk upload capability.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, bulk email finding", + "input": "Domain, name, or LinkedIn URL", + "output": "Business email addresses, verification status", + "opsec": "passive", + "opsecNote": "Searches public email database; does not contact targets directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "GHunt (T)", "type": "url", - "url": "https://github.com/mxrch/GHunt" + "url": "https://github.com/mxrch/GHunt", + "description": "Offensive Google framework that investigates Google accounts using email addresses to uncover YouTube channels, Google Photos, Maps reviews, and associated artifacts.", + "status": "live", + "pricing": "free", + "bestFor": "Google account investigation, YouTube/Google Photos OSINT", + "input": "Gmail address or GAIA ID", + "output": "YouTube channels, Google Photos, Maps reviews, device info", + "opsec": "active", + "opsecNote": "Requires Google login via browser extension; may be detected by Google.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OSINT Industries", "type": "url", - "url": "https://www.osint.industries/" + "url": "https://www.osint.industries/", + "description": "Account linking service that extracts all registered accounts tied to an email or phone across 500+ platforms including social media, messaging apps, and lifestyle services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Account enumeration, breach detection, digital footprint mapping", + "input": "Email address, phone number, username, or crypto wallet", + "output": "Linked accounts, breach information, geospatial data, timeline", + "opsec": "passive", + "opsecNote": "Scours public websites and databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", @@ -426,27 +531,102 @@ { "name": "Infoga (T)", "type": "url", - "url": "https://github.com/m4ll0k/infoga" + "url": "https://github.com/m4ll0k/infoga", + "description": "Python-based email OSINT tool that gathers email account information (IP, hostname, country) from search engines, PGP servers, and Shodan, with breach checking via haveibeenpwned.", + "status": "live", + "pricing": "free", + "bestFor": "Early-stage email reconnaissance, information gathering", + "input": "Email address", + "output": "IP addresses, hostnames, country, breach status", + "opsec": "passive", + "opsecNote": "Queries search engines and public APIs without direct target contact.", + "localInstall": true, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Skymem", "type": "url", - "url": "https://www.skymem.info/" + "url": "https://www.skymem.info/", + "description": "Email finder that discovers company and personal email addresses by domain or name, with bulk search, email list creation, and advanced filtering capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email discovery by domain, bulk email list creation", + "input": "Domain name or person name + domain", + "output": "Email addresses, bulk email lists", + "opsec": "passive", + "opsecNote": "Scrapes and aggregates public email data from websites and profiles.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Epieos Email Tool", "type": "url", - "url": "https://tools.epieos.com/email.php" + "url": "https://tools.epieos.com/email.php", + "description": "Freemium OSINT tool performing email reverse lookups to uncover associated social media profiles across 120+ websites and services with breach detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email reverse lookup, social media profile discovery", + "input": "Email address or phone number", + "output": "Associated social media profiles, forum posts, breach info", + "opsec": "passive", + "opsecNote": "Passive reconnaissance across 120+ websites; does not alert the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "breach.vip", "type": "url", - "url": "https://breach.vip/" + "url": "https://breach.vip/", + "description": "Free database search engine providing access to 1000+ breach databases for research, email searching, and analysis of compromised credentials.", + "status": "live", + "pricing": "free", + "bestFor": "Breach database search, credential lookup", + "input": "Email, domain, Discord ID, or phone number", + "output": "Breach records, leaked credentials", + "opsec": "passive", + "opsecNote": "Queries aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Holehe (T)", "type": "url", - "url": "https://github.com/megadose/holehe" + "url": "https://github.com/megadose/holehe", + "description": "Python-based email enumeration tool that checks if an email is registered across 120+ websites and services using password-reset mechanisms.", + "status": "live", + "pricing": "free", + "bestFor": "Email account enumeration, service detection", + "input": "Email address", + "output": "List of websites where email is registered", + "opsec": "passive", + "opsecNote": "Uses password-reset functionality without sending emails or alerting targets.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -457,12 +637,42 @@ { "name": "Email Format", "type": "url", - "url": "https://www.email-format.com/" + "url": "https://www.email-format.com/", + "description": "Tool for analyzing and discovering corporate email address patterns and formats to predict valid employee email addresses within an organization.", + "status": "live", + "pricing": "free", + "bestFor": "Corporate email pattern analysis, email format discovery", + "input": "Sample email addresses or company info", + "output": "Predicted email format patterns", + "opsec": "passive", + "opsecNote": "Statistical analysis of publicly known email patterns.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Permutator", "type": "url", - "url": "https://metricsparrow.com/toolkit/email-permutator/" + "url": "https://metricsparrow.com/toolkit/email-permutator/", + "description": "OSINT tool that generates all possible email address combinations from a person's name and domain(s) for reconnaissance and email guessing.", + "status": "live", + "pricing": "free", + "bestFor": "Email pattern generation, targeted email guessing", + "input": "Person name, nickname, domain(s)", + "output": "List of possible email address variations", + "opsec": "passive", + "opsecNote": "Generates permutations without any network contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -473,37 +683,187 @@ { "name": "Reacher Github (T)", "type": "url", - "url": "https://github.com/reacherhq/check-if-email-exists" + "url": "https://github.com/reacherhq/check-if-email-exists", + "description": "Open-source Rust-based email verification API that checks email deliverability without sending messages, detecting catch-all and disposable addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification, bounce detection, list cleaning", + "input": "Email address", + "output": "Deliverability status, MX records, bounce type", + "opsec": "passive", + "opsecNote": "Verifies email existence through MTA queries without sending mail.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Reacher Demo", "type": "url", - "url": "https://reacher.email" + "url": "https://reacher.email", + "description": "Hosted demo of the Reacher email verification API allowing free testing of email validation and deliverability checks online.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification testing, demonstration", + "input": "Email address", + "output": "Deliverability status, bounce information", + "opsec": "passive", + "opsecNote": "Passive MTA-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MailScrap", "type": "url", - "url": "https://mailscrap.com/" + "url": "https://mailscrap.com/", + "description": "Email verification tool that connects to mail servers to verify mailbox existence and removes disposable email addresses from lists.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email validation, list cleaning, disposable email detection", + "input": "Email addresses or email lists", + "output": "Validation status, mailbox existence", + "opsec": "passive", + "opsecNote": "Connects to mail servers for verification without sending messages.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Read Notify", "type": "url", - "url": "https://www.readnotify.com/" + "url": "https://www.readnotify.com/", + "description": "Email tracking and read receipt service that monitors email opens and engagement, useful for confirming email validity through delivery.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email delivery confirmation, read receipt tracking", + "input": "Email address", + "output": "Delivery and read status", + "opsec": "active", + "opsecNote": "Sends tracking pixels; may alert targets to monitoring.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Reputation", "type": "url", - "url": "https://emailrep.io/" + "url": "https://emailrep.io/", + "description": "Tool that checks email reputation, risk scoring, and breach history to identify phishing emails, compromised accounts, and risky addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email reputation checking, risk assessment", + "input": "Email address", + "output": "Reputation score, risk level, breach history", + "opsec": "passive", + "opsecNote": "Passive database lookup without target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MailboxValidator", "type": "url", - "url": "https://www.mailboxvalidator.com/demo" + "url": "https://www.mailboxvalidator.com/demo", + "description": "Email verification API that validates email deliverability, detects catch-all addresses, and provides risk scoring for bulk email list cleaning.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, list cleaning, bounce prevention", + "input": "Email addresses or bulk lists", + "output": "Validation status, risk score, catch-all detection", + "opsec": "passive", + "opsecNote": "Server-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VerifyEmail (R$)", "type": "url", "url": "https://emailable.com/" + }, + { + "name": "Disposable Email Domains (T)", + "type": "url", + "url": "https://github.com/disposable-email-domains/disposable-email-domains", + "description": "Community-maintained blocklist of 5,000+ disposable email domains with allowlist support and multi-language implementation examples. Used by PyPI and other projects.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting disposable and temporary email addresses during verification", + "input": "Domain name to check against the blocklist", + "output": "Match result against the disposable email domain blocklist", + "opsec": "passive", + "opsecNote": "Local list comparison; no external requests made during lookup.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Disposable Emails Registry", + "type": "url", + "url": "https://disposable-emails.github.io/", + "description": "Searchable registry of disposable email domains with bulk download support for threat intelligence integration.", + "status": "live", + "pricing": "free", + "bestFor": "Bulk blocking and threat intelligence integration for disposable email detection", + "input": "Domain name or bulk list download", + "output": "Match result or full disposable domain list (/list.txt)", + "opsec": "passive", + "opsecNote": "Static list download; community-sourced submissions, no external lookups required.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Burner Email Providers (T)", + "type": "url", + "url": "https://github.com/wesbos/burner-email-providers", + "description": "Curated list of temporary email service domains with API references and detection library implementations across multiple languages.", + "status": "live", + "pricing": "free", + "bestFor": "Identifying burner email providers for integration into custom investigation tools", + "input": "Email domain", + "output": "Match result against known burner/temporary email providers", + "opsec": "passive", + "opsecNote": "Local list comparison; MIT licensed for integration use.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -534,17 +894,62 @@ { "name": "Hudson Rock", "type": "url", - "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" + "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools", + "description": "Infostealer threat intelligence platform that searches a database of compromised devices and stolen credentials to identify if emails have been exposed via malware infections.", + "status": "live", + "pricing": "freemium", + "bestFor": "Infostealer detection, breach assessment, device compromise verification", + "input": "Email address, domain, username, or IP", + "output": "Infostealer hits, compromised account data, breach details", + "opsec": "passive", + "opsecNote": "Queries public infostealer database compiled from malware captures.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DeHashed (R)", "type": "url", - "url": "https://dehashed.com/" + "url": "https://dehashed.com/", + "description": "Modern breach search engine indexing historical breach data over a decade old, enabling searches by email, username, password, domain, phone, and IP address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Breach searching, credential lookup, historical breach analysis", + "input": "Email, username, password, domain, phone, or IP", + "output": "Breach records, exposed credentials, breach dates", + "opsec": "passive", + "opsecNote": "Searches aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Vigilante.pw", "type": "url", - "url": "https://www.vigilante.pw/" + "url": "https://www.vigilante.pw/", + "description": "Breach database directory and search platform raising awareness of data breaches by aggregating publicly leaked database information and breach details.", + "status": "live", + "pricing": "free", + "bestFor": "Breach research, public breach database navigation", + "input": "Email, username, domain", + "output": "Breach records, exposed data information", + "opsec": "passive", + "opsecNote": "Aggregates and indexes publicly disclosed breach data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -555,7 +960,22 @@ { "name": "MxToolbox", "type": "url", - "url": "https://mxtoolbox.com/" + "url": "https://mxtoolbox.com/", + "description": "Email deliverability diagnostics tool that checks MX records, SPF, DKIM, DMARC configuration, and server health to prevent email delivery issues.", + "status": "live", + "pricing": "free", + "bestFor": "Email server diagnostics, deliverability testing, DNS validation", + "input": "Domain name or email address", + "output": "MX records, SPF/DKIM/DMARC status, blacklist info", + "opsec": "passive", + "opsecNote": "Public DNS lookups and SMTP diagnostics without target alerting.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -572,92 +992,362 @@ { "name": "Domain Dossier", "type": "url", - "url": "https://centralops.net/co/DomainDossier.aspx" + "url": "https://centralops.net/co/DomainDossier.aspx", + "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", + "input": "Domain name or IP address", + "output": "WHOIS records, DNS records, IP information, registration details", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "domainIQ", "type": "url", - "url": "https://www.domainiq.com/" + "url": "https://www.domainiq.com/", + "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", + "input": "Domain name", + "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", + "opsec": "passive", + "opsecNote": "Queries aggregated domain data; does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DomainTools Whois", "type": "url", - "url": "https://whois.domaintools.com/" + "url": "https://whois.domaintools.com/", + "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", + "status": "live", + "pricing": "paid", + "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", + "input": "Domain name or IP address", + "output": "Current and historical WHOIS records, registrant details, hosting history", + "opsec": "passive", + "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "SWITCH Internet Domains Whois (.ch)", "type": "url", - "url": "https://www.nic.ch/whois/" + "url": "https://www.nic.ch/whois/", + "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", + "status": "live", + "pricing": "free", + "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", + "input": ".ch or .li domain name", + "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", + "opsec": "passive", + "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whoisology", "type": "url", - "url": "https://whoisology.com/#advanced" + "url": "https://whoisology.com/#advanced", + "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", + "input": "Domain name, email, registrant name", + "output": "Historical WHOIS records, ownership changes, registrant information across domains", + "opsec": "passive", + "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whois ARIN", "type": "url", - "url": "https://whois.arin.net/ui/advanced.jsp" + "url": "https://whois.arin.net/ui/advanced.jsp", + "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", + "status": "live", + "pricing": "free", + "bestFor": "IP address and ASN registration data, North American internet resource tracking", + "input": "IP address, ASN, organization name, contact information", + "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", + "opsec": "passive", + "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNSstuff", "type": "url", - "url": "https://www.dnsstuff.com/freetools" + "url": "https://www.dnsstuff.com/freetools", + "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", + "input": "Domain name, IP address", + "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Robtex (R)", "type": "url", - "url": "https://robtex.com/" + "url": "https://robtex.com/", + "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", + "input": "Domain name, IP address, hostname, autonomous system", + "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", + "opsec": "passive", + "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Domaincrawler.com", "type": "url", - "url": "https://domaincrawler.com/" + "url": "https://domaincrawler.com/", + "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", + "status": "live", + "pricing": "paid", + "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", + "input": "Domain name, DNS data, technology stack filters", + "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", + "opsec": "passive", + "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MarkMonitor Whois Search", "type": "url", - "url": "https://domains.markmonitor.com/whois/" + "url": "https://domains.markmonitor.com/whois/", + "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", + "status": "live", + "pricing": "paid", + "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", + "input": "Domain name", + "output": "WHOIS records, registration data, brand portfolio information", + "opsec": "passive", + "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "easyWhois", "type": "url", - "url": "https://www.easywhois.com/" + "url": "https://www.easywhois.com/", + "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain WHOIS lookups and DNS checks", + "input": "Domain name", + "output": "WHOIS records, DNS information, registrant details, nameservers", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Website Informer", "type": "url", - "url": "https://website.informer.com/" + "url": "https://website.informer.com/", + "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", + "status": "live", + "pricing": "free", + "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", + "input": "Domain name or URL", + "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", + "opsec": "passive", + "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Who.is", "type": "url", - "url": "https://who.is/" + "url": "https://who.is/", + "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", + "status": "live", + "pricing": "free", + "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", + "input": "Domain name or IP address", + "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whois AMPed", "type": "url", - "url": "https://whoisamped.com/" + "url": "https://whoisamped.com/", + "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", + "status": "live", + "pricing": "free", + "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", + "input": "Domain name", + "output": "WHOIS records, domain registration information, registrant details", + "opsec": "passive", + "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ViewDNS.info", "type": "url", - "url": "https://viewdns.info/" + "url": "https://viewdns.info/", + "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", + "input": "Domain name, IP address, registrant name/email, nameserver", + "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2WHOIS", "type": "url", - "url": "https://www.ip2whois.com" + "url": "https://www.ip2whois.com", + "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", + "status": "live", + "pricing": "free", + "bestFor": "Domain and IP WHOIS lookups, registrant research", + "input": "Domain name or IP address", + "output": "WHOIS records, registrant details, location information, registration dates", + "opsec": "passive", + "opsecNote": "Queries public WHOIS databases; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/whois_domains/" + "url": "https://app.netlas.io/whois_domains/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -668,22 +1358,82 @@ { "name": "SynapsInt", "type": "url", - "url": "https://synapsint.com" + "url": "https://synapsint.com", + "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", + "input": "Domain, IP, email, phone, username, CVE ID", + "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", + "opsec": "passive", + "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Aquatone (T)", "type": "url", - "url": "https://github.com/michenriksen/aquatone" + "url": "https://github.com/michenriksen/aquatone", + "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", + "input": "Domain name", + "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", + "opsec": "active", + "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FindSubDomains", "type": "url", - "url": "https://findsubdomains.com/" + "url": "https://findsubdomains.com/", + "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", + "input": "Domain name or keyword", + "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", + "opsec": "passive", + "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Subdomains (D)", "type": "url", - "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E" + "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E", + "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", + "status": "live", + "pricing": "free", + "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", + "input": "Domain name (as Google Dork syntax: site:domain.com)", + "output": "Indexed subdomains and pages from Google search results", + "opsec": "passive", + "opsecNote": "Uses Google's search index; no direct contact with the target domain.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Recon-ng (T)", @@ -708,45 +1458,135 @@ { "name": "XRay", "type": "url", - "url": "https://github.com/evilsocket/xray" + "url": "https://github.com/evilsocket/xray", + "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", + "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", + "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", + "opsec": "active", + "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Recon (T)", "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" + "url": "https://github.com/darkoperator/dnsrecon", + "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", + "status": "live", + "pricing": "free", + "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", + "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", + "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", + "opsec": "active", + "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Gobuster (T)", "type": "url", - "url": "https://github.com/OJ/gobuster" + "url": "https://github.com/OJ/gobuster", + "description": "Multi-mode brute-force tool for DNS subdomain, virtual host, and directory discovery.", + "status": "live", + "pricing": "free", + "bestFor": "Fast DNS and vhost brute-force enumeration", + "input": "Domain, wordlist, and optional resolver/thread settings", + "output": "Discovered subdomains, vhosts, or directories with response details", + "opsec": "active", + "opsecNote": "Sends direct DNS/HTTP probes and can generate noisy traffic patterns.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Fierce Domain Scanner (T)", "type": "url", - "url": "https://github.com/davidpepper/fierce-domain-scanner" + "url": "https://github.com/davidpepper/fierce-domain-scanner", + "description": "DNS reconnaissance tool focused on subdomain discovery and non-contiguous IP space mapping.", + "status": "live", + "pricing": "free", + "bestFor": "DNS recon and subdomain-to-IP mapping", + "input": "Domain, DNS server options, and optional wordlist/range parameters", + "output": "Subdomains, resolved IPs, and DNS reconnaissance findings", + "opsec": "active", + "opsecNote": "Performs direct DNS lookups and optional scans that can be logged by infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bluto (T)", "type": "url", - "url": "https://github.com/darryllane/Bluto" + "url": "https://github.com/darryllane/Bluto", + "description": "Recon utility for domain intelligence including DNS records, email patterns, and infrastructure clues.", + "status": "live", + "pricing": "free", + "bestFor": "Initial domain footprinting and asset discovery", + "input": "Target domain and optional scan switches", + "output": "Aggregated recon output including DNS and related domain artifacts", + "opsec": "active", + "opsecNote": "Runs active lookups against target-related infrastructure and third-party services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OWASP Maryam (T)", "type": "url", - "url": "https://github.com/saeeddhqan/Maryam" + "url": "https://github.com/saeeddhqan/Maryam", + "description": "Modular OWASP OSINT framework with footprinting and search modules for multi-source reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Scriptable multi-module OSINT reconnaissance workflows", + "input": "Domain, IP, email, username, or module-specific query terms", + "output": "Module-based findings such as subdomains, metadata, and related intelligence", + "opsec": "active", + "opsecNote": "Can issue direct queries and module-driven probes depending on selected workflow.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", "type": "url", "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "description": "Command-line tool for harvesting emails, subdomains, hosts, and URLs from public data sources.", "status": "live", "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", + "bestFor": "Passive email and subdomain collection from indexed sources", + "input": "Domain and selected data source(s)", + "output": "Email addresses, subdomains, hostnames, IPs, and related metadata", "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "opsecNote": "Queries third-party sources instead of directly interacting with the target host.", "localInstall": true, "googleDork": false, "registration": false, @@ -758,37 +1598,142 @@ { "name": "Pentest-tools.com Subdomains", "type": "url", - "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" + "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain", + "description": "Web-based subdomain finder that enumerates subdomains for a given domain through hosted scanning.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick browser-based subdomain discovery without local setup", + "input": "Domain name", + "output": "List of discovered subdomains and related DNS intelligence", + "opsec": "passive", + "opsecNote": "Scanning is performed by Pentest-Tools infrastructure, not directly from your host.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SecLists DNS Subdomains (T)", "type": "url", - "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" + "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS", + "description": "Community-maintained DNS wordlist collection used to power subdomain brute-force workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Supplying high-quality DNS wordlists for enumeration tools", + "input": "Domain and chosen wordlist file used in external tooling", + "output": "Wordlist candidates for subdomain brute-force and permutation attacks", + "opsec": "passive", + "opsecNote": "Repository itself is passive; OPSEC impact depends on how the lists are used.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dnspop (T)", "type": "url", - "url": "https://github.com/bitquark/dnspop" + "url": "https://github.com/bitquark/dnspop", + "description": "DNS reconnaissance utility for enumerating records and identifying domain-related infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Command-line DNS recon and record analysis", + "input": "Domain and optional scan parameters", + "output": "DNS records, discovered hosts, and recon findings", + "opsec": "active", + "opsecNote": "Performs direct DNS queries against resolvers and target-associated records.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "gdns (T)", "type": "url", - "url": "https://github.com/hrbrmstr/gdns" + "url": "https://github.com/hrbrmstr/gdns", + "description": "Google DNS-focused command-line tool for DNS lookup and domain record exploration.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS enumeration via Google DNS services", + "input": "Domain and query options", + "output": "Resolved DNS records and related lookup results", + "opsec": "active", + "opsecNote": "Issues active DNS lookup requests that may be observable at resolver level.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sublist3r", "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" + "url": "https://github.com/aboul3la/Sublist3r", + "description": "Python tool for subdomain enumeration using search engines, passive sources, and optional brute-force.", + "status": "live", + "pricing": "free", + "bestFor": "Combining passive and active subdomain discovery in one tool", + "input": "Domain and optional brute-force/thread settings", + "output": "Consolidated list of discovered subdomains", + "opsec": "active", + "opsecNote": "Uses multiple external sources and optional brute-force that can generate detectable traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AltDNS (T)", "type": "url", - "url": "https://github.com/infosec-au/altdns" + "url": "https://github.com/infosec-au/altdns", + "description": "Permutation-based DNS tool that generates and resolves alternative subdomains from known names.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering likely subdomain variants through permutations", + "input": "Known subdomains, wordlist, and target domain", + "output": "Resolved alternative subdomains and permutation results", + "opsec": "active", + "opsecNote": "Performs direct DNS resolution on generated permutations, creating active query footprints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/domains/" + "url": "https://app.netlas.io/domains/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -800,14 +1745,14 @@ "name": "Shodan", "type": "url", "url": "https://www.shodan.io/", - "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", + "description": "Search engine for internet-exposed devices, services, and security-relevant banners.", "status": "live", "pricing": "freemium", - "bestFor": "Port scanning, banner grabbing, IoT discovery", - "input": "IP address, domain", - "output": "Open ports, services, banners, CVEs", + "bestFor": "Finding exposed services and infrastructure risk indicators", + "input": "IP, domain, ASN, organization, or filter-based search query", + "output": "Service banners, open ports, geolocation, vulnerabilities, and host metadata", "opsec": "passive", - "opsecNote": "Queries cached scan data. Does not directly probe the target.", + "opsecNote": "Uses Shodan indexed scan data; target systems are not probed from your local host.", "localInstall": false, "googleDork": false, "registration": true, @@ -819,50 +1764,175 @@ { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/" + "url": "https://app.netlas.io/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kraken (T)", "type": "url", - "url": "https://github.com/Sw4mpf0x/Kraken" + "url": "https://github.com/Sw4mpf0x/Kraken", + "description": "Open-source reconnaissance utility for domain and network intelligence gathering workflows.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-driven reconnaissance against domain and host assets", + "input": "Domain, host, or target parameters supported by selected module", + "output": "Recon findings across DNS, host intelligence, and related artifacts", + "opsec": "active", + "opsecNote": "Runs active collection modules that can generate requests visible to target infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "URL and domain analysis service that captures page loads, requests, and security-relevant artifacts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Investigating suspicious URLs with scan snapshots and indicators", + "input": "URL or domain", + "output": "Scan reports including redirects, requests, domains, IPs, and screenshots", + "opsec": "passive", + "opsecNote": "Analysis runs on urlscan infrastructure; target contact is performed from their scanners.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Redirect Detective", "type": "url", - "url": "https://redirectdetective.com/" + "url": "https://redirectdetective.com/", + "description": "Web tool that traces URL redirect chains and final destinations across multi-hop redirects.", + "status": "live", + "pricing": "free", + "bestFor": "Understanding redirect paths and affiliate or cloaking behavior", + "input": "URL", + "output": "Redirect chain, intermediate hops, and final destination URL", + "opsec": "passive", + "opsecNote": "Redirect checks are initiated through the service, limiting direct local target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sitediff (T)", "type": "url", - "url": "https://github.com/digininja/sitediff" + "url": "https://github.com/digininja/sitediff", + "description": "Command-line utility for comparing website versions to detect content and structural changes.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking site changes between snapshots for monitoring and QA", + "input": "Two URLs or snapshots to compare", + "output": "Diff output highlighting content and structural deltas", + "opsec": "passive", + "opsecNote": "Primarily compares fetched content; does not perform intrusive probing by design.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Technology profiling platform that identifies web stacks, frameworks, analytics, and hosting signals.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", + "bestFor": "Website technology stack fingerprinting and ecosystem mapping", "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "output": "Detected technologies, hosting/CDN indicators, and related site intelligence", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Returns platform-collected intelligence and does not require direct target probing by the user.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Wappalyzer", + "type": "url", + "url": "https://www.wappalyzer.com/", + "description": "Technology detection platform and browser tooling for identifying frameworks, CMS, and SaaS usage.", + "status": "live", + "pricing": "freemium", + "bestFor": "Detecting web technologies and software dependencies at scale", + "input": "Domain, URL, or browsed webpage", + "output": "Detected technologies by category with confidence indicators", + "opsec": "passive", + "opsecNote": "Uses extension/service analysis of page resources; minimal direct probing behavior.", "localInstall": false, "googleDork": false, "registration": true, @@ -871,30 +1941,85 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "Wappalyzer", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, { "name": "AnalyzeID", "type": "url", - "url": "https://analyzeid.com/" + "url": "https://analyzeid.com/", + "description": "Reverse lookup service for tracking IDs such as Google Analytics, AdSense, and affiliate identifiers.", + "status": "live", + "pricing": "free", + "bestFor": "Pivoting from shared tracking IDs to related domains", + "input": "Tracking ID (analytics, ads, affiliate, or publisher ID)", + "output": "Associated domains and identifier reuse relationships", + "opsec": "passive", + "opsecNote": "Operates on indexed identifier-to-domain mappings without active target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "Cyber threat intelligence search engine for exposed assets, domains, vulnerabilities, and risk indicators.", + "status": "live", + "pricing": "freemium", + "bestFor": "Threat-focused lookup of internet-facing assets and exposures", + "input": "IP, domain, ASN, CVE, or filter-based threat query", + "output": "Asset details, risk scores, service fingerprints, and vulnerability context", + "opsec": "passive", + "opsecNote": "Searches provider datasets rather than scanning targets directly from analyst infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "urlDNA", "type": "url", - "url": "https://urldna.io" + "url": "https://urldna.io", + "description": "URL intelligence service for investigating domains, redirects, and related reputation indicators.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick URL/domain triage and intelligence pivoting", + "input": "URL or domain", + "output": "URL analysis details, related domains, and risk-relevant metadata", + "opsec": "passive", + "opsecNote": "Uses service-side analysis and historical datasets instead of direct local probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ZoomEye.ai", "type": "url", - "url": "https://www.zoomeye.org/" + "url": "https://www.zoomeye.org/", + "description": "Cyberspace search engine indexing internet-connected devices, services, and vulnerabilities globally. Provides AI-powered search via ZoomEyeGPT with support for ZoomEye dorks for targeted reconnaissance.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet device discovery, service enumeration, vulnerability mapping, attack surface assessment", + "input": "Domain, IP, port, service, or natural language query", + "output": "Device list, port data, banner info, vulnerability details, geographic distribution", + "opsec": "passive", + "opsecNote": "Queries ZoomEye's pre-scanned internet data; does not probe targets during search.", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -910,12 +2035,42 @@ { "name": "Google's Certificate Transparency", "type": "url", - "url": "https://www.certificate-transparency.org/known-logs" + "url": "https://www.certificate-transparency.org/known-logs", + "description": "Directory of all known Certificate Transparency logs monitored by Chrome and other browsers. Browse CT log records to discover issued certificates, identify unauthorized domain certificates, and monitor for certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate discovery, unauthorized cert detection, domain monitoring", + "input": "Domain name or certificate fingerprint", + "output": "List of CT logs and certificates issued for the specified domain", + "opsec": "passive", + "opsecNote": "Queries public certificate logs without contacting the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/certificate" + "url": "https://spyse.com/search/certificate", + "description": "Internet assets registry providing certificate search, domain intelligence, and vulnerability discovery. Scans domains, subdomains, certificates, emails, and open ports across the global internet.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain intelligence, certificate discovery, subdomain enumeration, vulnerability identification", + "input": "Domain, IP, certificate, email, or organization name", + "output": "Domain details, subdomains, certificates, WHOIS info, CVEs, open ports, scraped emails", + "opsec": "passive", + "opsecNote": "Queries Spyse's pre-scanned database; does not contact the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Censys", @@ -940,22 +2095,82 @@ { "name": "crt.sh - Certificate Search", "type": "url", - "url": "https://crt.sh/?" + "url": "https://crt.sh/?", + "description": "CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate search, subdomain discovery via CT logs, detecting unauthorized certificates", + "input": "Domain name (with or without wildcard)", + "output": "List of certificates issued to the domain with Subject Alternative Names and issue/expiry dates", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CertKit - Certificate Transparency Log Search", "type": "url", - "url": "https://www.certkit.io/tools/ct-logs/" + "url": "https://www.certkit.io/tools/ct-logs/", + "description": "Fast Certificate Transparency log search tool using Clickhouse for sub-second queries. Discover all certificates issued to a domain, including Subject Alternative Names, to reveal hidden infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "CT certificate search, subdomain enumeration, certificate misuse detection", + "input": "Domain name", + "output": "List of certificates with issuance dates, expiry dates, and Subject Alternative Names", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "certgraph (T)", "type": "url", - "url": "https://github.com/lanrat/certgraph" + "url": "https://github.com/lanrat/certgraph", + "description": "CLI tool that crawls SSL certificates via Certificate Transparency logs to create a directed graph of domain relationships. Supports multiple drivers including crt.sh, Censys, HTTPS, and SMTP.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate mapping, domain relationship discovery, hostname enumeration via SSL certificates", + "input": "Hostname or domain name", + "output": "Directed graph showing domain nodes and certificate alternative name connections between domains", + "opsec": "passive", + "opsecNote": "Default HTTPS driver can make connections to hosts; alternative drivers query CT logs passively. Use CT drivers for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/certs/" + "url": "https://app.netlas.io/certs/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -966,17 +2181,62 @@ { "name": "Mnemonic", "type": "url", - "url": "https://passivedns.mnemonic.no/" + "url": "https://passivedns.mnemonic.no/", + "description": "Mnemonic's public PassiveDNS service providing historical and current DNS records collected from global sensor networks. Unauthenticated queries available with rate limiting.", + "status": "live", + "pricing": "free", + "bestFor": "Passive DNS lookups, historical domain resolutions, DNS reconnaissance", + "input": "Domain or IP address", + "output": "DNS query history with timestamps, associated IPs, and historical resolutions", + "opsec": "passive", + "opsecNote": "Queries a passive database of DNS records; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Dumpster", "type": "url", - "url": "https://dnsdumpster.com/" + "url": "https://dnsdumpster.com/", + "description": "Free domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Subdomain enumeration, DNS reconnaissance, infrastructure mapping", + "input": "Domain name", + "output": "MX records, TXT records, Host records, subdomains, infrastructure map", + "opsec": "passive", + "opsecNote": "Passive DNS research without sending direct DNS requests or probing the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Deteque (R)", "type": "url", - "url": "https://www.deteque.com/" + "url": "https://www.deteque.com/", + "description": "Real-time IP, domain, and threat intelligence from Spamhaus and abuse.ch alliance. Provides comprehensive malware, botnet, and abuse data with diverse IOC coverage (IPs, domains, URLs, files, cryptos).", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware tracking, botnet detection, abuse data", + "input": "Domain, IP, URL, file hash, or AS number", + "output": "Threat classification, malware associations, botnet data, historical records (up to 12 months)", + "opsec": "passive", + "opsecNote": "Queries threat intelligence database; does not contact or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -987,97 +2247,382 @@ { "name": "UrlQuery.net", "type": "url", - "url": "https://urlquery.net/" + "url": "https://urlquery.net/", + "description": "Free online URL scanner that analyzes webpages for malware, suspicious elements, and phishing threats. Provides comprehensive threat detection reports with threat briefs on emerging campaigns.", + "status": "live", + "pricing": "free", + "bestFor": "URL reputation scanning, malware detection, phishing detection, threat analysis", + "input": "URL or webpage", + "output": "Threat report, detected threats, malicious behavior, anomalies, security assessment", + "opsec": "active", + "opsecNote": "Visits and analyzes the submitted URL; the target server may detect the scan.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Void", "type": "url", - "url": "https://www.urlvoid.com/" + "url": "https://www.urlvoid.com/", + "description": "Free website reputation checker that scans URLs against 30+ blocklist engines and reputation services. Detects fraudulent and malicious websites with browser extension available.", + "status": "live", + "pricing": "free", + "bestFor": "Website reputation checking, malware/phishing detection, threat analysis", + "input": "Website URL", + "output": "Safety report from 30+ blocklists, IP details, domain age, server location, threat indicators", + "opsec": "passive", + "opsecNote": "Queries blocklist and reputation services; does not directly visit or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FortiGuard Reputation Service", "type": "url", - "url": "https://fortiguard.com/iprep" + "url": "https://fortiguard.com/iprep", + "description": "Fortinet's IP reputation service aggregating malicious source IP data from global threat sensors and collaborators. Blocks botnets, DDoS sources, and IPs associated with phishing, scanning, and malware.", + "status": "live", + "pricing": "free", + "bestFor": "IP reputation lookup, botnet/malware source identification, threat intelligence", + "input": "IP address or IP range", + "output": "IP reputation score, threat categories, malware associations, botnet status", + "opsec": "passive", + "opsecNote": "Queries Fortinet's IP reputation database without contacting the target IP.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Trend Micro Site Safety Center", "type": "url", - "url": "https://global.sitesafety.trendmicro.com/" + "url": "https://global.sitesafety.trendmicro.com/", + "description": "Free service that checks website safety ratings from Trend Micro's research and reputation sources. Identifies websites with malware, phishing activity, or suspicious behavior.", + "status": "live", + "pricing": "free", + "bestFor": "Website safety verification, malware/phishing detection, threat assessment", + "input": "Website URL", + "output": "Safety rating, category classification, threat indicators, historical data", + "opsec": "passive", + "opsecNote": "Queries Trend Micro's pre-scanned website reputation database without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchGuard ReputationAuthority", "type": "url", - "url": "https://www.reputationauthority.org/" + "url": "https://www.reputationauthority.org/", + "description": "In-the-cloud reputation monitoring service analyzing URL and IP threat risk. Assigns reputation scores between 1-100 using data from global sources and deployed systems.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation scoring, threat risk assessment, malicious source identification", + "input": "URL or IP address", + "output": "Reputation score (1-100), threat risk level, URL category, blocking recommendations", + "opsec": "passive", + "opsecNote": "Queries WatchGuard's reputation servers without contacting the target directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sucuri SiteCheck", "type": "url", - "url": "https://sitecheck.sucuri.net/" + "url": "https://sitecheck.sucuri.net/", + "description": "Free remote website scanner that checks for malware, security threats, blacklisting, and vulnerabilities. Detects outdated CMS versions, insecure configurations, and security anomalies.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning, vulnerability detection, security assessment", + "input": "Website URL", + "output": "Security scan report, malware detection, blacklist status, vulnerable plugin/CMS details", + "opsec": "active", + "opsecNote": "Remotely visits the website to check source code and security; may be detectable by WAF/IDS.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThreatMiner.org", "type": "url", - "url": "https://www.threatminer.org/" + "url": "https://www.threatminer.org/", + "description": "Non-profit threat intelligence portal providing IOC research including domains, IPs, malware samples, SSL certificates, WHOIS data, and malicious URLs under Creative Commons license.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence research, IOC investigation, malware/phishing link analysis", + "input": "Domain, IP, file hash (MD5/SHA1/SHA256), SSL certificate, or URL", + "output": "Threat reports, IOC data, WHOIS info, malware associations, related indicators", + "opsec": "passive", + "opsecNote": "Queries aggregated threat intelligence data from multiple sources; does not probe targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BlueCoat WebPulse", "type": "url", - "url": "https://sitereview.bluecoat.com/sitereview.jsp" + "url": "https://sitereview.bluecoat.com/sitereview.jsp", + "description": "Web reputation filtering service rating URLs with 50+ language support. Processes 180+ million rating requests daily with Dynamic Link Analysis for attack injection detection.", + "status": "live", + "pricing": "free", + "bestFor": "URL categorization, website reputation filtering, malicious link detection", + "input": "Website URL", + "output": "URL category, reputation rating, threat indicators, web content classification", + "opsec": "passive", + "opsecNote": "Queries Blue Coat's cloud-based URL reputation database without directly probing targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Zscaler Zulu URL Risk Analyzer", "type": "url", - "url": "https://zulu.zscaler.com/" + "url": "https://zulu.zscaler.com/", + "description": "Free dynamic risk scoring engine for web content analysis. Assesses URLs from multiple perspectives: content analysis, URL patterns, and host reputation using machine learning.", + "status": "live", + "pricing": "free", + "bestFor": "URL risk scoring, web threat detection, malicious content analysis", + "input": "Website URL", + "output": "Risk score, threat assessment at content/URL/host levels, malicious behavior detection", + "opsec": "active", + "opsecNote": "Uses sandboxing to execute URLs in an isolated environment; may detect analysis activity.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe Sandbox Url Analyzer", "type": "url", - "url": "https://www.url-analyzer.net/" + "url": "https://www.url-analyzer.net/", + "description": "Deep URL and document analysis using real browser execution in isolated environments. Detects malware, phishing, and suspicious behavior with detailed system/network monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware/phishing analysis, URL behavior detection, deep web threat investigation", + "input": "URL or document file", + "output": "Detailed behavior analysis, DOM tree, browser data, network capture, threat assessment", + "opsec": "active", + "opsecNote": "Executes URLs in real browsers; detectable by advanced anti-analysis techniques.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Deepviz Domain Search", "type": "url", - "url": "https://search.deepviz.com/" + "url": "https://search.deepviz.com/", + "description": "Threat intelligence platform providing domain, IP, and malware sample search with daily threat feeds. Includes similar sample finding, malware family clustering, and API/Splunk integration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware analysis, threat feed subscription", + "input": "Domain, IP, file hash (MD5), or malware sample", + "output": "Threat intelligence data, malware associations, related IOCs, daily threat feeds", + "opsec": "passive", + "opsecNote": "Queries threat intelligence databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "AVG Threat Labs", "type": "url", - "url": "https://www.avg.com/en/signal/website-safety" + "url": "https://www.avg.com/en/signal/website-safety", + "description": "Website security analysis tool providing instant safety assessment of sites. Merges quantitative threat detection from 100M AVG users with LinkScanner technology in graphical reports.", + "status": "degraded", + "pricing": "free", + "bestFor": "Website safety assessment, threat detection reports, website popularity tracking", + "input": "Website URL", + "output": "Safety analysis, threat report, popularity status, server location, detection timeline", + "opsec": "passive", + "opsecNote": "Queries AVG's threat detection database; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Webroot BrightCloud URL/IP Lookup", "type": "url", - "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" + "url": "https://www.brightcloud.com/tools/url-ip-lookup.php", + "description": "Web classification and reputation tool providing URL/IP threat and content analysis. Uses machine learning reputation scoring across 82 content categories with IP risk tiering.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation lookup, web classification, threat intelligence, web categorization", + "input": "URL or IP address", + "output": "Threat assessment, content category, reputation score, WHOIS data, risk level", + "opsec": "passive", + "opsecNote": "Queries BrightCloud's reputation database without directly contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "vURL Online", "type": "url", - "url": "https://vurldissect.co.uk/" + "url": "https://vurldissect.co.uk/", + "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.", + "status": "live", + "pricing": "free", + "bestFor": "URL/domain dissection and reputation", + "input": "URL or domain", + "output": "Detailed dissection report", + "opsec": "passive", + "opsecNote": "Passive analysis of URL components and reputation data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AlienVault Open Threat Exchange", "type": "url", - "url": "https://otx.alienvault.com/browse/pulses/" + "url": "https://otx.alienvault.com/browse/pulses/", + "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence sharing", + "input": "Domain, IP, URL, file hash", + "output": "Threat pulses, reputation data, indicators", + "opsec": "passive", + "opsecNote": "Community-sourced intelligence; free API access with registration", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Domain List", "type": "url", - "url": "https://www.malwaredomainlist.com/mdl.php" + "url": "https://www.malwaredomainlist.com/mdl.php", + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Web Inspector Online Scan", "type": "url", - "url": "https://www.webinspector.com/website-malware-scanner/" + "url": "https://www.webinspector.com/website-malware-scanner/", + "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning", + "input": "Website URL", + "output": "Malware scan report, vulnerability assessment", + "opsec": "active", + "opsecNote": "Active scanning required; connects to target website to analyze content", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Safe Browsing API", "type": "url", - "url": "https://developers.google.com/safe-browsing/?csw=1" + "url": "https://developers.google.com/safe-browsing/?csw=1", + "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and phishing URL detection", + "input": "URL or domain", + "output": "Safe/unsafe classification, threat type", + "opsec": "passive", + "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cisco Talos", "type": "url", - "url": "https://talosintelligence.com/" + "url": "https://talosintelligence.com/", + "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation intelligence", + "input": "IP address or domain", + "output": "Reputation score, threat indicators, intelligence reports", + "opsec": "passive", + "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1088,67 +2633,262 @@ { "name": "Threatexpert.com Malicious URLs", "type": "url", - "url": "https://www.networksec.org/grabbho/block.txt" + "url": "https://www.networksec.org/grabbho/block.txt", + "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.", + "status": "down", + "pricing": "free", + "bestFor": "Malware URL intelligence", + "input": "Domain or URL", + "output": "Blocklist/Feed format", + "opsec": "passive", + "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Zeus C2 Tracker", "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" + "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist", + "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet C2 blocking", + "input": "None (blocklist provider)", + "output": "Domain/IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Queries public Zeus tracker database; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Domains Blacklist", "type": "url", - "url": "https://mirror1.malwaredomains.com/files/domains.txt" + "url": "https://mirror1.malwaredomains.com/files/domains.txt", + "description": "Historical malware domains blocklist providing hosts file format malicious domain list.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Hosts file format", + "opsec": "passive", + "opsecNote": "Legacy service; no longer maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Blackweb", "type": "url", - "url": "https://github.com/maravento/blackweb" + "url": "https://github.com/maravento/blackweb", + "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.", + "status": "live", + "pricing": "free", + "bestFor": "Squid proxy malware filtering", + "input": "None (aggregated blocklist)", + "output": "Squid-compatible blocklist format", + "opsec": "passive", + "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Critical Stack Intel (R)", "type": "url", - "url": "https://intel.criticalstack.com/" + "url": "https://intel.criticalstack.com/", + "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.", + "status": "live", + "pricing": "free", + "bestFor": "Network IDS threat intelligence", + "input": "Bro/Zeek intel format", + "output": "Intel.log entries, network alerts", + "opsec": "passive", + "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Sinkhole", "type": "url", - "url": "https://malc0de.com/bl/" + "url": "https://malc0de.com/bl/", + "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.", + "status": "degraded", + "pricing": "free", + "bestFor": "DNS-based malware blocking", + "input": "DNS zone file", + "output": "Malware domain sinkhole list", + "opsec": "passive", + "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS-BH Malware Domain Blocklist", "type": "url", - "url": "https://www.malwaredomains.com/wordpress/?page_id=66" + "url": "https://www.malwaredomains.com/wordpress/?page_id=66", + "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)", + "opsec": "passive", + "opsecNote": "Service sunset; merged into ShadowNet", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Malware Domain List", "type": "url", - "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" + "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt", + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MalwareURL (R)", "type": "url", - "url": "https://www.malwareurl.com/index.php" + "url": "https://www.malwareurl.com/index.php", + "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware URL reputation checking", + "input": "URL", + "output": "Reputation report, blocklist data", + "opsec": "passive", + "opsecNote": "Free lookup service available; commercial network integration available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "scumware.org", "type": "url", - "url": "https://www.scumware.org/" + "url": "https://www.scumware.org/", + "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and spyware domain research", + "input": "Domain or URL", + "output": "Domain reputation/blocklist data", + "opsec": "passive", + "opsecNote": "Community-maintained research database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ZeuS Tracker", "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php" + "url": "https://zeustracker.abuse.ch/blocklist.php", + "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet tracking and blocking", + "input": "None (blocklist provider)", + "output": "Domain blocklist, IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Shadowserver Foundation", "type": "url", - "url": "https://www.shadowserver.org/" + "url": "https://www.shadowserver.org/", + "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation and abuse intelligence", + "input": "IP address or domain", + "output": "Reputation reports, blocklists, abuse intelligence", + "opsec": "passive", + "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Domain Validation", "type": "url", - "url": "https://www.mailboxvalidator.com/domain" + "url": "https://www.mailboxvalidator.com/domain", + "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email domain and mailbox verification", + "input": "Email domain or address", + "output": "Domain validation report, MX records", + "opsec": "active", + "opsecNote": "Active mail server connectivity checks required for validation", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1159,22 +2899,82 @@ { "name": "DNS Twist (T)", "type": "url", - "url": "https://github.com/elceef/dnstwist" + "url": "https://github.com/elceef/dnstwist", + "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting and phishing domain detection", + "input": "Domain name", + "output": "Domain permutation list, DNS records, HTTP similarity", + "opsec": "active", + "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URLCrazy (T)", "type": "url", - "url": "https://www.morningstarsecurity.com/research/urlcrazy" + "url": "https://www.morningstarsecurity.com/research/urlcrazy", + "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting domain discovery", + "input": "Domain name", + "output": "Domain variant list, registration status", + "opsec": "active", + "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dnstwister", "type": "url", - "url": "https://dnstwister.report/" + "url": "https://dnstwister.report/", + "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Typosquatting monitoring", + "input": "Domain name", + "output": "Domain variants, registration status, DNS records", + "opsec": "active", + "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Catphish (T)", "type": "url", - "url": "https://github.com/ring0lab/catphish" + "url": "https://github.com/ring0lab/catphish", + "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Red team phishing domain generation", + "input": "Target domain", + "output": "Phishing domain variants, categorization status", + "opsec": "active", + "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1186,14 +2986,74 @@ "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Public website analysis; passive technical reconnaissance", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SiteSleuth", + "type": "url", + "url": "https://www.sitesleuth.io/", + "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking code intelligence and related domain discovery", + "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key", + "output": "List of associated domains and tracking codes", + "opsec": "passive", + "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Wappalyzer (T)", + "type": "url", + "url": "https://www.wappalyzer.com/", + "description": "Technology stack profiler that identifies CMS, frameworks, analytics, and infrastructure used by a website.", + "status": "live", + "pricing": "freemium", + "bestFor": "Technology stack fingerprinting and recon", + "input": "Domain or URL", + "output": "Detected technologies, categories, versions, and metadata", + "opsec": "active", + "opsecNote": "Performs direct analysis of target pages when scanning live URLs.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SEMrush", + "type": "url", + "url": "https://www.semrush.com/", + "description": "SEO intelligence platform for domain analytics, keyword intelligence, backlinks, and competitor profiling.", + "status": "live", + "pricing": "paid", + "bestFor": "Traffic and backlink competitive analysis", + "input": "Domain", + "output": "Keywords, backlinks, ranking trends, and traffic estimates", + "opsec": "passive", + "opsecNote": "Uses provider-side indexed datasets and does not require direct probing by the user.", "localInstall": false, "googleDork": false, "registration": true, @@ -1202,100 +3062,325 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "SiteSleuth", - "type": "url", - "url": "https://www.sitesleuth.io/" - }, - { - "name": "Wappalyzer (T)", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, - { - "name": "SEMrush", - "type": "url", - "url": "https://www.semrush.com/" - }, { "name": "Moonsearch", "type": "url", - "url": "https://moonsearch.com/" + "url": "https://moonsearch.com/", + "description": "Legacy reverse-WHOIS style domain correlation service with unclear current availability.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical domain ownership correlation", + "input": "Domain or registrant details", + "output": "Potentially related domains and ownership links", + "opsec": "unknown", + "opsecNote": "Service availability is inconsistent; treat results as unverified and re-check before use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Ewhois", "type": "url", - "url": "https://ewhois.com/" + "url": "https://www.ewhois.com/", + "description": "Web WHOIS lookup utility for registration, registrar, and nameserver details.", + "status": "live", + "pricing": "free", + "bestFor": "Quick WHOIS lookups", + "input": "Domain", + "output": "Registrant, registrar, dates, and nameserver records", + "opsec": "passive", + "opsecNote": "Performs standard registration lookups with low operational risk.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "StatsCrop", "type": "url", - "url": "https://www.statscrop.com/" + "url": "https://www.statscrop.com/", + "description": "Website statistics portal with traffic rank snapshots and related metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Quick website popularity snapshots", + "input": "Domain", + "output": "Traffic rank estimates and summary site stats", + "opsec": "passive", + "opsecNote": "Reads provider-side metrics without direct target interaction by the user.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Open Site Explorer", "type": "url", - "url": "https://moz.com/link-explorer" + "url": "https://moz.com/link-explorer", + "description": "Legacy Moz Open Site Explorer entry now represented by Moz Link Explorer for backlink analysis.", + "status": "degraded", + "pricing": "freemium", + "bestFor": "Backlink and linking-domain analysis", + "input": "Domain or URL", + "output": "Backlinks, authority-style metrics, and linking domains", + "opsec": "passive", + "opsecNote": "Modern functionality persists under Moz Link Explorer; legacy naming retained for framework continuity.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": true }, { "name": "SpyOnWeb", "type": "url", - "url": "https://www.spyonweb.com/" + "url": "https://www.spyonweb.com/", + "description": "Correlation tool that links domains by shared tracking and advertising identifiers.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding related infrastructure via shared IDs", + "input": "Domain or analytics/ad IDs", + "output": "Related domains and shared identifier pivots", + "opsec": "passive", + "opsecNote": "Uses indexed identifier data and does not require active probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Keyword Density", "type": "url", - "url": "https://tools.seobook.com/general/keyword-density/" + "url": "https://tools.seobook.com/general/keyword-density/", + "description": "Text and page analyzer that measures keyword frequency and relative density.", + "status": "live", + "pricing": "free", + "bestFor": "On-page keyword frequency analysis", + "input": "URL or text", + "output": "Keyword counts and density metrics", + "opsec": "active", + "opsecNote": "May fetch target content directly for analysis when URL input is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Alexa Site Statistics", "type": "url", - "url": "https://alexa.amazon.com/about" + "url": "https://alexa.amazon.com/about", + "description": "Historical Alexa Internet traffic-statistics entry; service was discontinued in 2022.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Domain", + "output": "Legacy traffic ranking context (archival)", + "opsec": "unknown", + "opsecNote": "Alexa Internet shut down on May 1, 2022; keep as deprecated reference only.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Cisco Umbrella Popularity List", "type": "url", - "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" + "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html", + "description": "Domain popularity ranking based on Cisco Umbrella DNS telemetry.", + "status": "live", + "pricing": "free", + "bestFor": "Top-domain popularity and DNS trend context", + "input": "Domain or list lookup", + "output": "Popularity ranking and related DNS-derived context", + "opsec": "passive", + "opsecNote": "Consumes published ranking data with low direct exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Alexa Top 500 Global Sites", "type": "url", - "url": "https://alexa.amazon.com/about" + "url": "https://alexa.amazon.com/about", + "description": "Historical Alexa Top Sites list reference; no longer maintained after Alexa shutdown.", + "status": "down", + "pricing": "free", + "bestFor": "Historical popularity-list reference", + "input": "N/A", + "output": "Legacy ranking context only", + "opsec": "unknown", + "opsecNote": "Alexa Internet ended on May 1, 2022; this entry is retained only as deprecated legacy context.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Sitedossier", "type": "url", - "url": "https://www.sitedossier.com/" + "url": "https://www.sitedossier.com/", + "description": "Domain dossier aggregator with WHOIS, DNS, and linked infrastructure context.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain intelligence aggregation", + "input": "Domain or IP", + "output": "WHOIS, DNS, and related-site context", + "opsec": "passive", + "opsecNote": "Aggregates public records and indexed data with limited operator exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Visual Site Mapper", "type": "url", - "url": "https://github.com/alentum/sitemapper-nodejs" + "url": "https://github.com/alentum/sitemapper-nodejs", + "description": "Site-crawling mapper used to visualize website structure and page relationships.", + "status": "live", + "pricing": "free", + "bestFor": "Generating website structure maps", + "input": "Domain or URL seed", + "output": "Crawl graph and site map structure", + "opsec": "active", + "opsecNote": "Actively crawls target pages and generates repeated requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ClearWebStats.com", "type": "url", - "url": "https://www.clearwebstats.com/" + "url": "https://www.clearwebstats.com/", + "description": "Public site-statistics index showing traffic and rank snapshots for domains.", + "status": "live", + "pricing": "free", + "bestFor": "Lightweight web popularity lookups", + "input": "Domain", + "output": "Estimated rank and summary traffic metrics", + "opsec": "passive", + "opsecNote": "Uses provider-collected analytics rather than direct target scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PubDB", "type": "url", - "url": "https://pub-db.com/" + "url": "https://pub-db.com/", + "description": "Legacy public-database lookup entry with expired or unavailable service state.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Query terms", + "output": "Unavailable/legacy output", + "opsec": "unknown", + "opsecNote": "Service appears expired or defunct; verify alternatives before operational use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "SimilarWeb", "type": "url", - "url": "https://www.similarweb.com/" + "url": "https://www.similarweb.com/", + "description": "Digital intelligence platform for traffic estimates, referrals, and audience insights.", + "status": "live", + "pricing": "freemium", + "bestFor": "Competitor traffic and referral analysis", + "input": "Domain", + "output": "Traffic channels, engagement, and competitor benchmarking", + "opsec": "passive", + "opsecNote": "Relies on provider-side datasets and panels; no active probing required by user.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Siteliner", "type": "url", - "url": "https://www.siteliner.com/" + "url": "https://www.siteliner.com/", + "description": "Website crawler that highlights duplicate content, broken links, and SEO quality issues.", + "status": "live", + "pricing": "freemium", + "bestFor": "Duplicate-content and link-health audits", + "input": "Domain", + "output": "Duplicate-content metrics, broken links, and crawl summaries", + "opsec": "active", + "opsecNote": "Performs active crawl requests against the target site.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WhatWeb", "type": "url", - "url": "https://github.com/urbanadventurer/WhatWeb" + "url": "https://github.com/urbanadventurer/WhatWeb", + "description": "Open-source fingerprinting scanner for identifying technologies, frameworks, and server-side indicators.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-based web technology fingerprinting", + "input": "Domain or URL", + "output": "Detected technologies, headers, and fingerprint matches", + "opsec": "active", + "opsecNote": "Directly scans target endpoints and can be noisy depending on scan options.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1306,27 +3391,102 @@ { "name": "Link Expander", "type": "url", - "url": "https://www.linkexpander.com/" + "url": "https://www.linkexpander.com/", + "description": "Short-link expansion tool that resolves redirects to destination URLs.", + "status": "live", + "pricing": "free", + "bestFor": "Expanding shortened links safely", + "input": "Shortened URL", + "output": "Resolved destination URL and redirect behavior", + "opsec": "passive", + "opsecNote": "Uses preview/expansion workflows and avoids direct navigation in the browser.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CheckShortURL", "type": "url", - "url": "https://checkshorturl.com/" + "url": "https://checkshorturl.com/", + "description": "Preview service for shortened URLs with destination and threat-check context.", + "status": "live", + "pricing": "free", + "bestFor": "Safe short-link destination checks", + "input": "Shortened URL", + "output": "Expanded destination and warning context", + "opsec": "passive", + "opsecNote": "Passively expands links before user navigation.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Expander", "type": "url", - "url": "https://urlex.org/" + "url": "https://urlex.org/", + "description": "Link resolver for unshortening and inspecting redirect destination chains.", + "status": "live", + "pricing": "free", + "bestFor": "Resolving opaque short links", + "input": "Shortened URL", + "output": "Expanded URL and redirect details", + "opsec": "passive", + "opsecNote": "Primarily destination resolution with low direct operational exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Where Does This Link Go?", "type": "url", - "url": "https://wheregoes.com/" + "url": "https://wheregoes.com/", + "description": "Redirect-chain inspector that traces and visualizes final destination paths.", + "status": "live", + "pricing": "free", + "bestFor": "Tracing redirect chains for suspicious links", + "input": "URL", + "output": "Redirect hops, response codes, and final destination", + "opsec": "passive", + "opsecNote": "Provides passive redirect tracing before manual browser interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "KnowURL", "type": "url", - "url": "https://www.knowurl.com/" + "url": "https://www.knowurl.com/", + "description": "Legacy URL intelligence entry with uncertain availability and reliability.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "URL", + "output": "Unreliable or unavailable metadata", + "opsec": "unknown", + "opsecNote": "Current service status is unclear; verify manually before relying on output.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -1337,37 +3497,142 @@ { "name": "VisualPing", "type": "url", - "url": "https://visualping.io:443/" + "url": "https://visualping.io/", + "description": "Website monitoring platform that alerts on page content or visual changes.", + "status": "live", + "pricing": "freemium", + "bestFor": "Automated webpage change monitoring", + "input": "URL and watch settings", + "output": "Change alerts with visual or text diffs", + "opsec": "active", + "opsecNote": "Performs recurring fetches of target pages based on monitoring cadence.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Change Detection", "type": "url", - "url": "https://visualping.io/" + "url": "https://changedetection.io/", + "description": "Open-source change-monitoring system for tracking updates on websites over time.", + "status": "live", + "pricing": "free", + "bestFor": "Self-hosted page change monitoring", + "input": "URL and monitoring rules", + "output": "Diffs and notifications when monitored content changes", + "opsec": "active", + "opsecNote": "Generates recurring requests to monitored targets; tune intervals for OPSEC.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { - "name": "Check site availability Online", + "name": "UPcheck", "type": "url", - "url": "https://upcheck.online/" + "url": "https://upcheck.online/", + "description": "Website uptime checker that tests if a site is currently accessible.", + "status": "down", + "pricing": "free", + "bestFor": "Quick site availability checks", + "input": "URL/domain", + "output": "Up/down status", + "opsec": "passive", + "opsecNote": "No identification risk; passive status check only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Follow That Page", "type": "url", - "url": "https://www.followthatpage.com/" + "url": "https://www.followthatpage.com/", + "description": "Website monitoring service that checks pages for changes and sends alerts when tracked content updates. Supports keyword-based notifications for focused monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Tracking updates on specific web pages by keyword", + "input": "Target page URL and optional keyword filters", + "output": "Email alerts showing detected page changes", + "opsec": "passive", + "opsecNote": "Monitoring requests are performed by Follow That Page infrastructure rather than directly from the investigator's workstation.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Urlwatch", "type": "url", - "url": "https://github.com/thp/urlwatch" + "url": "https://github.com/thp/urlwatch", + "description": "Open-source Python CLI tool for monitoring webpages and feeds for changes. Supports multiple filters, reporters, and scheduled checks via local automation.", + "status": "live", + "pricing": "free", + "bestFor": "Self-hosted web page change monitoring automation", + "input": "URLs, feeds, and local watch configuration", + "output": "Diffs and alerts through email, console, or integrations", + "opsec": "passive", + "opsecNote": "Can run locally or on controlled infrastructure, allowing investigators to manage request origin and monitoring cadence.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchThatPage", "type": "url", - "url": "https://watchthatpage.com/" + "url": "https://watchthatpage.com/", + "description": "Web-based page monitoring platform that detects content changes and notifies users by email. Useful for tracking updates on websites without RSS feeds.", + "status": "live", + "pricing": "freemium", + "bestFor": "Monitoring static web pages for updates over time", + "input": "Web page URL and watch configuration", + "output": "Email notifications and change history snapshots", + "opsec": "passive", + "opsecNote": "Page checks originate from WatchThatPage systems instead of directly from the investigator.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ChangeDetect", "type": "url", - "url": "https://www.eatgrainmaker.com/home/" + "url": "https://changedetection.io/", + "description": "Open-source website change detection platform with both self-hosted and hosted options. Supports visual diffs, notifications, and automation workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Flexible page change monitoring with self-hosted control", + "input": "Target URL and optional monitoring rules/selectors", + "output": "Change alerts, snapshots, and webhook/integration notifications", + "opsec": "passive", + "opsecNote": "When self-hosted, investigators control infrastructure and request origin; hosted mode proxies checks through provider systems.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1378,7 +3643,22 @@ { "name": "Google Trends", "type": "url", - "url": "https://trends.google.com/trends/" + "url": "https://trends.google.com/trends/", + "description": "Google's search trend analysis tool for tracking keyword popularity and comparing search interest over time.", + "status": "live", + "pricing": "free", + "bestFor": "Search trend analysis and keyword research", + "input": "Keywords or domains", + "output": "Trend data and comparative interest graphs", + "opsec": "passive", + "opsecNote": "Google-tracked; your queries may be associated with your account or IP", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1389,12 +3669,42 @@ { "name": "DNSSEC Analyzer", "type": "url", - "url": "https://dnssec-analyzer.verisignlabs.com/" + "url": "https://dnssec-analyzer.verisignlabs.com/", + "description": "Verisign's DNSSEC validation tool that checks the DNSSEC chain of trust for a domain.", + "status": "live", + "pricing": "free", + "bestFor": "DNSSEC chain-of-trust validation", + "input": "Domain names", + "output": "DNSSEC validation status and chain details", + "opsec": "passive", + "opsecNote": "No identification risk; passive DNS lookup", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNSViz", "type": "url", - "url": "https://dnsviz.net/" + "url": "https://dnsviz.net/", + "description": "DNS and DNSSEC analysis platform that visualizes delegation chains and cryptographic validation paths. Helps diagnose trust and signing issues in domain configurations.", + "status": "live", + "pricing": "free", + "bestFor": "Visual DNSSEC validation and DNS misconfiguration analysis", + "input": "Domain name", + "output": "DNS resolution graphs, DNSSEC status, and validation diagnostics", + "opsec": "passive", + "opsecNote": "Analysis runs against public DNS infrastructure without direct interaction with domain owners.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1409,17 +3719,62 @@ { "name": "Sn1per (T)", "type": "url", - "url": "https://github.com/1N3/Sn1per" + "url": "https://github.com/1N3/Sn1per", + "description": "Automated reconnaissance and penetration testing framework combining multiple scanning tools for full-scope target enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Full-scope pentest automation and recon", + "input": "Target domains or IPs", + "output": "Recon data, open ports, vulnerabilities, and footprinting results", + "opsec": "active", + "opsecNote": "Generates significant network traffic and alerts; high IDS/WAF detection risk", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { - "name": "WDES - Web Data Exposure Scanner (T)", + "name": "Web Data Exposure Scanner (T)", "type": "url", - "url": "https://github.com/eduardoit/web-data-exposure-scanner" + "url": "https://github.com/eduardoit/web-data-exposure-scanner", + "description": "Open-source scanner for detecting exposed web application data and sensitive file disclosures on web servers.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting exposed sensitive data on web servers", + "input": "URLs/domains", + "output": "Exposed data findings", + "opsec": "active", + "opsecNote": "Active scanning may generate server logs and trigger alerts", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1430,14 +3785,44 @@ { "name": "Zone-H.org", "type": "url", - "url": "https://zone-h.org/archive" + "url": "https://zone-h.org/archive", + "description": "Archive of reported website defacements and related incident metadata maintained by the Zone-H community.", + "status": "live", + "pricing": "free", + "bestFor": "Historical tracking of website defacement incidents", + "input": "Search terms, domains, or browsing archive filters", + "output": "Defacement records with timestamps and mirrored evidence", + "opsec": "passive", + "opsecNote": "Uses a third-party archive and does not require direct interaction with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "RobotsDisallowed", "type": "url", - "url": "https://github.com/danielmiessler/RobotsDisallowed" + "url": "https://github.com/danielmiessler/RobotsDisallowed", + "description": "Curated wordlist of top disallowed paths harvested from robots.txt files across high-traffic websites.", + "status": "live", + "pricing": "free", + "bestFor": "robots.txt enumeration and directory discovery", + "input": "Used as wordlist input for directory brute-forcing", + "output": "Directory path wordlist", + "opsec": "passive", + "opsecNote": "Passive wordlist only; no requests made to target during list use", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1448,32 +3833,122 @@ { "name": "Belati (T)", "type": "url", - "url": "https://github.com/aancw/Belati" + "url": "https://github.com/aancw/Belati", + "description": "Open-source OSINT data collection and automation framework for gathering information from multiple sources.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-source OSINT collection automation", + "input": "Domains and targets", + "output": "Aggregated OSINT data", + "opsec": "passive", + "opsecNote": "Primarily passive; behavior depends on configured modules", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Burp Suite (T)", "type": "url", - "url": "https://portswigger.net/burp" + "url": "https://portswigger.net/burp", + "description": "Industry-standard web application security testing platform for manual and automated vulnerability assessment.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web application penetration testing", + "input": "Web applications and URLs", + "output": "Security findings, intercepted traffic, and vulnerability reports", + "opsec": "active", + "opsecNote": "Full active scanning; generates extensive server logs and may trigger WAF/IDS alerts", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "EyeWitness (T)", "type": "url", - "url": "https://github.com/ChrisTruncer/EyeWitness" + "url": "https://github.com/ChrisTruncer/EyeWitness", + "description": "Open-source tool for automated website screenshotting, service header collection, and default credential identification.", + "status": "live", + "pricing": "free", + "bestFor": "Visual site enumeration and credential identification", + "input": "URL lists", + "output": "Screenshots, headers, and default credential matches", + "opsec": "passive", + "opsecNote": "HTTP requests visible in target server logs; screenshots leave network footprint", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunting-New-Registered-Domains (T)", "type": "url", - "url": "https://github.com/gfek/Hunting-New-Registered-Domains" + "url": "https://github.com/gfek/Hunting-New-Registered-Domains", + "description": "Open-source tool for identifying newly registered domains matching patterns, useful for phishing and brand threat detection.", + "status": "live", + "pricing": "free", + "bestFor": "Phishing domain detection and brand threat monitoring", + "input": "Domain patterns or keywords", + "output": "List of newly registered matching domains", + "opsec": "passive", + "opsecNote": "WHOIS queries may create observable patterns; otherwise passive", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "International Domain Name Conversion Tool", "type": "url", - "url": "https://mct.verisign-grs.com/" + "url": "https://mct.verisign-grs.com/", + "description": "Verisign's IDN/Punycode bidirectional converter for translating international domain names to and from ASCII-compatible encoding.", + "status": "live", + "pricing": "free", + "bestFor": "IDN and Punycode domain analysis", + "input": "International or Punycode domain names", + "output": "Converted domain equivalents", + "opsec": "passive", + "opsecNote": "No identification risk; local conversion tool", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1482,14 +3957,44 @@ "type": "folder", "children": [ { - "name": "Microsoft", + "name": "Windows Defender Security Intelligence (WDSI)", "type": "url", - "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" + "url": "https://www.microsoft.com/en-us/wdsi", + "description": "Microsoft's security intelligence portal for reporting malicious URLs and checking Windows Defender threat assessments.", + "status": "live", + "pricing": "free", + "bestFor": "Reporting malicious sites to Microsoft and checking URL threat status", + "input": "URLs", + "output": "Threat status and submission confirmation", + "opsec": "passive", + "opsecNote": "Microsoft-tracked; submissions aggregated for threat intelligence", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { - "name": "Google", + "name": "Google Safe Browsing", "type": "url", - "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" + "url": "https://safebrowsing.google.com/", + "description": "Google's phishing and malware reporting portal for submitting suspicious URLs for review.", + "status": "live", + "pricing": "free", + "bestFor": "Reporting malicious sites to Google and checking URL safety status", + "input": "URLs", + "output": "Safety status and submission confirmation", + "opsec": "passive", + "opsecNote": "Google-tracked; searches and submissions aggregated at scale", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -1687,42 +4192,162 @@ { "name": "MaxMind Demo", "type": "url", - "url": "https://www.maxmind.com/en/home" + "url": "https://www.maxmind.com/en/home", + "description": "Web-based IP geolocation demo with location, ASN, and network data from MaxMind's GeoIP database.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP geolocation", + "input": "IP address", + "output": "Country, region, city, coordinates, ASN", + "opsec": "passive", + "opsecNote": "Queries MaxMind; submissions logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4/IPv6 lists by country code", "type": "url", - "url": "https://github.com/ipverse/" + "url": "https://github.com/ipverse/", + "description": "Database of IPv4 and IPv6 address ranges organized by country for geographic IP filtering.", + "status": "live", + "pricing": "free", + "bestFor": "Country-level IP enumeration", + "input": "Country code", + "output": "IP ranges in CIDR notation", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP allocations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2Location.com", "type": "url", - "url": "https://www.ip2location.com/demo" + "url": "https://www.ip2location.com/demo", + "description": "Commercial IP geolocation service with free demo and database. Provides location, proxy detection, and network data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate geolocation with proxy detection", + "input": "IP address", + "output": "Location, ASN, proxy type, VPN status, timezone", + "opsec": "passive", + "opsecNote": "Passive database lookup; free tier limited.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Fingerprints", "type": "url", - "url": "https://ipfingerprints.com/" + "url": "https://ipfingerprints.com/", + "description": "Reverse IP lookup service identifying all domains hosted on a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Uses public DNS reverse lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DB-IP", "type": "url", - "url": "https://db-ip.com/" + "url": "https://db-ip.com/", + "description": "Lightweight IP geolocation API covering 46M+ IPv4/IPv6 blocks with city-level accuracy.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate IP geolocation with developer API", + "input": "IP address", + "output": "Location, timezone, ISP, coordinates", + "opsec": "passive", + "opsecNote": "Passive database lookup; free API rate limited.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Location Finder", "type": "url", - "url": "https://www.iplocation.net/" + "url": "https://www.iplocation.net/", + "description": "Web-based tool for IP geolocation with maps and detailed location information.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP location with maps", + "input": "IP address", + "output": "City, coordinates, ISP, hostname", + "opsec": "passive", + "opsecNote": "Passive lookup; no notification to target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Info Sniper", "type": "url", - "url": "https://www.infosniper.net/" + "url": "https://www.infosniper.net/", + "description": "Multi-field reverse OSINT tool for IP, email, phone lookups with social media enumeration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-field reverse lookup (IP/email/phone)", + "input": "IP, email, or phone", + "output": "Associated accounts and social profiles", + "opsec": "passive", + "opsecNote": "Correlates public data; paid features available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "utrace", "type": "url", - "url": "https://en.utrace.de/" + "url": "https://en.utrace.de/", + "description": "IP geolocation and reverse DNS lookup tool with network traceroute visualization.", + "status": "live", + "pricing": "free", + "bestFor": "IP location and traceroute", + "input": "IP or hostname", + "output": "Location, ASN, reverse DNS, route path", + "opsec": "active", + "opsecNote": "Traceroute is active; geolocation is passive.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1733,67 +4358,262 @@ { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "Website scanner analyzing URLs and domains for malicious content with infrastructure intelligence.", + "status": "live", + "pricing": "freemium", + "bestFor": "URL/domain scanning for malware and phishing", + "input": "URL or domain", + "output": "Screenshot, DNS, IP, certificates, cookies", + "opsec": "passive", + "opsecNote": "Passive scanning; no direct contact with target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/ip" + "url": "https://spyse.com/search/ip", + "description": "Internet assets search engine collecting and analyzing public data for attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and reconnaissance", + "input": "IP, domain, email, organization", + "output": "Subdomains, services, vulnerabilities, data breaches", + "opsec": "passive", + "opsecNote": "Passive data collection; requires account for full access.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Shodan", "type": "url", - "url": "https://www.shodan.io/" + "url": "https://www.shodan.io/", + "description": "Search engine for internet-connected devices, providing visibility into exposed services and vulnerabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Find exposed IoT and network services", + "input": "IP, port, service type", + "output": "Service banners, open ports, vulnerabilities, location", + "opsec": "passive", + "opsecNote": "Passive data collection; InternetDB API free for non-commercial use.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://netlas.io/" + "url": "https://netlas.io/", + "description": "Comprehensive internet scanning platform with OSINT, DNS, and WHOIS data. Free tier: 50 requests/day.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset reconnaissance with web, DNS, WHOIS", + "input": "IP, domain, ASN", + "output": "Open ports, services, certificates, DNS records, WHOIS", + "opsec": "passive", + "opsecNote": "Passive scanning with account-based rate limits.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Portmap", "type": "url", - "url": "https://portmap.com/" + "url": "https://portmap.com/", + "description": "Port mapping tool that scans for open ports and services on target IP addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Port scanning and service discovery", + "input": "IP address or hostname", + "output": "Open ports, service types, versions", + "opsec": "active", + "opsecNote": "Active port scanning probes target network.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Scans.io", "type": "url", - "url": "https://scans.io/" + "url": "https://scans.io/", + "description": "Archive of internet-wide scan data including censys scans and other reconnaissance data.", + "status": "live", + "pricing": "free", + "bestFor": "Historical internet scan data access", + "input": "IP or domain", + "output": "Historical scan results, service history", + "opsec": "passive", + "opsecNote": "Passive access to historical scanning archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Nmap (T)", "type": "url", - "url": "https://nmap.org/download.html" + "url": "https://nmap.org/download.html", + "description": "Open-source network mapping and port scanning tool with OS detection and service version identification.", + "status": "live", + "pricing": "free", + "bestFor": "Network reconnaissance and port scanning", + "input": "IP range or hostname", + "output": "Open ports, OS type, service versions, MAC addresses", + "opsec": "active", + "opsecNote": "Active scanning tool; generates network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Port scanner", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Web-based port scanner checking open ports on target IP addresses without installation.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port scanning without tools", + "input": "IP address and port range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active port scanning; limited to common ports on free tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Internet Census Search", "type": "url", - "url": "https://www.exfiltrated.com/querystart.php" + "url": "https://www.exfiltrated.com/querystart.php", + "description": "Search interface for the Shodan-like internet census data and open services.", + "status": "live", + "pricing": "free", + "bestFor": "Search open services and devices", + "input": "Service type, IP range, port", + "output": "List of exposed services and IPs", + "opsec": "passive", + "opsecNote": "Passive data search of known internet census.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "IP reputation and threat intelligence platform analyzing malicious IP addresses and attacks.", + "status": "live", + "pricing": "freemium", + "bestFor": "IP reputation and malicious activity analysis", + "input": "IP address", + "output": "Threat reports, activity logs, attack types", + "opsec": "passive", + "opsecNote": "Passive threat intelligence lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Scanless (T)", "type": "url", - "url": "https://github.com/vesche/scanless" + "url": "https://github.com/vesche/scanless", + "description": "Command-line tool for port scanning without leaving traces on target using third-party services.", + "status": "live", + "pricing": "free", + "bestFor": "Stealthy port scanning via proxies", + "input": "IP and port", + "output": "Open port results", + "opsec": "passive", + "opsecNote": "Routes scans through third-party services for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BinaryEdge (R)", "type": "url", - "url": "https://www.binaryedge.io/" + "url": "https://www.binaryedge.io/", + "description": "Commercial security research platform with internet-wide scanning and module-based detection.", + "status": "live", + "pricing": "paid", + "bestFor": "Commercial internet threat intelligence", + "input": "IP, domain, query", + "output": "Services, vulnerabilities, threat modules", + "opsec": "passive", + "opsecNote": "Commercial threat intelligence requiring subscription.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Masscan (T)", "type": "url", - "url": "https://github.com/robertdavidgraham/masscan" + "url": "https://github.com/robertdavidgraham/masscan", + "description": "Ultra-fast TCP port scanner designed for scanning large IP ranges and entire networks.", + "status": "live", + "pricing": "free", + "bestFor": "Large-scale network port scanning", + "input": "IP range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active scanner; generates significant network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1804,42 +4624,162 @@ { "name": "ASlookup.com", "type": "url", - "url": "https://aslookup.com/" + "url": "https://aslookup.com/", + "description": "BGP and autonomous system lookup tool for finding IP ranges and ownership information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP and ASN lookup", + "input": "ASN or IP address", + "output": "IP ranges, organization, peering info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Port scanner Online", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Simple web-based port scanner for checking common ports on target IPs.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port availability checks", + "input": "IP and port", + "output": "Port status (open/closed)", + "opsec": "active", + "opsecNote": "Active probing; may be logged by firewalls.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Onyphe", "type": "url", - "url": "https://www.onyphe.io/" + "url": "https://www.onyphe.io/", + "description": "Cyber defense search engine with internet scanning, threat intelligence, and attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and threat intel", + "input": "IP, domain, CVE", + "output": "Services, vulnerabilities, certificates, datasources", + "opsec": "passive", + "opsecNote": "Passive intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/as2.0/" + "url": "https://www.cidr-report.org/as2.0/", + "description": "Tool for analyzing IPv4 CIDR blocks and finding contained IP addresses and subnets.", + "status": "live", + "pricing": "free", + "bestFor": "CIDR block analysis and subnet enumeration", + "input": "CIDR block", + "output": "IP ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IP allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reverse.report", "type": "url", - "url": "https://reverse.report/" + "url": "https://reverse.report/", + "description": "Comprehensive reverse lookup tool for IP to domain, email, and phone number associations.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse IP and domain lookups", + "input": "IP address or domain", + "output": "Associated domains, subdomains, history", + "opsec": "passive", + "opsecNote": "Passive lookup of DNS and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Team Cymru IP to ASN", "type": "url", - "url": "https://asn.cymru.com/" + "url": "https://asn.cymru.com/", + "description": "IP to ASN mapping tool providing autonomous system ownership and prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN mapping", + "input": "IP address", + "output": "ASN, organization, prefix", + "opsec": "passive", + "opsecNote": "Passive lookup of BGP and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP to ASN DB", "type": "url", - "url": "https://iptoasn.com/" + "url": "https://iptoasn.com/", + "description": "Database and API service for looking up which ASN owns a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN lookup with historical data", + "input": "IP address", + "output": "ASN, organization, prefix, company info", + "opsec": "passive", + "opsecNote": "Passive database lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hacker Target - Reverse DNS", "type": "url", - "url": "https://hackertarget.com/reverse-dns-lookup/" + "url": "https://hackertarget.com/reverse-dns-lookup/", + "description": "Reverse DNS lookup tool and API finding domain names associated with IP addresses.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse DNS lookup of IP addresses", + "input": "IP address or range", + "output": "Associated domains and PTR records", + "opsec": "passive", + "opsecNote": "Passive DNS lookup; includes free API tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1850,7 +4790,22 @@ { "name": "IPv6 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/v6/as2.0/" + "url": "https://www.cidr-report.org/v6/as2.0/", + "description": "CIDR block analysis tool for IPv6 address ranges and subnet enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "IPv6 CIDR block analysis", + "input": "IPv6 CIDR block", + "output": "IPv6 ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IPv6 allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1861,22 +4816,82 @@ { "name": "Hurricane Electric BGP Toolkit", "type": "url", - "url": "https://bgp.he.net/" + "url": "https://bgp.he.net/", + "description": "BGP and network routing analysis tools including AS to prefix lookup and BGP prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP analysis and routing intelligence", + "input": "ASN, IP range, or prefix", + "output": "BGP routes, peering, organization info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Malicious Content Ranking", "type": "url", - "url": "https://bgpranking.circl.lu/" + "url": "https://bgpranking.circl.lu/", + "description": "Platform ranking ASNs and BGP prefixes by malicious content and security threats.", + "status": "live", + "pricing": "free", + "bestFor": "Identify malicious ASNs and networks", + "input": "ASN or prefix", + "output": "Threat ranking, malicious activity metrics", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PeeringDB", "type": "url", - "url": "https://www.peeringdb.com/advanced_search" + "url": "https://www.peeringdb.com/advanced_search", + "description": "Database of internet exchange points, member networks, and AS relationships for network mapping.", + "status": "live", + "pricing": "free", + "bestFor": "Internet peering and AS relationship mapping", + "input": "ASN, organization, or IX", + "output": "Peering relationships, exchange points, contacts", + "opsec": "passive", + "opsecNote": "Passive lookup of public peering data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Tools", "type": "url", - "url": "https://www.bgp4.as/tools" + "url": "https://www.bgp4.as/tools", + "description": "Collection of BGP analysis and AS number lookup tools for network intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "BGP routing and AS analysis", + "input": "ASN, IP, or prefix", + "output": "Routes, prefixes, organizations", + "opsec": "passive", + "opsecNote": "Passive analysis of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1887,17 +4902,62 @@ { "name": "IP Void", "type": "url", - "url": "https://www.ipvoid.com/" + "url": "https://www.ipvoid.com/", + "description": "IP reputation and threat intelligence service analyzing blacklist status and security risks.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP reputation and blacklist status", + "input": "IP address", + "output": "Threat score, blacklist status, reports", + "opsec": "passive", + "opsecNote": "Passive reputation lookup; account needed for full data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExoneraTor", "type": "url", - "url": "https://exonerator.torproject.org/" + "url": "https://exonerator.torproject.org/", + "description": "Tool for checking if an IP address belonged to Tor at a specific date.", + "status": "live", + "pricing": "free", + "bestFor": "Verify Tor relay membership by date", + "input": "IP address and date", + "output": "Tor exit/entry node status confirmation", + "opsec": "passive", + "opsecNote": "Passive historical Tor relay lookup from public archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grey Noise", "type": "url", - "url": "https://viz.greynoise.io/" + "url": "https://viz.greynoise.io/", + "description": "Platform for analyzing internet background noise and identifying benign scanning activity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Distinguish malicious from benign internet activity", + "input": "IP address", + "output": "Classification, scanner type, threat assessment", + "opsec": "passive", + "opsecNote": "Passive threat intelligence; free tier available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1908,22 +4968,82 @@ { "name": "Blocklist.de", "type": "url", - "url": "https://www.blocklist.de/en/index.html" + "url": "https://www.blocklist.de/en/index.html", + "description": "Community-contributed blocklist of IP addresses involved in attacks and malicious activity.", + "status": "live", + "pricing": "free", + "bestFor": "Check IP blacklist status", + "input": "IP address", + "output": "Blacklist status, attack types logged", + "opsec": "passive", + "opsecNote": "Passive lookup of community blocklist.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DShield API", "type": "url", - "url": "https://isc.sans.edu/api/" + "url": "https://isc.sans.edu/api/", + "description": "API and database of security events and IPs involved in attacks monitored by SANS.", + "status": "live", + "pricing": "free", + "bestFor": "Query IPs involved in attacks", + "input": "IP address", + "output": "Attack reports, threat activity", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from SANS monitored networks.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Project Honey Pot", "type": "url", - "url": "https://www.projecthoneypot.org/list_of_ips.php" + "url": "https://www.projecthoneypot.org/list_of_ips.php", + "description": "Global honeypot network collecting spam and attack data with IP reputation service.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP for spam and attack history", + "input": "IP address", + "output": "Threat score, spam reports, attack activity", + "opsec": "passive", + "opsecNote": "Passive lookup of honeypot-collected threat data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1934,22 +5054,82 @@ { "name": "IP Fingerprints - Reverse IP Lookup", "type": "url", - "url": "https://ipfingerprints.com/reverseip.php" + "url": "https://ipfingerprints.com/reverseip.php", + "description": "Find all domains hosted on a shared IP address through reverse IP lookup.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bing IP Search (D)", "type": "url", - "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" + "url": "https://www.bing.com/search?q=ip%3A8.8.8.8", + "description": "Bing search operator for finding domains and subdomains hosted on a specific IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on IP using Bing index", + "input": "IP address", + "output": "Domains indexed by Bing on that IP", + "opsec": "passive", + "opsecNote": "Passive search using Bing's public index.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TCP/IP Utils - Domain Neighbors", "type": "url", - "url": "https://dnslytics.com/" + "url": "https://dnslytics.com/", + "description": "Find all domains on the same IP and subdomain information via reverse IP lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Identify related domains on same IP", + "input": "Domain or IP", + "output": "Neighbor domains, IP info", + "opsec": "passive", + "opsecNote": "Passive DNS and IP lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MyIPNeighbors", "type": "url", - "url": "https://www.my-ip-neighbors.com/" + "url": "https://www.my-ip-neighbors.com/", + "description": "Reverse IP lookup tool for discovering all domains and subdomains on an IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find all domains on same shared IP", + "input": "IP address", + "output": "List of domains on IP, subdomains", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1960,12 +5140,42 @@ { "name": "CloudFlare Watch", "type": "url", - "url": "https://www.crimeflare.com/" + "url": "https://www.crimeflare.com/", + "description": "Tool for identifying and analyzing websites protected by Cloudflare's CDN and security services.", + "status": "live", + "pricing": "free", + "bestFor": "Identify Cloudflare-protected sites", + "input": "Domain or IP", + "output": "Cloudflare status, origin IP (if discoverable)", + "opsec": "passive", + "opsecNote": "Passive lookup of Cloudflare configurations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CloudFail (T)", "type": "url", - "url": "https://github.com/m0rtem/CloudFail" + "url": "https://github.com/m0rtem/CloudFail", + "description": "Tool for finding origin IPs of Cloudflare-protected websites through enumeration techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Bypass Cloudflare to find origin IP", + "input": "Domain protected by Cloudflare", + "output": "Origin IP address (if discoverable)", + "opsec": "active", + "opsecNote": "Uses active enumeration and DNS history techniques.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1976,12 +5186,42 @@ { "name": "WiGLE: Wireless Network Mapping", "type": "url", - "url": "https://wigle.net/" + "url": "https://wigle.net/", + "description": "Global database of wireless networks (WiFi, Bluetooth, cellular) with mapping and signal strength data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Map wireless networks and find signal coverage", + "input": "Location, SSID, or BSSID", + "output": "Network locations, signal maps, network details", + "opsec": "passive", + "opsecNote": "Crowdsourced wireless network data; passive lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenCellid: Database of Cell Towers", "type": "url", - "url": "https://opencellid.org/" + "url": "https://opencellid.org/", + "description": "Open database of cellular tower locations and coverage for mobile network geolocation.", + "status": "live", + "pricing": "free", + "bestFor": "Find cellular tower locations and coverage", + "input": "Cell tower ID or location", + "output": "Tower coordinates, operator, coverage area", + "opsec": "passive", + "opsecNote": "Passive lookup of public cellular network data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1992,22 +5232,82 @@ { "name": "Wireshark", "type": "url", - "url": "https://www.wireshark.org/download.html" + "url": "https://www.wireshark.org/download.html", + "description": "Open-source network packet analyzer for deep packet inspection and network troubleshooting.", + "status": "live", + "pricing": "free", + "bestFor": "Network packet analysis and protocol debugging", + "input": "Network traffic capture file", + "output": "Detailed packet analysis, protocol breakdown", + "opsec": "Unknown", + "opsecNote": "Tool-dependent; passive capture or active sniffing possible.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NetworkMiner", "type": "url", - "url": "https://www.netresec.com/?page=Networkminer" + "url": "https://www.netresec.com/?page=Networkminer", + "description": "Passive network forensics tool for extracting files and data from network traffic captures.", + "status": "live", + "pricing": "free", + "bestFor": "Network forensics and file extraction from traffic", + "input": "PCAP network traffic files", + "output": "Extracted files, metadata, network sessions", + "opsec": "passive", + "opsecNote": "Passive analysis of already-captured traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Packet Total", "type": "url", - "url": "https://www.packettotal.com/" + "url": "https://www.packettotal.com/", + "description": "Online platform for uploading and analyzing network packet captures (PCAP files).", + "status": "live", + "pricing": "free", + "bestFor": "Cloud-based network forensics analysis", + "input": "PCAP files", + "output": "Traffic analysis, threat indicators, IoCs", + "opsec": "Unknown", + "opsecNote": "Passive analysis of PCAP; consider privacy of uploaded data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "checkip (T)", "type": "url", - "url": "https://github.com/jreisinger/checkip" + "url": "https://github.com/jreisinger/checkip", + "description": "Command-line utility for checking local machine IP address and network connectivity.", + "status": "live", + "pricing": "free", + "bestFor": "Display local IP and network info", + "input": "Local system (no input needed)", + "output": "Local IP, gateway, DNS servers", + "opsec": "passive", + "opsecNote": "Passive system utility; local only.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2018,17 +5318,62 @@ { "name": "Ki.tc", "type": "url", - "url": "https://ki.tc" + "url": "https://ki.tc", + "description": "IP logging service that generates trackable links for IP/browser info collection.", + "status": "live", + "pricing": "free", + "bestFor": "Generate trackable links to log visitor IPs", + "input": "Target URL or destination", + "output": "Tracker link, IP logs, browser info", + "opsec": "Unknown", + "opsecNote": "Creates tracking mechanism; detection depends on how link is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grabify", "type": "url", - "url": "https://grabify.link" + "url": "https://grabify.link", + "description": "URL shortener service that logs IP addresses and device information of link clickers.", + "status": "live", + "pricing": "free", + "bestFor": "Shorten URLs and log visitor IPs", + "input": "URL to shorten", + "output": "Short URL with IP logging", + "opsec": "Unknown", + "opsecNote": "Creates tracking link; malicious uses common.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Logger", "type": "url", - "url": "https://iplogger.com/" + "url": "https://iplogger.com/", + "description": "IP logging and URL shortening service tracking visitor IP, location, and browser data.", + "status": "live", + "pricing": "free", + "bestFor": "Track visitor IPs through shortened links", + "input": "URL to wrap", + "output": "Logging URL, visitor IP/location data", + "opsec": "Unknown", + "opsecNote": "Tracking service; ethical and legal concerns apply.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -2049,127 +5394,462 @@ { "name": "Google Images", "type": "url", - "url": "https://images.google.com/?gws_rd=ssl" + "url": "https://images.google.com/", + "description": "Google's reverse image and visual search via Lens for finding matches, source pages, and related images across the web.", + "status": "live", + "pricing": "free", + "bestFor": "Broad reverse image search and source discovery", + "input": "Image upload or image URL", + "output": "Visually similar images, matching pages, and indexed source sites", + "opsec": "passive", + "opsecNote": "Standard search query against Google; no direct interaction with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bing Images", "type": "url", - "url": "https://www.bing.com/images" + "url": "https://www.bing.com/images", + "description": "Microsoft visual search engine with reverse image lookup and crop-based matching for partial-object analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Cropped reverse-image matching and visual component analysis", + "input": "Image upload, image URL, or cropped image region", + "output": "Matching images, related pages, and object-level visual matches", + "opsec": "passive", + "opsecNote": "Performs web search queries without direct interaction with target identities.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FaceCheck Facial Recognition Search", "type": "url", - "url": "https://facecheck.id/" + "url": "https://facecheck.id/", + "description": "Facial recognition search engine that finds publicly indexed face matches across web and social sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding public social profiles by face image", + "input": "Face photo upload", + "output": "Potential face matches with source links and similarity scoring", + "opsec": "active", + "opsecNote": "Uploads target imagery to a third-party face-search service; treat as active collection.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Surfface Face & People Search Engine", "type": "url", - "url": "https://surfface.com/" + "url": "https://surfface.com/", + "description": "AI-based face and people search platform focused on open-source identity discovery and correlation.", + "status": "live", + "pricing": "freemium", + "bestFor": "Identity correlation from face imagery", + "input": "Face photo and optional identifying context", + "output": "Candidate profile matches from publicly available web sources", + "opsec": "active", + "opsecNote": "Submits facial data to vendor infrastructure for matching against indexed sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PimEyes Face Search Engine", "type": "url", - "url": "https://pimeyes.com/en" + "url": "https://pimeyes.com/en", + "description": "Commercial reverse face search engine for locating appearances of a face on publicly indexed websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "High-coverage reverse face search investigations", + "input": "Face photo upload", + "output": "Matched face thumbnails and source-page links", + "opsec": "active", + "opsecNote": "Face image is uploaded and processed by a third-party biometric search provider.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Yandex Images", "type": "url", - "url": "https://www.yandex.com/images/" + "url": "https://yandex.com/images/", + "description": "Reverse image search engine with strong matching for Eastern European and Asian web sources.", + "status": "live", + "pricing": "free", + "bestFor": "Finding non-Western image sources and modified variants", + "input": "Image upload or image URL", + "output": "Similar images, likely originals, and source webpages", + "opsec": "passive", + "opsecNote": "Standard search requests to Yandex index; no direct account interaction required.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Baidu Images", "type": "url", - "url": "https://graph.baidu.com/pcpage/index?tpl_from=pc" + "url": "https://image.baidu.com/", + "description": "Chinese reverse image search platform useful for discovering image reuse on China-centric websites.", + "status": "live", + "pricing": "free", + "bestFor": "China-specific image source discovery", + "input": "Image upload or image URL", + "output": "Visually similar images from Chinese websites and platforms", + "opsec": "passive", + "opsecNote": "Queries Baidu index only; no direct contact with target entities.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Twitter Image Search (M)", "type": "url", - "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images" + "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images", + "description": "Manual X/Twitter query template for finding tweets containing images for a target keyword or account.", + "status": "live", + "pricing": "free", + "bestFor": "Finding image-containing tweets by keyword or operator", + "input": "Edited URL query (keyword, account, and search operators)", + "output": "Tweets and accounts with matching image/media posts", + "opsec": "passive", + "opsecNote": "Searches public timeline content; no direct engagement with targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Imgur Search", "type": "url", - "url": "https://imgur.com/search" + "url": "https://imgur.com/search", + "description": "Search interface for Imgur-hosted public images, albums, and community media posts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Locating reposted images and public gallery content on Imgur", + "input": "Keyword, tag, or user/gallery query", + "output": "Public image posts, albums, and account-linked media results", + "opsec": "passive", + "opsecNote": "Uses public site search and does not directly contact targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Photobucket", "type": "url", - "url": "https://photobucket.com/" + "url": "https://photobucket.com/", + "description": "Long-running image hosting platform with public galleries and legacy web-hosted photo content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding legacy hosted images and user gallery artifacts", + "input": "Keyword, user, or gallery search", + "output": "Public image galleries and hosted photo assets", + "opsec": "passive", + "opsecNote": "Investigations remain on public gallery pages and search views.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "7Photos.net", "type": "url", - "url": "https://7photos.net/" - }, - { - "name": "Panoramio", - "type": "url", - "url": "https://www.panoramio.com/" + "url": "https://7photos.net/", + "description": "Unclear image-related web service with an active domain but limited publicly verifiable functionality.", + "status": "degraded", + "pricing": "unknown", + "bestFor": "Unknown; requires additional validation before operational use", + "input": "Presumed image upload", + "output": "Unclear due to gated/redirected workflow", + "opsec": "unknown", + "opsecNote": "Observed authentication-style redirect behavior; service behavior is not fully observable.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Current Location", "type": "url", - "url": "https://current-location.com/" - }, - { - "name": "Lakako Photo Search", - "type": "url", - "url": "https://www.lakako.com/" + "url": "https://current-location.com/", + "description": "Location-based photo discovery tool that aggregates geotagged images from public platforms on an interactive map.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering geotagged photos near a location of interest", + "input": "Map location, coordinates, or browser geolocation", + "output": "Geotagged image results with source context from supported platforms", + "opsec": "passive", + "opsecNote": "Queries publicly indexed geotagged photos; no direct interaction with uploaders.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Lenso.ai", "type": "url", - "url": "https://lenso.ai/" + "url": "https://lenso.ai/", + "description": "AI reverse image and face matching platform designed to find similar or edited visual content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Matching altered or low-quality images and face lookups", + "input": "Image or face photo upload", + "output": "Visual matches, related occurrences, and similarity-ranked results", + "opsec": "active", + "opsecNote": "Uploads target imagery to external AI service for analysis and indexing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CC Search", "type": "url", - "url": "https://ccsearch.creativecommons.org/" + "url": "https://search.creativecommons.org/", + "description": "Creative Commons search portal for discovering openly licensed and public-domain images.", + "status": "live", + "pricing": "free", + "bestFor": "Finding license-safe imagery and attribution-ready sources", + "input": "Keyword search with license/source filters", + "output": "CC/public-domain image results across partner collections", + "opsec": "passive", + "opsecNote": "Aggregated search over open repositories with no target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CamFind App", "type": "url", - "url": "https://camfindapp.com/" + "url": "https://camfindapp.com/", + "description": "Mobile visual search app that identifies objects, landmarks, and products from photos.", + "status": "live", + "pricing": "freemium", + "bestFor": "On-device object identification and quick visual lookups", + "input": "Mobile camera image", + "output": "Object labels, related images, and linked web results", + "opsec": "active", + "opsecNote": "Uploads captured images to remote processing service for recognition.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "RevEye Reverse Image Search (T)", "type": "url", - "url": "https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/keaaclcjhehbbapnphnmpiklalfhelgf?hl=en" + "url": "https://github.com/steven2358/reveye", + "description": "Open-source browser extension that launches reverse image searches across multiple engines from one menu.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-engine reverse image pivoting from a single browser action", + "input": "Right-click target image in browser", + "output": "Parallel reverse-search results in configured engines", + "opsec": "passive", + "opsecNote": "Client-side extension submits search queries to selected engines only.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SmugMug Search", "type": "url", - "url": "https://www.smugmug.com/" + "url": "https://www.smugmug.com/", + "description": "Photo hosting and portfolio platform with searchable public galleries and photographer profiles.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding public photographer portfolios and gallery artifacts", + "input": "Keyword, gallery, or photographer search", + "output": "Public albums, image sets, and profile-linked photo collections", + "opsec": "passive", + "opsecNote": "Research is limited to publicly exposed gallery content.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ImageNet", "type": "url", - "url": "https://image-net.org/" + "url": "https://image-net.org/", + "description": "Large-scale labeled image dataset used for computer vision and image classification research.", + "status": "live", + "pricing": "free", + "bestFor": "Reference classification sets and ML-oriented visual taxonomy work", + "input": "Category/synset browsing and dataset queries", + "output": "Labeled image classes, metadata, and downloadable dataset resources", + "opsec": "passive", + "opsecNote": "Academic dataset access with no direct subject engagement.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Places2", "type": "url", - "url": "https://places2.csail.mit.edu/explore.html" + "url": "http://places2.csail.mit.edu/", + "description": "MIT CSAIL scene-recognition dataset containing millions of place-labeled images for visual analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Scene classification reference and location-context model training", + "input": "Scene categories and dataset download requests", + "output": "Scene-labeled image datasets and related research resources", + "opsec": "passive", + "opsecNote": "Public academic dataset access; no direct target interaction.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Image Identification Project", "type": "url", - "url": "https://www.imageidentify.com/" + "url": "https://www.imageidentify.com/", + "description": "Online image recognition service that labels uploaded images with machine-generated tags and confidence scores.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick machine-labeling of unknown image content", + "input": "Image upload", + "output": "Predicted tags, object labels, and confidence values", + "opsec": "active", + "opsecNote": "Uploaded images are processed on third-party infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SauceNAO", "type": "url", - "url": "https://saucenao.com/" + "url": "https://saucenao.com/", + "description": "Reverse image source finder widely used to trace artwork, anime frames, and reposted media to origin sites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Tracing image origins and duplicate postings", + "input": "Image upload or image URL", + "output": "Likely source links, matching images, and similarity metrics", + "opsec": "passive", + "opsecNote": "Search workflow only; does not interact with target accounts directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Picarta", "type": "url", - "url": "https://picarta.ai/" + "url": "https://picarta.ai/", + "description": "AI geolocation tool that estimates likely photo capture locations from visual scene analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Estimating geographic origin of photos without metadata", + "input": "Image upload", + "output": "Predicted coordinates and location confidence cues", + "opsec": "active", + "opsecNote": "Image content is uploaded to a third-party AI geolocation service.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FaceSeek Face Search Engine", "type": "url", - "url": "https://faceseek.online" + "url": "https://www.faceseek.online/", + "description": "Face-matching web tool for locating visually similar faces across indexed online content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Supplemental reverse face lookup and comparison", + "input": "Face photo upload", + "output": "Potential facial matches with source references", + "opsec": "active", + "opsecNote": "Uploads biometric imagery to a hosted face-search platform.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2180,27 +5860,102 @@ { "name": "Webstigram", "type": "url", - "url": "https://websta.me/search-engine-optimization/" + "url": "https://websta.me/search-engine-optimization/", + "description": "Legacy Webstagram endpoint historically used for Instagram search workflows; currently not verifiable as a standalone active OSINT tool.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference while migrating to active Instagram tooling", + "input": "Instagram usernames or tags (legacy workflow)", + "output": "Unreliable/limited Instagram lookup results", + "opsec": "unknown", + "opsecNote": "Tool status is unclear and behavior is inconsistent; validate with alternative tools before operational use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Instagram", "type": "url", - "url": "https://www.instagram.com/" + "url": "https://www.instagram.com/", + "description": "Main Instagram platform used for public profile, hashtag, and location OSINT collection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Social profiling and image discovery", + "input": "Usernames, hashtags, locations", + "output": "Profiles, posts, location signals, and network context", + "opsec": "passive", + "opsecNote": "Viewing public content is low-friction, but platform telemetry and account controls still apply.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Mini Instagram", "type": "url", - "url": "https://mininsta.net/" + "url": "https://mini-for-instagram.en.softonic.com/", + "description": "Lightweight Instagram client utility used to simplify media viewing and downloading workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Preserving Instagram media for offline review", + "input": "Instagram profile or post URLs", + "output": "Downloaded Instagram images and videos", + "opsec": "passive", + "opsecNote": "Client-side utility; still follow account and platform ToS constraints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Imgrab", "type": "url", - "url": "https://www.imgrab.com/" + "url": "https://www.imgrab.com/", + "description": "Image download utility family used for saving individual or batch media from web pages.", + "status": "live", + "pricing": "free", + "bestFor": "Batch image capture and archive building", + "input": "Web pages or direct image URLs", + "output": "Downloaded image files", + "opsec": "passive", + "opsecNote": "Primarily local processing; risk profile depends on source websites being queried.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Tofo.me", "type": "url", - "url": "https://tofo.me/" + "url": "https://tofo.me/", + "description": "Legacy Instagram-related endpoint with unclear current functionality and limited verifiable OSINT value.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Unknown", + "output": "Unclear or inconsistent output", + "opsec": "unknown", + "opsecNote": "Service behavior is not reliably documented; prefer validated alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -2211,27 +5966,102 @@ { "name": "Flickr", "type": "url", - "url": "https://www.flickr.com/" + "url": "https://www.flickr.com/", + "description": "Photo hosting platform that often preserves useful image metadata and geotags for OSINT workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Image metadata and geolocation investigation", + "input": "Usernames, tags, photo links, map regions", + "output": "Public photos with metadata and account context", + "opsec": "passive", + "opsecNote": "Public browsing is generally low-risk; API and account use may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Flickr Map", "type": "url", - "url": "https://www.flickr.com/map/" + "url": "https://www.flickr.com/map/", + "description": "Flickr map interface for browsing geotagged photos by area and time.", + "status": "live", + "pricing": "free", + "bestFor": "Map-based discovery of geotagged Flickr images", + "input": "Geographic area and map navigation", + "output": "Geotagged photos plotted on interactive map tiles", + "opsec": "passive", + "opsecNote": "Uses public Flickr geotag data; activity remains normal web browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "My Pics Map", "type": "url", - "url": "https://www.mypicsmap.com/" + "url": "https://www.mypicsmap.com/", + "description": "Photo mapping utility reference with unclear present-day availability as a distinct OSINT tool.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference for photo geotag visualization", + "input": "Photo collections with location data", + "output": "Mapped photo points (when service is operational)", + "opsec": "unknown", + "opsecNote": "Current reliability is uncertain; validate output against active mapping alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "idGettr", "type": "url", - "url": "https://www.webfx.com/tools/idgettr/" + "url": "https://www.webfx.com/tools/idgettr/", + "description": "Web utility for resolving Instagram usernames to numeric account IDs.", + "status": "live", + "pricing": "free", + "bestFor": "Converting Instagram handles into numeric IDs for follow-on tooling", + "input": "Instagram username", + "output": "Numeric Instagram user ID", + "opsec": "passive", + "opsecNote": "Lookup is performed through the service; avoid using sensitive operational accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Flickr Hive Mind", "type": "url", - "url": "https://flickrhivemind.net/" + "url": "https://flickrhivemind.net/", + "description": "Advanced Flickr search and data-mining interface for tags, users, text, and date filters.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted Flickr dataset discovery and batch result review", + "input": "Tags, usernames, free text, date constraints", + "output": "Filtered photo result sets and source links", + "opsec": "passive", + "opsecNote": "Queries public Flickr data through a third-party interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2242,97 +6072,297 @@ { "name": "ExifEditor", "type": "url", - "url": "https://exifeditor.io" + "url": "https://exifeditor.io", + "description": "Browser-based EXIF metadata viewer and editor for quick image metadata inspection or sanitization.", + "status": "live", + "pricing": "free", + "bestFor": "Fast EXIF inspection and metadata cleanup in-browser", + "input": "Image files (JPEG/PNG)", + "output": "Displayed EXIF fields and optionally edited image file", + "opsec": "passive", + "opsecNote": "Primarily local browser processing; metadata edits are active data changes.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExifTool (T)", "type": "url", - "url": "https://exiftool.org/" + "url": "https://exiftool.org/", + "description": "Widely used command-line toolkit for reading and writing EXIF, IPTC, XMP, and other metadata formats.", + "status": "live", + "pricing": "free", + "bestFor": "Comprehensive multi-format metadata extraction", + "input": "Image, video, audio, and document files", + "output": "Structured metadata fields and optional file metadata updates", + "opsec": "passive", + "opsecNote": "Read operations are passive; write mode modifies source metadata.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExifViewer", "type": "url", - "url": "https://www.exifviewer.org/" + "url": "https://www.exifviewer.org/", + "description": "Online EXIF inspection utility for camera, location, and embedded image metadata fields.", + "status": "live", + "pricing": "free", + "bestFor": "Quick EXIF inspection without local CLI tools", + "input": "Image file uploads or image URLs", + "output": "Human-readable EXIF and geolocation data", + "opsec": "passive", + "opsecNote": "Uploads may route through third-party infrastructure depending on deployment.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FOCA (T)", "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" + "url": "https://github.com/ElevenPaths/FOCA", + "description": "Desktop reconnaissance tool that gathers public documents from target domains and extracts embedded metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Corporate document metadata reconnaissance", + "input": "Target domains and document repositories", + "output": "Extracted usernames, paths, software fingerprints, and document metadata", + "opsec": "active", + "opsecNote": "Performs active collection and download actions that may be logged by target infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "GeoSetter", "type": "url", - "url": "https://geosetter.de/en/main-en/" + "url": "https://geosetter.de/en/main-en/", + "description": "Windows desktop utility for viewing and editing photo geotags and EXIF/XMP metadata fields in bulk.", + "status": "live", + "pricing": "free", + "bestFor": "Bulk geolocation metadata review and correction", + "input": "Image files with embedded or missing location metadata", + "output": "Updated geotags and metadata-enhanced image sets", + "opsec": "passive", + "opsecNote": "Local tool; editing metadata is an active modification step.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Jeffrey's Exif Viewer", "type": "url", - "url": "https://exif.regex.info/" + "url": "https://regex.info/blog/", + "description": "Formerly popular EXIF web viewer that is now discontinued and kept as historical reference.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Image files (service discontinued)", + "output": "No active EXIF processing available", + "opsec": "unknown", + "opsecNote": "Service is discontinued; use active alternatives for operational work.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "JPEGsnoop (T)", "type": "url", - "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html" + "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html", + "description": "Windows forensic utility for deep JPEG structure analysis, recompression detection, and authenticity clues.", + "status": "live", + "pricing": "free", + "bestFor": "JPEG forensic analysis and tamper signal detection", + "input": "JPEG and supported media/document files", + "output": "Compression signatures, structure details, and edit indicators", + "opsec": "passive", + "opsecNote": "Local forensic analysis with no inherent outbound activity.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Metapicz", "type": "url", - "url": "https://metapicz.com/#landing" + "url": "https://metapicz.com/#landing", + "description": "Online EXIF parser historically used for quick camera and location metadata reads, now showing signs of limited maintenance.", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy metadata checks when primary tools are unavailable", + "input": "Image files", + "output": "Formatted EXIF metadata when service is functioning", + "opsec": "passive", + "opsecNote": "Reliability appears inconsistent; verify findings with maintained alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Search by Exif", "type": "url", - "url": "https://www.exif-search.com/" + "url": "https://exif.osint-tool.com", + "description": "Web EXIF inspection tool focused on extracting metadata and GPS clues from supplied images.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid EXIF and geolocation extraction", + "input": "Image files", + "output": "EXIF metadata with location-relevant fields", + "opsec": "passive", + "opsecNote": "Web-hosted processing can expose uploads to third-party infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "xeuledoc - Fetch metadata about any public Google document", "type": "url", - "url": "https://github.com/Malfrats/xeuledoc" - }, - { - "name": "FOCA (T)", - "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" + "url": "https://github.com/Malfrats/xeuledoc", + "description": "Python tool that extracts metadata from public Google Docs, Sheets, and Slides links.", + "status": "live", + "pricing": "free", + "bestFor": "Google document attribution and metadata extraction", + "input": "Public Google document URLs", + "output": "Owner identifiers, account metadata, and document context", + "opsec": "passive", + "opsecNote": "Reads only public docs without authentication bypass, but still queries Google infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Exiv2 (T)", "type": "url", - "url": "https://exiv2.org/" + "url": "https://exiv2.org/", + "description": "Cross-platform library and CLI for reading and modifying EXIF, IPTC, XMP, and ICC metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Programmatic metadata parsing and editing pipelines", + "input": "Image files with embedded metadata", + "output": "Metadata dumps and optional metadata writes", + "opsec": "passive", + "opsecNote": "Read operations are passive; write actions alter evidence files.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MediaInfo (T)", "type": "url", - "url": "https://mediaarea.net/en/MediaInfo" + "url": "https://mediaarea.net/en/MediaInfo", + "description": "Cross-platform utility for extracting technical metadata from video and audio media files.", + "status": "live", + "pricing": "free", + "bestFor": "Media codec and container metadata profiling", + "input": "Video and audio files", + "output": "Codec, bitrate, duration, stream, and tag metadata", + "opsec": "passive", + "opsecNote": "Local analysis utility with no required outbound collection.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Apache Tika (T)", "type": "url", - "url": "https://tika.apache.org/" + "url": "https://tika.apache.org/", + "description": "Apache content analysis framework for extracting metadata and text across a very broad set of file formats.", + "status": "live", + "pricing": "free", + "bestFor": "Scalable metadata extraction across heterogeneous document sets", + "input": "Documents, archives, media, and structured file types", + "output": "Normalized metadata fields and extracted text content", + "opsec": "passive", + "opsecNote": "Operational exposure depends on deployment mode (local vs server-based processing).", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "oletools (T)", "type": "url", - "url": "https://github.com/decalage2/oletools" + "url": "https://github.com/decalage2/oletools", + "description": "Python toolkit for analyzing OLE and Office documents, including macro extraction and suspicious object detection.", + "status": "live", + "pricing": "free", + "bestFor": "Office document security triage and embedded code inspection", + "input": "OLE/OOXML/RTF Office documents", + "output": "Macro code, suspicious indicators, embedded object details, and metadata", + "opsec": "active", + "opsecNote": "Malicious samples can trigger security tooling; run analysis in isolated environments.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hachoir (T)", "type": "url", - "url": "https://github.com/vstinner/hachoir" + "url": "https://hachoir.readthedocs.io/" }, { "name": "C2PA Verify", "type": "url", - "url": "https://contentcredentials.org/verify" + "url": "https://c2paviewer.com/" }, { "name": "Metadata2Go", "type": "url", "url": "https://www.metadata2go.com/" - }, - { - "name": "Get-Metadata", - "type": "url", - "url": "https://www.get-metadata.com/" } ] }, @@ -2343,12 +6373,7 @@ { "name": "Ghiro (T)", "type": "url", - "url": "https://github.com/ghirensics/ghiro" - }, - { - "name": "Camera Trace", - "type": "url", - "url": "https://www.cameratrace.com/trace" + "url": "https://getghiro.org/" }, { "name": "Forensically", @@ -2361,11 +6386,6 @@ "name": "OCR", "type": "folder", "children": [ - { - "name": "Online OCR", - "type": "url", - "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" - }, { "name": "i2OCR", "type": "url", @@ -2390,7 +6410,7 @@ { "name": "Creepy (T)", "type": "url", - "url": "https://www.geocreepy.com/" + "url": "https://github.com/ilektrojohn/creepy" } ] } @@ -2407,7 +6427,7 @@ { "name": "Google Videos", "type": "url", - "url": "https://www.google.com/videohp?gws_rd=ssl" + "url": "https://www.google.com/videohp" }, { "name": "Bing Videos", @@ -2417,7 +6437,7 @@ { "name": "Internet Archive Videos", "type": "url", - "url": "https://archive.org/details/opensource_movies" + "url": "https://archive.org/details/movies" }, { "name": "Vines (D)", @@ -2425,14 +6445,14 @@ "url": "https://www.google.com/search?q=site:vine.co+%3Csearchterm%3E" }, { - "name": "Dogpile Web Search", + "name": "Dogpile", "type": "url", "url": "https://www.dogpile.com/" }, { "name": "Geo Search Tool", "type": "url", - "url": "https://www.geosearchtool.com/" + "url": "https://youtube.github.io/geo-search-tool/" }, { "name": "blinkx Video Search", @@ -2442,17 +6462,17 @@ { "name": "Facebook Live Map", "type": "url", - "url": "https://www.facebook.com/watch/live/?ref=live_delegate" + "url": "https://facebook.com/live" }, { - "name": "LiveLeak", + "name": "LiveLeak (D)", "type": "url", "url": "https://www.liveleak.com/" }, { "name": "Metatube", "type": "url", - "url": "https://www.metatube.com/" + "url": "https://github.com/JVT038/MetaTube" }, { "name": "Yahoo Video Search", @@ -2462,7 +6482,7 @@ { "name": "Search YouTube by Location", "type": "url", - "url": "https://mattw.io/youtube-geofind/location" + "url": "https://mattw.io/youtube-geofind/" } ] }, @@ -2470,11 +6490,6 @@ "name": "Analyze / Record", "type": "folder", "children": [ - { - "name": "DetURL", - "type": "url", - "url": "https://deturl.com/" - }, { "name": "Print YouTube StoryBoard Instructions", "type": "url", @@ -2641,7 +6656,22 @@ { "name": "What Font Is", "type": "url", - "url": "https://www.whatfontis.com/" + "url": "https://www.whatfontis.com/", + "description": "AI-powered font identification tool that analyzes images against a database of 1.2M+ typefaces to identify fonts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Identifying fonts from screenshots and images", + "input": "Image files containing text (uploaded via drag-and-drop or file picker)", + "output": "Font matches with design details, download links, and up to 60+ similar alternatives", + "opsec": "passive", + "opsecNote": "Uploads images to remote servers; consider OPSEC implications for sensitive screenshots or documents.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -2662,27 +6692,102 @@ { "name": "FB Email Search", "type": "url", - "url": "https://www.facebook.com/public?query=email@gmail.com&nomc=0" + "url": "https://www.facebook.com/public?query=email@gmail.com&nomc=0", + "description": "Facebook public search pattern used to test whether an email identifier resolves to matching profiles. Useful for quick account existence checks with manually edited query values.", + "status": "live", + "pricing": "free", + "bestFor": "Quick Facebook account existence checks from an email identifier", + "input": "Email address (replace the query value in the URL)", + "output": "Facebook public search results that may include matching profile records", + "opsec": "passive", + "opsecNote": "Uses Facebook web search endpoints without authentication, but query terms are visible in browser/network logs.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Recover FB Account", "type": "url", - "url": "https://www.facebook.com/login/identify?ctx=recover" + "url": "https://www.facebook.com/login/identify?ctx=recover", + "description": "Facebook account recovery endpoint that confirms whether an email or phone number is linked to an account and presents recovery options.", + "status": "live", + "pricing": "free", + "bestFor": "Validating whether a target email or phone is tied to a Facebook account", + "input": "Email address or phone number", + "output": "Account match confirmation and available recovery paths", + "opsec": "passive", + "opsecNote": "No login required, but submitted identifiers are sent directly to Facebook.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Facebook Photos by ID (M)", "type": "url", - "url": "https://www.facebook.com/photo.php?fbid=PHOTO-ID-HERE" + "url": "https://www.facebook.com/photo.php?fbid=PHOTO-ID-HERE", + "description": "Direct Facebook photo permalink format that retrieves a specific image when the photo ID is known.", + "status": "live", + "pricing": "free", + "bestFor": "Opening specific Facebook photos from known numeric IDs", + "input": "Photo ID value inserted into the URL", + "output": "Direct Facebook photo page for the supplied photo ID", + "opsec": "passive", + "opsecNote": "Accesses publicly available photo endpoints; visibility depends on the target photo privacy settings.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FB Lookup ID", "type": "url", - "url": "https://lookup-id.com/" + "url": "https://lookup-id.com/", + "description": "Web utility that resolves Facebook profile, page, or group URLs into numeric Facebook IDs for downstream investigation tools.", + "status": "live", + "pricing": "free", + "bestFor": "Converting Facebook profile URLs into numeric IDs for pivoting", + "input": "Facebook profile/page/group URL", + "output": "Resolved numeric Facebook ID", + "opsec": "passive", + "opsecNote": "Processes public Facebook URLs through a third-party service.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FB Identify (Requires Logout)", "type": "url", - "url": "https://www.facebook.com/login/identify" + "url": "https://www.facebook.com/login/identify", + "description": "Facebook identify endpoint used in recovery workflows to resolve account records from submitted identifiers; typically works best when not logged in.", + "status": "live", + "pricing": "free", + "bestFor": "Account discovery checks through Facebook identify flow", + "input": "Email address, phone number, or profile identifier", + "output": "Potential account matches and recovery prompts", + "opsec": "passive", + "opsecNote": "Requires interacting with Facebook recovery interfaces and may produce different results when authenticated.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -2781,12 +6886,42 @@ { "name": "Inflact Instagram Viewer (Anonymous)", "type": "url", - "url": "https://inflact.com/instagram-viewer/profile/" + "url": "https://inflact.com/instagram-viewer/profile/", + "description": "Anonymous Instagram viewer for browsing public profiles, stories, and posts without authenticating to Instagram directly.", + "status": "live", + "pricing": "freemium", + "bestFor": "Anonymous reconnaissance of public Instagram profiles", + "input": "Instagram username or profile URL", + "output": "Profile details, posts, stories, and highlight content", + "opsec": "passive", + "opsecNote": "Uses a third-party proxy viewer; avoid entering sensitive target identifiers outside approved workflow.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Osintgram (T)", "type": "url", - "url": "https://github.com/Datalux/Osintgram" + "url": "https://github.com/Datalux/Osintgram", + "description": "Python-based Instagram OSINT toolkit for extracting data from public accounts, including posts, hashtags, and follower relationships.", + "status": "live", + "pricing": "free", + "bestFor": "Deep Instagram profile analysis from a local CLI workflow", + "input": "Instagram username and operator credentials for session access", + "output": "Posts, captions, hashtags, engagement metrics, and account metadata", + "opsec": "active", + "opsecNote": "Direct interaction with Instagram endpoints can trigger rate limits or account monitoring.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2801,32 +6936,122 @@ { "name": "Twitter Advanced Search", "type": "url", - "url": "https://twitter.com/search-advanced" + "url": "https://twitter.com/search-advanced", + "description": "Built-in X/Twitter advanced search interface supporting operator-based filtering for users, terms, dates, and engagement constraints.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted discovery of public tweets with complex filters", + "input": "Search operators and filter parameters (keywords, accounts, dates, media flags)", + "output": "Filtered tweet result set matching the applied criteria", + "opsec": "passive", + "opsecNote": "Uses native search features without direct interaction with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Twitter Location Search", "type": "url", - "url": "https://twitter.com/search?q=geocode%3A36.1143855%2C-115.1727518%2C1km&src=typd" + "url": "https://twitter.com/search?q=geocode%3A36.1143855%2C-115.1727518%2C1km&src=typd", + "description": "Operator-based X/Twitter search workflow for geotagged content using `geocode:` and location-focused query parameters.", + "status": "live", + "pricing": "free", + "bestFor": "Finding public tweets associated with specific coordinates and radius", + "input": "Latitude/longitude plus radius in search query", + "output": "Tweets matching the configured location filter", + "opsec": "passive", + "opsecNote": "Searches public indexed content; no outbound contact to targets beyond normal platform queries.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Twitter Date Search", "type": "url", - "url": "https://twitter.com/search?q=SearchTerm%20since:2016-03-01%20until:2016-03-02" + "url": "https://twitter.com/search?q=SearchTerm%20since:2016-03-01%20until:2016-03-02", + "description": "Date-bounded X/Twitter search pattern using `since:` and `until:` operators to isolate tweets in a specific time window.", + "status": "live", + "pricing": "free", + "bestFor": "Timeline reconstruction and historical tweet collection", + "input": "Keywords plus `since:` and `until:` date operators", + "output": "Tweets posted within the requested date range", + "opsec": "passive", + "opsecNote": "Relies on platform search indexing and public content availability.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Followerwonk (R)", "type": "url", - "url": "https://followerwonk.com/" + "url": "https://followerwonk.com/", + "description": "Follower analytics platform (now under Fedica) for examining X/Twitter audience demographics, account overlaps, and engagement trends.", + "status": "live", + "pricing": "freemium", + "bestFor": "Audience demographic analysis and account overlap discovery", + "input": "Twitter/X username or profile URL", + "output": "Follower demographics, activity analytics, and comparative account insights", + "opsec": "passive", + "opsecNote": "Uses platform-derived public profile and follower data via third-party analytics.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Twopcharts", "type": "url", - "url": "https://twopcharts.com/" + "url": "https://twopcharts.com/", + "description": "Legacy Twitter statistics site for ranking active users by geography and language; coverage appears limited and stale.", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy exploratory checks of historical Twitter influence rankings", + "input": "City or language selection", + "output": "Ranked user lists and basic activity comparisons", + "opsec": "passive", + "opsecNote": "Data freshness is unclear; treat outputs as historical indicators rather than real-time intelligence.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TweeterID", "type": "url", - "url": "https://tweeterid.com/" + "url": "https://tweeterid.com/", + "description": "Bidirectional converter between X/Twitter usernames and numeric account IDs for correlation and API-ready pivots.", + "status": "live", + "pricing": "free", + "bestFor": "Converting Twitter handles to numeric IDs (and reverse)", + "input": "Twitter username or numeric Twitter ID", + "output": "Mapped username-ID pair for the submitted account", + "opsec": "passive", + "opsecNote": "Performs lookup against public account metadata through a third-party web interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2841,22 +7066,82 @@ { "name": "Tweepsect", "type": "url", - "url": "https://tweepsect.com/" + "url": "https://tweepsect.com/", + "description": "Former Twitter overlap analysis tool for intersecting followers and following lists between accounts; no longer operational under current API limits.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference for follower overlap analysis workflows", + "input": "Twitter username(s)", + "output": "Follower/following intersection sets (historical behavior)", + "opsec": "passive", + "opsecNote": "Service endpoint is no longer functional; keep for historical context only.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Twitonomy", "type": "url", - "url": "https://www.twitonomy.com/" + "url": "https://www.twitonomy.com/", + "description": "Twitter analytics platform for profile activity, hashtag usage, and follower/following behavior over time.", + "status": "live", + "pricing": "free", + "bestFor": "Profile-level Twitter analytics and behavior baselining", + "input": "Twitter/X username", + "output": "Activity timelines, hashtag/topic frequency, and account-level analytics", + "opsec": "passive", + "opsecNote": "Requires third-party platform access and may prompt X/Twitter sign-in for full features.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Foller.me Analytics", "type": "url", - "url": "https://foller.me/" + "url": "https://foller.me/", + "description": "Web analytics tool for summarizing public Twitter profile behavior, including hashtags, mentions, topics, and activity cadence.", + "status": "live", + "pricing": "free", + "bestFor": "Quick baseline profiling of a Twitter account", + "input": "Twitter/X username", + "output": "Follower counts, topic and hashtag summaries, posting-time patterns, and account metadata", + "opsec": "passive", + "opsecNote": "Queries publicly visible profile data through a third-party interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "X0rz Tweets_analyzer (T)", "type": "url", - "url": "https://github.com/x0rz/tweets_analyzer" + "url": "https://github.com/x0rz/tweets_analyzer", + "description": "Python CLI analyzer for profiling Twitter user behavior, including posting rhythm, language distribution, and source-client usage.", + "status": "live", + "pricing": "free", + "bestFor": "Behavioral profiling and temporal analysis of Twitter accounts", + "input": "Twitter username and API credentials", + "output": "Activity charts, language/source statistics, and account behavior indicators", + "opsec": "active", + "opsecNote": "Requires API-driven collection and can expose investigator infrastructure through API usage patterns.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2867,44 +7152,164 @@ { "name": "RiteTag", "type": "url", - "url": "https://ritetag.com/" + "url": "https://ritetag.com/", + "description": "Hashtag intelligence platform that scores and recommends social tags based on trend velocity and engagement potential.", + "status": "live", + "pricing": "freemium", + "bestFor": "Hashtag trend analysis and campaign tag selection", + "input": "Keywords, draft text, or media captions", + "output": "Suggested hashtags with trend and visibility indicators", + "opsec": "passive", + "opsecNote": "Processes submitted content on third-party infrastructure for analytics.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "TAGSExplorer", "type": "url", - "url": "https://tags.hawksey.info/tagsexplorer/" + "url": "https://tags.hawksey.info/tagsexplorer/", + "description": "Browser-based visualization layer for TAGS archives that maps mentions, replies, and retweet relationships from collected Twitter datasets.", + "status": "live", + "pricing": "free", + "bestFor": "Conversation network mapping from archived Twitter data", + "input": "Google Sheets data produced by TAGS collection workflows", + "output": "Interactive network graph and conversation summaries", + "opsec": "passive", + "opsecNote": "Works on previously collected datasets; no direct contact with target accounts during analysis.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "Tweet Metadata", "type": "url", - "url": "https://www.wsj.com/public/resources/documents/TweetMetadata.pdf" + "url": "https://www.wsj.com/public/resources/documents/TweetMetadata.pdf", + "description": "Reference document and workflow aid for interpreting metadata fields embedded in tweet payloads and exports.", + "status": "live", + "pricing": "free", + "bestFor": "Understanding tweet metadata fields for forensic analysis", + "input": "Tweet JSON/export data and metadata field references", + "output": "Field-level interpretation guidance for tweet metadata", + "opsec": "passive", + "opsecNote": "Documentation resource only; does not query live targets directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Birdwatcher (T)", "type": "url", - "url": "https://github.com/michenriksen/birdwatcher" + "url": "https://github.com/michenriksen/birdwatcher", + "description": "Open-source Twitter data harvesting and analysis framework for collecting tweets and producing offline analytical artifacts.", + "status": "live", + "pricing": "free", + "bestFor": "Local collection and analysis of Twitter datasets at scale", + "input": "Twitter account targets and API configuration", + "output": "Collected tweets, relationship data, and analysis-ready exports (including geospatial artifacts)", + "opsec": "active", + "opsecNote": "Performs direct API/data collection activity from investigator infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Tinfoleak Web", "type": "url", - "url": "https://tinfoleak.com/" + "url": "https://tinfoleak.com/", + "description": "Web-based platform for Twitter/X intelligence analysis, user profiling, and geolocation-oriented review of public activity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Twitter profile and timeline intelligence", + "input": "Twitter/X username or profile URL", + "output": "Profile details, tweet history views, and account activity context", + "opsec": "active", + "opsecNote": "Queries are sent to third-party service infrastructure and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Tinfoleak.py (T)", "type": "url", - "url": "https://www.vicenteaguileradiaz.com/tools/" + "url": "https://github.com/vaguileradiaz/tinfoleak", + "description": "Python command-line tool for collecting Twitter/X account intelligence and metadata from target profiles.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-based Twitter metadata collection", + "input": "Twitter/X usernames or profile identifiers", + "output": "User profile metadata and related account intelligence artifacts", + "opsec": "active", + "opsecNote": "Direct requests to platform endpoints expose source IP and request patterns.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DMI-TCAT (T)", "type": "url", - "url": "https://github.com/digitalmethodsinitiative/dmi-tcat" + "url": "https://github.com/digitalmethodsinitiative/dmi-tcat", + "description": "Twitter Capture and Analysis Toolset for collecting and analyzing Twitter datasets using self-hosted infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Large-scale Twitter collection and analysis", + "input": "API credentials plus search terms, handles, or tracking filters", + "output": "Stored tweet datasets, exports, and analysis-ready records", + "opsec": "active", + "opsecNote": "Requires authenticated API collection and self-hosted data processing.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Twint (T)", "type": "url", - "url": "https://github.com/twintproject/twint" + "url": "https://github.com/twintproject/twint", + "description": "Open-source Twitter scraping utility for collecting public tweet and user data without official API usage.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical Twitter scraping without API keys", + "input": "Handles, keywords, hashtags, and date filters", + "output": "Tweet collections, user metadata, and exportable structured results", + "opsec": "active", + "opsecNote": "Scraping activity can be detected and blocked by the target platform.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -2915,22 +7320,82 @@ { "name": "GeoSocial Footprint", "type": "url", - "url": "https://geosocialfootprint.com/" + "url": "https://geosocialfootprint.com/", + "description": "Geolocation-focused social media analysis service for mapping public location traces and movement patterns.", + "status": "live", + "pricing": "freemium", + "bestFor": "Location and movement pattern analysis", + "input": "Public social identifiers and geotagged content references", + "output": "Mapped points, movement timelines, and location summaries", + "opsec": "active", + "opsecNote": "Use may be logged by the provider and linked to investigator activity.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "One Million Tweet Map", "type": "url", - "url": "https://onemilliontweetmap.com/" + "url": "https://onemilliontweetmap.com/", + "description": "Interactive map for viewing recent geolocated tweets and filtering by keyword and region.", + "status": "live", + "pricing": "free", + "bestFor": "Real-time geolocated tweet monitoring", + "input": "Keyword, map area, and time filters", + "output": "Mapped tweet locations with associated post content", + "opsec": "passive", + "opsecNote": "Read-only web usage with no direct target interaction required.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Creepy (T)", "type": "url", - "url": "https://www.geocreepy.com/" + "url": "https://github.com/ilektrojohn/creepy", + "description": "Desktop geolocation intelligence tool aggregating public geotagged data from supported social sources.", + "status": "degraded", + "pricing": "free", + "bestFor": "Cross-platform geolocation aggregation", + "input": "Usernames and supported social platform account identifiers", + "output": "Location points, maps, and metadata for linked accounts", + "opsec": "active", + "opsecNote": "Tool pulls remote platform data and can generate identifiable request traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Fedica", "type": "url", - "url": "https://fedica.com/" + "url": "https://fedica.com/", + "description": "Social analytics platform with audience and engagement insights across multiple social networks.", + "status": "live", + "pricing": "freemium", + "bestFor": "Cross-platform social analytics and tracking", + "input": "Connected social accounts or profile targets", + "output": "Engagement metrics, trend data, and audience analytics", + "opsec": "active", + "opsecNote": "Platform usage and connected account actions are visible to service provider logs.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2941,17 +7406,62 @@ { "name": "All My Tweets", "type": "url", - "url": "https://www.allmytweets.net/connect/" + "url": "https://www.allmytweets.net/", + "description": "Twitter/X account history viewer for reviewing public tweet timelines in a single interface.", + "status": "live", + "pricing": "free", + "bestFor": "Quick review of tweet history", + "input": "Twitter/X username", + "output": "Chronological list of public tweets and profile activity", + "opsec": "active", + "opsecNote": "Uses third-party web service access that can be logged by provider systems.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Spoonbill", "type": "url", - "url": "https://spoonbill.io" + "url": "https://spoonbill.io/", + "description": "Service that tracks Twitter/X profile changes such as bios, names, and avatars over time.", + "status": "live", + "pricing": "freemium", + "bestFor": "Monitoring profile change history", + "input": "Twitter/X usernames", + "output": "Historical profile snapshots and change alerts", + "opsec": "passive", + "opsecNote": "Monitoring is indirect; investigator does not directly engage target accounts.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TweetVacuum (T)", "type": "url", - "url": "https://github.com/UberKitten/TweetVacuum" + "url": "https://github.com/UberKitten/TweetVacuum", + "description": "Tool for extracting larger Twitter/X timeline archives beyond default on-platform browsing constraints.", + "status": "live", + "pricing": "free", + "bestFor": "Expanded tweet history export", + "input": "Twitter/X account identifiers", + "output": "Archived tweet records in local export formats", + "opsec": "active", + "opsecNote": "Collection patterns may be visible through account- or IP-linked activity.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -2964,22 +7474,82 @@ { "name": "Reddit Metis", "type": "url", - "url": "https://redditmetis.com/" + "url": "https://redditmetis.com/", + "description": "Reddit user analyzer summarizing posting behavior, language patterns, and subreddit activity.", + "status": "live", + "pricing": "free", + "bestFor": "Reddit user behavior profiling", + "input": "Reddit username", + "output": "Account statistics, subreddit distribution, and content summaries", + "opsec": "passive", + "opsecNote": "Reads public Reddit data without direct interaction with target users.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reddit Archive", "type": "url", - "url": "https://www.redditarchive.com/" + "url": "https://www.redditarchive.com/", + "description": "Archive-oriented Reddit lookup resource for historical post and comment discovery workflows.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical Reddit content lookup", + "input": "Subreddit names, usernames, and keyword queries", + "output": "Archived post and comment references from historical datasets", + "opsec": "passive", + "opsecNote": "Read-only archive queries; availability may vary with backend data sources.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "subreddits", "type": "url", - "url": "https://subreddits.org/" + "url": "https://subreddits.org/", + "description": "Subreddit discovery index for identifying communities by topic and interest area.", + "status": "live", + "pricing": "free", + "bestFor": "Topic-based subreddit discovery", + "input": "Topic keywords or category browsing", + "output": "Lists of relevant subreddits and navigation paths", + "opsec": "passive", + "opsecNote": "Public index browsing with no direct target engagement.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reddit Comment History", "type": "url", - "url": "https://roadtolarissa.com/javascript/reddit-comment-visualizer/" + "url": "https://roadtolarissa.com/javascript/reddit-comment-visualizer/", + "description": "Visualization utility for reviewing Reddit account comment history and timing patterns.", + "status": "live", + "pricing": "free", + "bestFor": "Comment activity timeline analysis", + "input": "Reddit username", + "output": "Comment history visualizations and posting cadence insights", + "opsec": "passive", + "opsecNote": "Analyzes publicly accessible Reddit comment data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2990,22 +7560,82 @@ { "name": "LinkedInt - LinkedIn Recon Tool (T)", "type": "url", - "url": "https://github.com/vysecurity/LinkedInt" + "url": "https://github.com/vysecurity/LinkedInt", + "description": "LinkedIn reconnaissance script for enumerating employee profiles and organization-linked data points.", + "status": "degraded", + "pricing": "free", + "bestFor": "LinkedIn employee enumeration", + "input": "Company names, LinkedIn URLs, and search targets", + "output": "Employee profile lists and organization intelligence leads", + "opsec": "active", + "opsecNote": "Automated LinkedIn collection can violate platform policy and trigger detection.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "ScrapedIn (T)", "type": "url", - "url": "https://github.com/dchrastil/ScrapedIn" + "url": "https://github.com/dchrastil/ScrapedIn", + "description": "Open-source LinkedIn scraping utility for extracting profile and contact-style data from search results.", + "status": "live", + "pricing": "free", + "bestFor": "LinkedIn profile data extraction", + "input": "LinkedIn search queries and profile targets", + "output": "Structured profile records and contact-oriented datasets", + "opsec": "active", + "opsecNote": "Scraping traffic and automated behavior are detectable by LinkedIn controls.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "InSpy (T)", "type": "url", - "url": "https://github.com/jobroche/InSpy" + "url": "https://github.com/jobroche/InSpy", + "description": "LinkedIn-focused reconnaissance tool that combines profile discovery with email pattern generation.", + "status": "live", + "pricing": "free", + "bestFor": "Employee and email pattern discovery", + "input": "Company name and domain context", + "output": "Employee candidates with associated role and email pattern hints", + "opsec": "active", + "opsecNote": "Enumeration and enrichment workflows can expose investigator infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "raven (T)", "type": "url", - "url": "https://github.com/0x09AL/raven" + "url": "https://github.com/0x09AL/raven", + "description": "LinkedIn information gathering utility for automated employee enumeration and role filtering.", + "status": "live", + "pricing": "free", + "bestFor": "Automated LinkedIn org mapping", + "input": "Company, role, and location filters", + "output": "Enumerated employee records and role-based lists", + "opsec": "active", + "opsecNote": "Automated platform queries can be rate-limited or flagged.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3017,14 +7647,14 @@ "name": "TikTok (M)", "type": "url", "url": "https://www.tiktok.com/@username", - "description": "Direct TikTok profile lookup by manually editing the username in the URL. Quick way to check if a target has a TikTok presence.", + "description": "Manual TikTok profile URL pattern for direct lookup of public account pages.", "status": "live", "pricing": "free", - "bestFor": "Quick TikTok profile existence check", - "input": "TikTok username (replace 'username' in URL)", - "output": "Public TikTok profile page with videos, bio, and follower counts", - "opsec": "passive", - "opsecNote": "Standard web request to TikTok; profile views are not visible to the account owner without login.", + "bestFor": "Fast manual TikTok profile checks", + "input": "TikTok username inserted into the URL", + "output": "Public profile page with videos, bio, and engagement counts", + "opsec": "active", + "opsecNote": "Direct visits are observable by platform infrastructure; use caution when logged in.", "localInstall": false, "googleDork": false, "registration": false, @@ -3037,14 +7667,14 @@ "name": "TikTok-OSINT (T)", "type": "url", "url": "https://github.com/Omicron166/TikTok-OSINT", - "description": "Python CLI tool for collecting OSINT data from TikTok profiles including user metadata, video listings, and engagement statistics. Last updated October 2022.", - "status": "degraded", + "description": "Python tool for extracting TikTok profile metadata and video-linked OSINT artifacts.", + "status": "live", "pricing": "free", - "bestFor": "Automated TikTok profile data collection", - "input": "TikTok username or profile URL", - "output": "User metadata, video listings, engagement stats, and follower data", + "bestFor": "Automated TikTok metadata collection", + "input": "TikTok usernames or profile URLs", + "output": "Profile metadata, video details, and engagement-related fields", "opsec": "active", - "opsecNote": "Makes direct API requests to TikTok servers; may trigger rate limiting.", + "opsecNote": "Automated requests can trigger anti-abuse controls and rate limits.", "localInstall": true, "googleDork": false, "registration": false, @@ -3056,15 +7686,15 @@ { "name": "Unfurl", "type": "url", - "url": "https://dfir.blog/unfurl/", - "description": "Web and CLI tool that extracts and visualizes metadata embedded in URLs, including TikTok share links, timestamps, and tracking parameters. Also installable locally via Python.", + "url": "https://github.com/obsidianforensics/unfurl", + "description": "Forensic parser that extracts and visualizes metadata components embedded in URLs.", "status": "live", "pricing": "free", - "bestFor": "URL metadata extraction and timestamp analysis", - "input": "Any URL (including TikTok share/video links)", - "output": "Visual graph of extracted URL components, timestamps, and embedded identifiers", + "bestFor": "URL parameter and metadata forensics", + "input": "URLs or encoded URL fragments", + "output": "Parsed components, decoded values, and relationship visualizations", "opsec": "passive", - "opsecNote": "Parses URL structure locally in browser or on the Unfurl server; does not contact the target platform. Local install available for sensitive investigations.", + "opsecNote": "Local analysis mode avoids contacting target platforms during parsing.", "localInstall": true, "googleDork": false, "registration": false, @@ -3077,14 +7707,14 @@ "name": "yt-dlp (T)", "type": "url", "url": "https://github.com/yt-dlp/yt-dlp", - "description": "Feature-rich command-line video downloader supporting 1000+ sites including TikTok. Extracts video files, metadata, thumbnails, subtitles, and comments.", + "description": "Actively maintained command-line downloader for collecting video content and metadata from many platforms.", "status": "live", "pricing": "free", - "bestFor": "Downloading TikTok videos and extracting metadata for preservation", - "input": "TikTok video URL or user profile URL", - "output": "Downloaded video files, JSON metadata, thumbnails, subtitles, and comments", + "bestFor": "Video evidence preservation and metadata export", + "input": "Video, playlist, or channel URLs", + "output": "Media files, JSON metadata, thumbnails, subtitles, and related artifacts", "opsec": "active", - "opsecNote": "Makes direct HTTP requests to TikTok to download content; IP is visible to the platform.", + "opsecNote": "Direct content fetch requests expose investigator network identifiers.", "localInstall": true, "googleDork": false, "registration": false, @@ -3102,7 +7732,22 @@ { "name": "Treeverse (T)", "type": "url", - "url": "https://github.com/paulgb/Treeverse" + "url": "https://treeverse.app/", + "description": "Thread visualization tool for exploring conversation trees on supported social platforms.", + "status": "live", + "pricing": "free", + "bestFor": "Conversation structure mapping", + "input": "Post or thread URLs", + "output": "Hierarchical thread trees with participant and reply context", + "opsec": "passive", + "opsecNote": "Public-content visualization without direct target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3114,14 +7759,14 @@ "name": "Bellingcat Meta Content Library", "type": "url", "url": "https://bellingcat.gitbook.io/toolkit/more/all-tools/meta-content-library", - "description": "Bellingcat's guide to Meta's Content Library, a research platform providing near-real-time searchable archive of public Threads, Facebook, and Instagram content.", + "description": "Guide to Meta Content Library access for researching public Facebook, Instagram, and Threads content.", "status": "live", "pricing": "free", - "bestFor": "Large-scale Threads content search for academic and non-profit research", - "input": "Search queries, date ranges, content filters", - "output": "Public posts, engagement metrics, and text-in-image search results from Threads and other Meta platforms", + "bestFor": "Meta platform archive research for eligible organizations", + "input": "Approved research queries and archive search filters", + "output": "Searchable public-content archive results and metadata", "opsec": "passive", - "opsecNote": "Searches Meta's research archive; does not interact with target accounts directly. Requires academic/non-profit eligibility approval.", + "opsecNote": "Archive-centric workflow with eligibility gate; no direct account engagement.", "localInstall": false, "googleDork": false, "registration": true, @@ -3691,7 +8336,22 @@ { "name": "Slydial", "type": "url", - "url": "https://www.slydial.com/" + "url": "https://www.slydial.com/", + "description": "Voicemail drop service that connects directly to a recipient voicemail box without ringing the handset.", + "status": "live", + "pricing": "freemium", + "bestFor": "Voicemail-based phone-number engagement checks", + "input": "Phone number (primarily US mobile numbers)", + "output": "Voicemail delivery result and call/session outcome", + "opsec": "active", + "opsecNote": "Initiates outbound telephony actions against the target number and can generate logs/alerts.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3702,109 +8362,424 @@ { "name": "Numbering Plans", "type": "url", - "url": "https://www.numberingplans.com/?page=analysis&sub=phonenr" + "url": "https://www.numberingplans.com/?page=analysis&sub=phonenr", + "description": "International numbering reference for E.164 plans, carrier codes, and dialing metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Telephony standards and numbering-plan validation", + "input": "Country code, number range, or prefix", + "output": "Numbering-plan structure, carrier/routing metadata, and dialing references", + "opsec": "passive", + "opsecNote": "Reference lookup against published numbering data; no interaction with the target number.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Numberway", "type": "url", - "url": "https://www.numberway.com/" + "url": "https://www.numberway.com/", + "description": "Reverse phone lookup resource used to resolve ownership and location context from a phone number.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse phone owner and location enrichment", + "input": "Phone number", + "output": "Potential owner identity, carrier, and geographic details", + "opsec": "passive", + "opsecNote": "Query is brokered through third-party lookup infrastructure rather than direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "WhoCalld", "type": "url", - "url": "https://whocalld.com/" + "url": "https://whocalld.com/", + "description": "Legacy reverse-caller-ID listing retained for historical continuity in this category.", + "status": "down", + "pricing": "freemium", + "bestFor": "Historical reference only (defunct per project guidance)", + "input": "Phone number", + "output": "Previously provided caller identity and spam context", + "opsec": "unknown", + "opsecNote": "Marked defunct per CEO guidance; reliability and operational behavior are not trusted.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": true }, { "name": "CallerID Test", "type": "url", - "url": "https://calleridtest.com/" + "url": "https://calleridtest.com/", + "description": "Caller ID and number-validation utility for checking formatting and telecom metadata responses.", + "status": "live", + "pricing": "freemium", + "bestFor": "Caller-ID behavior and number validity testing", + "input": "Phone number", + "output": "Validation status, format checks, and associated number metadata", + "opsec": "passive", + "opsecNote": "Validation-style lookup with no direct contact to the target subscriber.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Twilio Lookup", "type": "url", - "url": "https://www.twilio.com/lookup" + "url": "https://www.twilio.com/lookup", + "description": "Twilio API endpoint for phone intelligence including line type, carrier, and validation data.", + "status": "live", + "pricing": "paid", + "bestFor": "Programmatic carrier/type validation and fraud controls", + "input": "Phone number in E.164 format", + "output": "Carrier, line type, validity, and optional risk/intelligence attributes", + "opsec": "active", + "opsecNote": "API calls are authenticated and logged by the provider account and may be auditable.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Fone Finder", "type": "url", - "url": "https://www.fonefinder.net/" + "url": "https://www.fonefinder.net/", + "description": "Legacy reverse phone lookup entry preserved for historical coverage in the framework.", + "status": "down", + "pricing": "freemium", + "bestFor": "Historical reference only (defunct per project guidance)", + "input": "Phone number", + "output": "Previously provided owner/location lookup details", + "opsec": "unknown", + "opsecNote": "Marked defunct per CEO guidance; do not rely on this entry operationally.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "True Caller", "type": "url", - "url": "https://www.truecaller.com/" + "url": "https://www.truecaller.com/", + "description": "Caller identification platform and mobile app for reverse lookup and spam-call context.", + "status": "live", + "pricing": "freemium", + "bestFor": "Caller-ID enrichment and spam reputation checks", + "input": "Phone number", + "output": "Caller profile signals, spam labels, and identity hints", + "opsec": "passive", + "opsecNote": "Lookups are mediated by the platform; typical usage does not directly notify the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Reverse Genie", "type": "url", - "url": "https://www.reversegenie.com/phone.php" + "url": "https://www.reversegenie.com/phone.php", + "description": "Reverse phone lookup service that returns publicly aggregated ownership and location hints.", + "status": "live", + "pricing": "free", + "bestFor": "Quick reverse-number triage from public-data aggregations", + "input": "Phone number", + "output": "Possible owner name, location, and related listing details", + "opsec": "passive", + "opsecNote": "Search is executed through an aggregator site and is generally non-interactive for targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SpyDialer", "type": "url", - "url": "https://www.spydialer.com:443/default.aspx" + "url": "https://www.spydialer.com:443/default.aspx", + "description": "Reverse phone lookup platform with caller intelligence and voicemail-related lookup features.", + "status": "live", + "pricing": "freemium", + "bestFor": "Phone-number attribution and spam context pivoting", + "input": "Phone number", + "output": "Identity clues, carrier/location context, and related lookup data", + "opsec": "passive", + "opsecNote": "Primary lookup behavior is database-driven, though some features may increase visibility.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Phone Validator", "type": "url", - "url": "https://www.phonevalidator.com/index.aspx" + "url": "https://www.phonevalidator.com/index.aspx", + "description": "Number-validation utility focused on format, line-type, and carrier checks.", + "status": "live", + "pricing": "free", + "bestFor": "Phone format/type validation before deeper pivots", + "input": "Phone number", + "output": "Validity result, number type, and carrier/format metadata", + "opsec": "passive", + "opsecNote": "Validation query against provider datasets with no direct target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Phonerator", "type": "url", - "url": "https://www.martinvigo.com/phonerator/" + "url": "https://www.martinvigo.com/phonerator/", + "description": "Phone number generation and testing utility for telephony research workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Generating test-number patterns for scripting and analysis", + "input": "Country/prefix pattern parameters", + "output": "Generated phone-number candidates and pattern outputs", + "opsec": "passive", + "opsecNote": "Local generation/reference behavior; does not query target subscribers directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Mr. Number (M)", "type": "url", - "url": "https://www.hiya.com/products/apps/hiya-spam-blocker" + "url": "https://www.hiya.com/products/apps/hiya-spam-blocker", + "description": "Mr. Number functionality has been consolidated under Hiya; retained as a legacy reference entry.", + "status": "down", + "pricing": "paid", + "bestFor": "Historical mapping to Hiya for caller-ID workflows", + "input": "Phone number", + "output": "Previously returned spam and caller-ID context (now via Hiya platform)", + "opsec": "unknown", + "opsecNote": "Standalone service is deprecated; use the Hiya entry for current functionality.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Next Caller (R)", "type": "url", - "url": "https://nextcaller.com/" + "url": "https://nextcaller.com/", + "description": "Caller-identification and spam intelligence service for reverse lookup workflows.", + "status": "live", + "pricing": "paid", + "bestFor": "Commercial caller-ID enrichment and number intelligence", + "input": "Phone number", + "output": "Caller identity indicators, spam reputation, and associated context", + "opsec": "active", + "opsecNote": "Account-based commercial lookups are provider-logged and attributable to operator credentials.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Data24-7 (R)", "type": "url", - "url": "https://www.data24-7.com/signup.php" + "url": "https://www.data24-7.com/signup.php", + "description": "Commercial data enrichment provider supporting phone-based identity and risk intelligence lookups.", + "status": "live", + "pricing": "paid", + "bestFor": "Enterprise-scale person/contact enrichment from phone pivots", + "input": "Phone number (single or batch)", + "output": "Enriched identity, risk, and contact-profile datasets", + "opsec": "active", + "opsecNote": "B2B account activity is logged and tied to customer credentials and usage plans.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "HLR Lookup Portal (R)", "type": "url", - "url": "https://www.hlr-lookups.com/en/start" + "url": "https://www.hlr-lookups.com/en/start", + "description": "HLR lookup service for telecom reachability, network, and carrier status checks.", + "status": "live", + "pricing": "paid", + "bestFor": "Mobile carrier/HLR validation and route intelligence", + "input": "Mobile number (E.164)", + "output": "HLR status, carrier/network identifiers, and routing metadata", + "opsec": "active", + "opsecNote": "Telecom lookup transactions are provider-recorded and typically require business credentials.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenCNAM API", "type": "url", - "url": "https://api.opencnam.com/v2/phone/+19073372323" + "url": "https://api.opencnam.com/v2/phone/+19073372323", + "description": "CNAM lookup API for resolving caller-name metadata from North American numbers.", + "status": "live", + "pricing": "paid", + "bestFor": "Programmatic caller-name enrichment in telecom workflows", + "input": "US/Canada phone number", + "output": "CNAM/caller-name string with associated lookup metadata", + "opsec": "active", + "opsecNote": "Authenticated API usage is logged and billable per account or subscription terms.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Numspy (T)", "type": "python3 Module", - "url": "https://bhattsameer.github.io/numspy/" + "url": "https://bhattsameer.github.io/numspy/", + "description": "OSINT-focused phone lookup utility with CLI-friendly workflows and metadata extraction features.", + "status": "live", + "pricing": "free", + "bestFor": "Technical lookup workflows and scripted number reconnaissance", + "input": "Phone number", + "output": "Carrier/region and related phone intelligence fields", + "opsec": "active", + "opsecNote": "Tool-driven queries can be attributable to operator infrastructure and API endpoints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Numspy-Api", "type": "url", - "url": "https://numspy.pythonanywhere.com/" + "url": "https://numspy.pythonanywhere.com/", + "description": "API wrapper for Numspy-style phone intelligence queries and automation use cases.", + "status": "live", + "pricing": "freemium", + "bestFor": "Programmatic phone-number verification and enrichment", + "input": "Phone number or batch input", + "output": "Structured verification and metadata response payloads", + "opsec": "active", + "opsecNote": "Remote API calls are logged by service operators and linked to originating access patterns.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Family Tree Now (M)", "type": "url", - "url": "https://www.familytreenow.com/search/genealogy/results?phoneno=(555)555-5555" + "url": "https://www.familytreenow.com/search/genealogy/results?phoneno=(555)555-5555", + "description": "People-search aggregator that can pivot from phone numbers to identity and relationship records.", + "status": "live", + "pricing": "freemium", + "bestFor": "Phone-to-person and household/relative pivoting", + "input": "Phone number", + "output": "Possible person records, addresses, and relationship links", + "opsec": "passive", + "opsecNote": "Search is platform-mediated and generally does not involve direct interaction with targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whitepages Reverse Phone", "type": "url", - "url": "https://www.whitepages.com/reverse-phone" + "url": "https://www.whitepages.com/reverse-phone", + "description": "Reverse phone lookup product from Whitepages for US-focused identity and contact attribution.", + "status": "live", + "pricing": "freemium", + "bestFor": "US reverse-phone attribution and address correlation", + "input": "Phone number (primarily US)", + "output": "Potential owner, location history, and related contact records", + "opsec": "passive", + "opsecNote": "Lookup occurs through a commercial data broker interface without direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hiya (R$)", "type": "url", - "url": "https://www.hiya.com/" + "url": "https://www.hiya.com/", + "description": "Caller-ID and spam-protection platform with reverse lookup capabilities and mobile integrations.", + "status": "live", + "pricing": "freemium", + "bestFor": "Spam classification and caller-ID enrichment on mobile workflows", + "input": "Phone number", + "output": "Caller identity signals, spam ratings, and reputation context", + "opsec": "passive", + "opsecNote": "Most checks are service-mediated; advanced features may still be account-tracked.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4112,6 +9087,260 @@ "type": "url", "url": "https://www.opengov-muenchen.de/" }, + { + "name": "Searchable FCC ID Database", + "type": "url", + "url": "https://fccid.io/" + } + ] + }, + { + "name": "Compliance & Risk Intelligence", + "type": "folder", + "children": [ + { + "name": "Sanctions Screening", + "type": "folder", + "children": [ + { + "name": "OpenSanctions", + "type": "url", + "url": "https://www.opensanctions.org/", + "description": "Aggregated database of sanctioned entities, politically exposed persons, and persons of criminal interest from 329 global data sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "Bulk sanctions and PEP screening across consolidated global watchlists", + "input": "Person or entity name", + "output": "Entity profiles with sanctions designations, PEP flags, and source metadata", + "opsec": "passive", + "opsecNote": "Passive lookups against a public database; API usage requires an account and is logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OFAC Sanctions List Search", + "type": "url", + "url": "https://sanctionssearch.ofac.treas.gov/", + "description": "Official U.S. Treasury tool for searching OFAC Specially Designated Nationals and related sanctions lists with approximate string matching.", + "status": "live", + "pricing": "free", + "bestFor": "Checking individuals or entities against U.S. sanctions programs", + "input": "Name, address, entity type, ID number, or sanctions program", + "output": "Matched records with name, sanctions program, list designation, and confidence score", + "opsec": "passive", + "opsecNote": "Public U.S. government search tool; queries are submitted to a federal server and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "EU Sanctions Tool (D)", + "type": "url", + "url": "https://sanctions-tool.ec.europa.eu", + "description": "European Commission tool for searching EU restrictive measures and consolidated sanctions lists targeting persons, entities, and bodies.", + "status": "degraded", + "pricing": "free", + "bestFor": "Checking individuals or entities against EU sanctions regimes", + "input": "Person or entity name", + "output": "Matches against EU consolidated sanctions list with designation details", + "opsec": "passive", + "opsecNote": "Public EU government search tool; queries are submitted to an EU server and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "dilisense", + "type": "url", + "url": "https://dilisense.com/en", + "description": "AML compliance platform that screens individuals and entities against sanctions, PEP, and watchlist data sources with fuzzy matching and confidence scoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Commercial AML/KYC sanctions screening and PEP checks", + "input": "Name, date of birth, citizenship, or other identifying information", + "output": "Match results with entity details, list sources, and confidence scores", + "opsec": "passive", + "opsecNote": "Queries sent to dilisense servers; registration required so searches are tied to an account.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "KYC / AML Tools", + "type": "folder", + "children": [ + { + "name": "NameScan", + "type": "url", + "url": "https://namescan.io", + "description": "Compliance screening platform providing sanctions checks, PEP screenings, and adverse media searches against global government databases with a free tier.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick free sanctions and PEP screening with adverse media checks", + "input": "Individual or business name", + "output": "Screening reports with sanctions matches, PEP flags, and adverse media hits", + "opsec": "passive", + "opsecNote": "Free scans available without registration; full access requires account creation.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OpenScreening", + "type": "url", + "url": "https://resources.linkurious.com/openscreening", + "description": "Free graph-based PEP and sanctions screening tool by Linkurious that visualizes connections across persons of interest using OpenSanctions and ICIJ data.", + "status": "live", + "pricing": "free", + "bestFor": "Visualizing connections between sanctioned entities, PEPs, and offshore structures", + "input": "Individual or organization name", + "output": "Interactive graph visualizations showing entity relationships and sanctions connections", + "opsec": "passive", + "opsecNote": "Web-based search against public datasets hosted by Linkurious; queries are sent to their servers.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Companies House (R)", + "type": "url", + "url": "https://find-and-update.company-information.service.gov.uk/", + "description": "Official UK government register for searching company information, officer appointments, and disqualified directors across all UK-registered companies.", + "status": "live", + "pricing": "free", + "bestFor": "Looking up UK company details, officers, and filing history", + "input": "Company name, company number, or officer name", + "output": "Company profiles, registered addresses, officer appointments, filing history, and document images", + "opsec": "passive", + "opsecNote": "Public UK government service; searches are passive lookups against an open register.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "Beneficial Ownership Lookup", + "type": "folder", + "children": [ + { + "name": "OpenOwnership", + "type": "url", + "url": "https://www.openownership.org/en/", + "description": "Global hub for beneficial ownership transparency, providing data standards and a register linking corporate ownership data across jurisdictions.", + "status": "live", + "pricing": "free", + "bestFor": "Investigating beneficial ownership of corporate entities across jurisdictions", + "input": "Company name, jurisdiction, or person name", + "output": "Beneficial ownership chains, corporate structures, and linked entities across registers", + "opsec": "passive", + "opsecNote": "Public web queries against open data; no notification to subjects.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ICIJ Offshore Leaks Database", + "type": "url", + "url": "https://offshoreleaks.icij.org/", + "description": "Searchable database of 800,000+ offshore entities from ICIJ investigations including Panama Papers, Paradise Papers, and Pandora Papers.", + "status": "live", + "pricing": "free", + "bestFor": "Tracing offshore company structures and hidden ownership from leaked documents", + "input": "Person name, company name, address, or jurisdiction", + "output": "Entity records, officer relationships, intermediary connections, and network graphs", + "opsec": "passive", + "opsecNote": "Public database queries; no notification to subjects. Bulk data also available for download.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "OCCRP Aleph (R)", + "type": "url", + "url": "https://aleph.occrp.org/", + "description": "Global archive of research material for investigative reporting, aggregating public records, court filings, company registries, and leaks from 200+ sources.", + "status": "live", + "pricing": "free", + "bestFor": "Cross-referencing persons and companies across public records, leaks, and investigative datasets", + "input": "Person name, company name, or document keywords", + "output": "Entity profiles, linked datasets, document matches, and relationship mappings", + "opsec": "passive", + "opsecNote": "Registration required for full access; queries are logged by OCCRP but subjects are not notified.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + }, + { + "name": "Public Records?", + "type": "url", + "url": "https://publicrecords.searchsystems.net/" + }, + { + "name": "The World Bank Open Data Catalog", + "type": "url", + "url": "https://datacatalog.worldbank.org/" + }, + { + "name": "BRB Public Records", + "type": "url", + "url": "https://www.brbpub.com/" + }, + { + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", + "type": "url", + "url": "https://www.govdata.de/" + }, + { + "name": "Open-Data-Portal M\u00fcnchen (German)", + "type": "url", + "url": "https://www.opengov-muenchen.de/" + }, { "name": "Searchable FCC ID Database", "type": "url", @@ -4122,9 +9351,64 @@ "type": "folder", "children": [ { - "name": "OpenSanctions", + "name": "PepChecker (R)", "type": "url", - "url": "https://www.opensanctions.org/" + "url": "https://pepchecker.com", + "description": "PEP and sanctions screening tool offering checks against comprehensive PEP lists and global sanctions databases with a free tier of limited searches.", + "status": "live", + "pricing": "freemium", + "bestFor": "Screening individuals against PEP lists and international sanctions databases", + "input": "Person name", + "output": "PEP match results, sanctions list matches, risk indicators, and political exposure details", + "opsec": "passive", + "opsecNote": "Web-based queries; registration required for workspace features. Subjects are not notified.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Ukraine PEP Register (D)", + "type": "url", + "url": "https://pep.org.ua/en/", + "description": "Formerly a database of Ukrainian politically exposed persons maintained by civil society. Now redirects to a static wartime advocacy page.", + "status": "down", + "pricing": "free", + "bestFor": "Previously used for checking Ukrainian politically exposed persons", + "input": "Person name (when operational)", + "output": "PEP profiles and political positions (when operational)", + "opsec": "passive", + "opsecNote": "Site is no longer functional; original database was a public web lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + { + "name": "EveryPolitician", + "type": "url", + "url": "https://everypolitician.org/", + "description": "Global database of political office-holders now operated as part of the OpenSanctions project, providing structured data on politicians and public officials worldwide.", + "status": "live", + "pricing": "free", + "bestFor": "Looking up current and former political office-holders globally for PEP screening", + "input": "Person name, country, or political position", + "output": "Politician profiles, positions held, party affiliations, and jurisdictional data", + "opsec": "passive", + "opsecNote": "Public database queries against open data; no notification to subjects.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -4141,22 +9425,82 @@ { "name": "AnnualReports.com", "type": "url", - "url": "https://www.annualreports.com/" + "url": "https://www.annualreports.com/", + "description": "Free directory of annual reports for thousands of public companies worldwide. Allows browsing and downloading official investor relations documents.", + "status": "live", + "pricing": "free", + "bestFor": "Locating and downloading public company annual reports", + "input": "Company name or ticker symbol", + "output": "Annual reports, sustainability reports, and proxy statements", + "opsec": "passive", + "opsecNote": "Searches are routed through AnnualReports.com servers; no direct contact with target company.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Public Register Online", "type": "url", - "url": "https://www.annualreportservice.com/" + "url": "https://www.annualreportservice.com/", + "description": "Online directory for accessing annual reports and financial documents from companies that participate in the service.", + "status": "live", + "pricing": "free", + "bestFor": "Requesting hard copy or digital annual reports from participating companies", + "input": "Company name", + "output": "Annual report listings with request or download links", + "opsec": "passive", + "opsecNote": "Lookup requests go through the service's servers; no direct contact with target company.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Public Register's Annual Report Service", "type": "url", - "url": "https://www.prars.com/search/alpha/A" + "url": "https://www.prars.com/search/alpha/A", + "description": "PRARS provides access to annual reports for thousands of publicly traded companies, organized alphabetically for browsing.", + "status": "live", + "pricing": "free", + "bestFor": "Browsing annual reports for US public companies alphabetically", + "input": "Company name (alphabetical browse)", + "output": "Annual reports and financial filings", + "opsec": "passive", + "opsecNote": "All requests pass through PRARS servers; no direct contact with target entity.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "International Registries", "type": "url", - "url": "https://www.gov.uk/government/publications/overseas-registries/overseas-registries" + "url": "https://www.gov.uk/government/publications/overseas-registries/overseas-registries", + "description": "UK government page listing official overseas company registries for countries worldwide, linking to each nation's official registration authority.", + "status": "live", + "pricing": "free", + "bestFor": "Finding official company registry links for foreign jurisdictions", + "input": "Country name (browsed from list)", + "output": "Links to official company registration authorities by country", + "opsec": "passive", + "opsecNote": "Static reference page on gov.uk; no target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4167,32 +9511,122 @@ { "name": "Commercial Register - Worldwide", "type": "url", - "url": "https://www.sg.ch/recht/handelsregister-notariate.html" + "url": "https://www.sg.ch/recht/handelsregister-notariate.html", + "description": "Canton of St. Gallen (Switzerland) official commercial register, providing a searchable database of businesses registered in the canton.", + "status": "live", + "pricing": "free", + "bestFor": "Searching Swiss corporate registry for businesses registered in St. Gallen", + "input": "Company name or registration number", + "output": "Business registration details, legal form, registered address", + "opsec": "passive", + "opsecNote": "Government registry query; no interaction with the target entity.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SEC.gov - EDGAR", "type": "url", - "url": "https://www.sec.gov/submit-filings" + "url": "https://www.sec.gov/submit-filings", + "description": "The SEC's Electronic Data Gathering, Analysis, and Retrieval system provides free public access to corporate filings including 10-K, 10-Q, 8-K, and proxy statements.", + "status": "live", + "pricing": "free", + "bestFor": "Researching US public company financials, ownership, and regulatory filings", + "input": "Company name, ticker symbol, or CIK number", + "output": "SEC filings including annual reports, quarterly reports, insider transactions, and prospectuses", + "opsec": "passive", + "opsecNote": "Government public database; searches do not interact with the target company.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "International White Pages", "type": "url", - "url": "https://www.wayp.com/" + "url": "https://www.wayp.com/", + "description": "WAYP.com is an international white pages and business directory aggregating contact listings from multiple countries.", + "status": "degraded", + "pricing": "free", + "bestFor": "International business and personal contact lookups by country", + "input": "Name, business name, or phone number", + "output": "Contact listings including address and phone data", + "opsec": "passive", + "opsecNote": "Lookup queries routed through WAYP servers; no direct contact with listed individuals.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "UK Companies", "type": "url", - "url": "https://www.gov.uk/get-information-about-a-company" + "url": "https://www.gov.uk/get-information-about-a-company", + "description": "Official UK government service providing free access to information about companies registered in England, Wales, Scotland, and Northern Ireland.", + "status": "live", + "pricing": "free", + "bestFor": "Looking up UK-registered company details, officers, and filing history", + "input": "Company name or registration number", + "output": "Registration details, officers, filing history, and charges", + "opsec": "passive", + "opsecNote": "Official government service; queries do not interact with the target company.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Global EDGE Resource Directory", "type": "url", - "url": "https://globaledge.msu.edu/global-resources" + "url": "https://globaledge.msu.edu/global-resources", + "description": "MSU GlobalEdge curated directory of international business resources, organized by topic including trade, investment, finance, and country data.", + "status": "live", + "pricing": "free", + "bestFor": "Finding international business intelligence resources and databases by topic", + "input": "Topic or resource category (browsed from directory)", + "output": "Curated links to international business data sources, reports, and tools", + "opsec": "passive", + "opsecNote": "Reference directory; no interaction with targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Finance", "type": "url", - "url": "https://www.google.com/finance/" + "url": "https://www.google.com/finance/", + "description": "Google's financial data platform providing stock quotes, financial statements, news, and company overviews for publicly traded companies.", + "status": "live", + "pricing": "free", + "bestFor": "Quick financial overview, stock data, and news for public companies", + "input": "Company name or stock ticker", + "output": "Stock price, financial summaries, news, and related companies", + "opsec": "passive", + "opsecNote": "All queries routed through Google; no direct interaction with target company.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4203,77 +9637,302 @@ { "name": "OpenCorporates", "type": "url", - "url": "https://opencorporates.com/" + "url": "https://opencorporates.com/", + "description": "The world's largest open database of companies, covering 200+ jurisdictions with over 200 million company records sourced directly from official registries.", + "status": "live", + "pricing": "freemium", + "bestFor": "Cross-jurisdictional company research and corporate network mapping", + "input": "Company name, registration number, or officer name", + "output": "Company registration details, officers, filings, and jurisdictional data", + "opsec": "passive", + "opsecNote": "All queries go through OpenCorporates servers; aggregates from public registries.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "AIHIT", "type": "url", - "url": "https://www.aihitdata.com/" + "url": "https://www.aihitdata.com/", + "description": "B2B company intelligence platform providing data on millions of businesses including executives, contact information, and company profiles.", + "status": "live", + "pricing": "freemium", + "bestFor": "Company executive discovery and B2B contact data enrichment", + "input": "Company name or domain", + "output": "Company profile, executive contacts, industry classification, and revenue estimates", + "opsec": "passive", + "opsecNote": "Queries routed through AIHIT servers; aggregates from web sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Plonked", "type": "url", - "url": "https://www.plonked.com/" + "url": "https://www.plonked.com/", + "description": "UK business directory service for locating companies and contact information.", + "status": "down", + "pricing": "free", + "bestFor": "UK business lookup by name or location", + "input": "Business name or location", + "output": "Business contact details and address", + "opsec": "passive", + "opsecNote": "Directory service; no direct contact with listed businesses.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Buzzfile", "type": "url", - "url": "https://www.buzzfile.com/Home/Basic" + "url": "https://www.buzzfile.com/Home/Basic", + "description": "US company database providing business profiles, SIC codes, employee counts, and contact information for millions of US businesses.", + "status": "live", + "pricing": "freemium", + "bestFor": "US business lookup by name, location, or industry classification", + "input": "Company name, location, or SIC code", + "output": "Business profiles with contacts, employee count, and revenue estimates", + "opsec": "passive", + "opsecNote": "Queries processed through Buzzfile servers; aggregates from public records.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "LittleSis", "type": "url", - "url": "https://littlesis.org/" + "url": "https://littlesis.org/", + "description": "Free database mapping relationships between powerful people and organizations, tracking political donors, lobbyists, board members, and corporate networks.", + "status": "live", + "pricing": "free", + "bestFor": "Mapping power relationships between corporations, politicians, and elites", + "input": "Person name, organization, or entity", + "output": "Relationship graphs, board memberships, political donations, and affiliations", + "opsec": "passive", + "opsecNote": "Queries processed through LittleSis servers; data sourced from public records.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Rusprofile", "type": "url", - "url": "https://www.rusprofile.ru/" + "url": "https://www.rusprofile.ru/", + "description": "Russian company registry and business intelligence platform providing information on Russian legal entities from official government sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "Researching Russian companies, directors, and legal entity registration", + "input": "Company name, INN (tax ID), or OGRN (registration number)", + "output": "Registration details, directors, financial data, and legal filings for Russian entities", + "opsec": "passive", + "opsecNote": "Queries routed through Rusprofile servers; aggregates from Russian government registries.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Companies House", "type": "url", - "url": "https://beta.companieshouse.gov.uk/" + "url": "https://beta.companieshouse.gov.uk/", + "description": "Official UK government company registry for England, Wales, Scotland, and Northern Ireland. Provides free access to company filings, officers, and registration details.", + "status": "live", + "pricing": "free", + "bestFor": "UK company registration details, directors, and filed accounts", + "input": "Company name, registration number, or officer name", + "output": "Company profile, registered officers, filing history, and charges", + "opsec": "passive", + "opsecNote": "Official government registry; queries do not interact with the target company.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Company Data Rex (EU)", "type": "url", - "url": "https://www.cdrex.com/" + "url": "https://www.cdrex.com/", + "description": "European company data aggregation platform providing business intelligence on EU-registered companies from multiple national registries.", + "status": "degraded", + "pricing": "freemium", + "bestFor": "Cross-border EU company research and registry data lookup", + "input": "Company name or registration number", + "output": "Company registration details, financial summaries, and officer information", + "opsec": "passive", + "opsecNote": "Queries processed through CDRex servers; aggregates from EU national registries.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Europages", "type": "url", - "url": "https://www.europages.co.uk:443/" + "url": "https://www.europages.co.uk:443/", + "description": "European B2B marketplace and company directory covering 3+ million companies across 26 countries with product and service listings.", + "status": "live", + "pricing": "free", + "bestFor": "Finding European suppliers, manufacturers, and B2B companies by industry", + "input": "Company name, product, or industry sector", + "output": "Company listings with contact information, products, and certifications", + "opsec": "passive", + "opsecNote": "All queries routed through Europages servers; no direct contact with listed companies.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Owler (R)", "type": "url", - "url": "https://www.owler.com/corp" + "url": "https://www.owler.com/corp", + "description": "Competitive intelligence platform providing company profiles, revenue estimates, employee counts, news alerts, and competitor tracking. Requires registration for full access.", + "status": "live", + "pricing": "freemium", + "bestFor": "Competitive intelligence and company profile research", + "input": "Company name or domain", + "output": "Revenue estimates, employee count, funding history, competitors, and news", + "opsec": "passive", + "opsecNote": "Queries processed through Owler servers; aggregates from public and crowdsourced data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Vault", "type": "url", - "url": "https://vault.com/" + "url": "https://vault.com/", + "description": "Career research platform providing company profiles, employee reviews, salary data, and industry guides for job seekers and researchers.", + "status": "live", + "pricing": "freemium", + "bestFor": "Company culture research, salary benchmarking, and employee sentiment analysis", + "input": "Company name or industry", + "output": "Company profiles, employee reviews, rankings, and salary data", + "opsec": "passive", + "opsecNote": "Queries processed through Vault servers; content sourced from employee submissions.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Companies In The UK", "type": "url", - "url": "https://www.companiesintheuk.co.uk/" + "url": "https://www.companiesintheuk.co.uk/", + "description": "UK company search engine aggregating information from Companies House, providing easy lookup of registered UK businesses.", + "status": "live", + "pricing": "free", + "bestFor": "Quick UK company lookup with simplified Companies House data", + "input": "Company name or registration number", + "output": "Company registration details, status, address, and SIC codes", + "opsec": "passive", + "opsecNote": "Queries processed through the service's servers using Companies House data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "UK Data", "type": "url", - "url": "https://ukdata.com/" + "url": "https://ukdata.com/", + "description": "UK company information and credit data service providing business intelligence on UK-registered companies.", + "status": "live", + "pricing": "freemium", + "bestFor": "UK company credit checks and financial health assessment", + "input": "Company name or registration number", + "output": "Company credit scores, financial summaries, directors, and registration details", + "opsec": "passive", + "opsecNote": "Queries processed through UK Data servers; aggregates from Companies House and financial sources.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Orbis Directory", "type": "url", - "url": "https://orbisdirectory.bvdinfo.com/version-2016121/OrbisDirectory/Companies" + "url": "https://orbisdirectory.bvdinfo.com/version-2016121/OrbisDirectory/Companies", + "description": "Bureau van Dijk's global company database covering 400+ million companies with standardized financial data, ownership structures, and M&A activity.", + "status": "live", + "pricing": "paid", + "bestFor": "Deep financial analysis and global ownership structure research", + "input": "Company name, registration number, or BvD ID", + "output": "Standardized financials, ownership chains, subsidiaries, and M&A data", + "opsec": "passive", + "opsecNote": "Queries processed through BvD servers; enterprise data product with institutional access.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Crunchbase", "type": "url", - "url": "https://www.crunchbase.com/#/home/index" + "url": "https://www.crunchbase.com/#/home/index", + "description": "Leading startup and investment intelligence platform tracking company funding rounds, acquisitions, investors, and executive profiles.", + "status": "live", + "pricing": "freemium", + "bestFor": "Startup funding research, investor mapping, and executive tracking", + "input": "Company name, person name, or investor name", + "output": "Funding history, investors, acquisitions, team profiles, and news", + "opsec": "passive", + "opsecNote": "Queries processed through Crunchbase servers; aggregates from public and submitted data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4284,27 +9943,102 @@ { "name": "RecruitEm", "type": "url", - "url": "https://recruitin.net/" + "url": "https://recruitin.net/", + "description": "Free X-Ray search tool for finding profiles on LinkedIn, GitHub, Twitter, and other platforms using Google's site: operator with customizable search parameters.", + "status": "live", + "pricing": "free", + "bestFor": "X-Ray searching LinkedIn and other platforms for employee and candidate profiles", + "input": "Job title, skills, location, and target platform", + "output": "Google search query and direct results links for profile discovery", + "opsec": "passive", + "opsecNote": "Generates Google dork queries; actual searches routed through Google.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "LinkedIn", "type": "url", - "url": "https://www.linkedin.com/" + "url": "https://www.linkedin.com/", + "description": "World's largest professional network with 900+ million members. Provides company pages, employee listings, and professional history data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Professional background research, employee enumeration, and corporate structure mapping", + "input": "Person name, company name, or job title", + "output": "Professional profiles, employment history, connections, company pages, and job listings", + "opsec": "active", + "opsecNote": "Profile views may be visible to the target; use private/restricted browsing mode to reduce visibility.", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Jobster", "type": "url", - "url": "https://jobster.com/" + "url": "https://jobster.com/", + "description": "Early job search and professional networking site that aggregated job listings and professional profiles.", + "status": "down", + "pricing": "free", + "bestFor": "Job listing and professional profile search (historical)", + "input": "Job title or person name", + "output": "Job listings and professional profiles", + "opsec": "passive", + "opsecNote": "Service is no longer operational.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "XING (R)", "type": "url", - "url": "https://www.xing.com/" + "url": "https://www.xing.com/", + "description": "European professional networking platform popular in German-speaking countries. Provides company profiles, employee listings, and career data. Requires registration to view profiles.", + "status": "live", + "pricing": "freemium", + "bestFor": "Professional background research for German and European contacts", + "input": "Person name or company name", + "output": "Professional profiles, employment history, company pages, and connections", + "opsec": "active", + "opsecNote": "Profile views may be visible to the target; use private browsing to reduce exposure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CVGadget", "type": "url", - "url": "https://cvgadget.com/" + "url": "https://cvgadget.com/", + "description": "CV and resume search tool using Google X-Ray techniques to find publicly posted resumes and CVs on the web.", + "status": "down", + "pricing": "free", + "bestFor": "Finding publicly posted resumes and CVs via Google X-Ray search", + "input": "Job title, skills, and location", + "output": "Google dork queries linking to publicly available CVs and resumes", + "opsec": "passive", + "opsecNote": "Generates Google dork queries; results routed through Google.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -4315,12 +10049,42 @@ { "name": "RBA - Business Information Resources", "type": "url", - "url": "https://www.rba.co.uk/sources/" + "url": "https://www.rba.co.uk/sources/", + "description": "Curated directory maintained by Researching Business Activities, linking to free and paid business information sources organized by category.", + "status": "live", + "pricing": "free", + "bestFor": "Finding specialized business intelligence resources and databases by topic", + "input": "Topic or category (browsed from directory)", + "output": "Annotated links to business data sources, news aggregators, and research tools", + "opsec": "passive", + "opsecNote": "Reference directory; no direct interaction with targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "VAT Number Validation", "type": "url", - "url": "https://ec.europa.eu/taxation_customs/vies/?locale=en" + "url": "https://ec.europa.eu/taxation_customs/vies/?locale=en", + "description": "EU VIES (VAT Information Exchange System) allows validation of VAT numbers for businesses registered in EU member states.", + "status": "live", + "pricing": "free", + "bestFor": "Validating EU VAT registration numbers and identifying registered businesses", + "input": "EU VAT number (country code + number)", + "output": "VAT registration validity, company name, and registered address", + "opsec": "passive", + "opsecNote": "Queries processed through the EU VIES system; no direct interaction with the target company.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -4337,47 +10101,182 @@ { "name": "MyAccident - traffic accident map", "type": "url", - "url": "https://myaccident.org/" + "url": "https://myaccident.org/", + "description": "Free database of redacted US traffic accident reports with searchable crash records and location details.", + "status": "live", + "pricing": "free", + "bestFor": "US accident history verification and claims investigations", + "input": "Accident location, address, or basic vehicle details", + "output": "Redacted accident reports, crash severity, and location data", + "opsec": "passive", + "opsecNote": "Read-only public database access; no direct contact with investigation targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NHTSA Vehicle API", "type": "url", - "url": "https://vpic.nhtsa.dot.gov/api/" + "url": "https://vpic.nhtsa.dot.gov/api/", + "description": "Official US government VIN decoder API with vehicle specification and manufacturer data for model years 1981 onward.", + "status": "live", + "pricing": "free", + "bestFor": "VIN decoding and US vehicle specification checks", + "input": "17-character VIN (full or partial with wildcards)", + "output": "Make, model, year, manufacturer, engine details, and related data", + "opsec": "passive", + "opsecNote": "Public government API endpoint with anonymous read access.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FindByPlate", "type": "url", - "url": "https://findbyplate.com/" + "url": "https://findbyplate.com/", + "description": "US license plate lookup service for basic vehicle identification and ownership-related investigation leads.", + "status": "live", + "pricing": "freemium", + "bestFor": "US license plate-based vehicle investigations", + "input": "US license plate number and state", + "output": "Vehicle make, model, year, and limited ownership hints", + "opsec": "passive", + "opsecNote": "Standard web lookup workflow without active interaction against the vehicle owner.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "carVertical VIN Decoder", "type": "url", - "url": "https://www.carvertical.com/vin-decoder" + "url": "https://www.carvertical.com/vin-decoder", + "description": "International VIN and registration decoder with vehicle history reporting across accident, theft, and ownership datasets.", + "status": "live", + "pricing": "paid", + "bestFor": "Cross-border vehicle history and ownership verification", + "input": "VIN or vehicle registration number", + "output": "Vehicle specs, accident history, theft records, and ownership changes", + "opsec": "passive", + "opsecNote": "Web-based lookup with paid reporting layers; no direct target interaction.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "autoDNA VIN Lookup", "type": "url", - "url": "https://www.autodna.com/" + "url": "https://www.autodna.com/", + "description": "Vehicle history lookup platform with records from European and North American markets and paid report expansion.", + "status": "live", + "pricing": "freemium", + "bestFor": "VIN-based damage, ownership, and service history checks", + "input": "17-character VIN", + "output": "Inspection, damage, repair, ownership, and mileage records", + "opsec": "passive", + "opsecNote": "Passive lookup model; full intelligence requires paid report access.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "VinDecodr", "type": "url", - "url": "https://vindecodr.com/" + "url": "https://vindecodr.com/", + "description": "Free VIN decoder for quick extraction of standard vehicle characteristics from 17-character VIN values.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid vehicle specification lookup from VIN values", + "input": "17-character VIN", + "output": "Vehicle make, model, year, engine, and recall-related details", + "opsec": "passive", + "opsecNote": "Simple public decoder workflow with no active probing against external systems.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AutoRef (EU)", "type": "url", - "url": "https://www.autoref.eu/en" + "url": "https://www.autoref.eu/en", + "description": "European VIN and plate intelligence service with free and paid tiers for technical vehicle profile data.", + "status": "live", + "pricing": "freemium", + "bestFor": "EU vehicle specification lookup and plate-to-VIN workflows", + "input": "European VIN or license plate number", + "output": "Vehicle make, model, engine, registration, and technical profile data", + "opsec": "passive", + "opsecNote": "Passive web queries with quota limits on the free tier.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Carnet.ai", "type": "url", - "url": "https://carnet.ai/" + "url": "https://carnet.ai/", + "description": "AI vehicle image recognition platform that identifies make/model/generation from submitted photos.", + "status": "live", + "pricing": "freemium", + "bestFor": "Vehicle identification from images in visual OSINT cases", + "input": "Vehicle image file or image URL", + "output": "Predicted make, model, generation year, and confidence score", + "opsec": "passive", + "opsecNote": "Image submission to hosted inference service without direct interaction with vehicle operators.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Finnik (NL)", "type": "url", - "url": "https://finnik.nl/en" + "url": "https://finnik.nl/en", + "description": "Dutch license plate intelligence service using official RDW-linked records for vehicle profile and APK history.", + "status": "live", + "pricing": "freemium", + "bestFor": "Netherlands plate investigations and inspection history checks", + "input": "Dutch license plate number", + "output": "Vehicle specs, APK timeline, and related ownership/tax data", + "opsec": "passive", + "opsecNote": "Uses public/government-linked datasets with user-initiated lookups.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4388,27 +10287,102 @@ { "name": "Flightradar24.com", "type": "url", - "url": "https://www.flightradar24.com/" + "url": "https://www.flightradar24.com/", + "description": "Global real-time flight tracking platform built on ADS-B and radar feeds with airport and route intelligence views.", + "status": "live", + "pricing": "freemium", + "bestFor": "Aircraft movement monitoring and flight status intelligence", + "input": "Flight number, aircraft registration, or airport code", + "output": "Real-time position, altitude, speed, routing, and departure/arrival status", + "opsec": "passive", + "opsecNote": "Passive monitoring of broadcast and aggregated flight telemetry.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "World Aeronautical Database", "type": "url", - "url": "https://worldaerodata.com/" + "url": "https://worldaerodata.com/", + "description": "Reference database for airport, airline, and aircraft metadata to support aviation intelligence lookups.", + "status": "live", + "pricing": "freemium", + "bestFor": "Aviation reference checks for airports, airlines, and aircraft", + "input": "Airport code, airline, aircraft type, or route context", + "output": "Airport details, airline profiles, and aircraft-related reference data", + "opsec": "passive", + "opsecNote": "Public aviation reference retrieval with no target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "ADS-B Exchange", "type": "url", - "url": "https://www.adsbexchange.com/" + "url": "https://www.adsbexchange.com/", + "description": "Large community-driven unfiltered ADS-B flight tracking network with broad global aircraft coverage.", + "status": "live", + "pricing": "freemium", + "bestFor": "Unfiltered aircraft tracking and historical flight pattern analysis", + "input": "Aircraft identifier, registration, hex code, or location", + "output": "Live aircraft position, altitude, speed, and historical track data", + "opsec": "passive", + "opsecNote": "Consumes broadcast telemetry from receiver networks without active interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "ADS-B.NL", "type": "url", - "url": "https://www.ads-b.nl/index.php?pageno=9999" + "url": "https://www.ads-b.nl/index.php?pageno=9999", + "description": "Netherlands-focused ADS-B tracking portal with emphasis on military and regional aviation movements.", + "status": "live", + "pricing": "free", + "bestFor": "European and military aircraft movement monitoring", + "input": "Aircraft registration, military callsign, or track query", + "output": "Flight traces, movement history, and aircraft classification context", + "opsec": "passive", + "opsecNote": "Aggregates publicly broadcast ADS-B data in a read-only interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenAIP World Aeronautical Database", "type": "url", - "url": "https://www.openaip.net/" + "url": "https://www.openaip.net/", + "description": "Open, community-maintained aeronautical dataset for airfields, airspace, navaids, and runway metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Airspace and airfield intelligence with reusable open data", + "input": "Airfield name, coordinates, or airspace criteria", + "output": "Runway, frequency, elevation, navaid, and airspace structure data", + "opsec": "passive", + "opsecNote": "Static open aviation data retrieval with no live target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4419,27 +10393,102 @@ { "name": "Vessel Tracker", "type": "url", - "url": "https://www.vesseltracker.com/" + "url": "https://www.vesseltracker.com/", + "description": "Commercial maritime tracking platform combining AIS and satellite feeds for global vessel movement intelligence.", + "status": "live", + "pricing": "paid", + "bestFor": "Maritime routing, vessel monitoring, and compliance investigations", + "input": "Vessel name, IMO, MMSI, or route context", + "output": "Live position, course, speed, destination, and vessel profile metadata", + "opsec": "passive", + "opsecNote": "Passive consumption of maritime broadcasts and aggregation feeds.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Ship AIS", "type": "url", - "url": "https://shipais.uk/" + "url": "https://shipais.uk/", + "description": "UK-centered AIS ship tracker with live map views, movement details, and vessel identification data.", + "status": "live", + "pricing": "free", + "bestFor": "UK maritime activity monitoring and vessel identification", + "input": "Vessel name, MMSI, or local waterway context", + "output": "Current position, movement track, vessel details, and nearby traffic", + "opsec": "passive", + "opsecNote": "Reads public AIS transmissions via community infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenSeaMap - The free nautical chart", "type": "url", - "url": "https://www.openseamap.org" + "url": "https://www.openseamap.org", + "description": "Open nautical chart map built on collaborative maritime data for ports, aids to navigation, and coastal context.", + "status": "live", + "pricing": "free", + "bestFor": "Nautical geolocation and maritime infrastructure mapping", + "input": "Coordinates, port name, or map area", + "output": "Nautical chart overlays, navigational aids, port/marina, and depth context", + "opsec": "passive", + "opsecNote": "Static map intelligence from crowd-sourced maritime geodata.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Vessel Finder", "type": "url", - "url": "https://www.vesselfinder.com/" + "url": "https://www.vesselfinder.com/", + "description": "Global AIS vessel tracking service for ship positions, voyage progress, and historical movement review.", + "status": "live", + "pricing": "freemium", + "bestFor": "Worldwide ship tracking and port-call timeline analysis", + "input": "Vessel name, IMO, MMSI, or geographic area", + "output": "Live vessel tracks, destination status, and historical route context", + "opsec": "passive", + "opsecNote": "Passive maritime telemetry consumption through aggregated AIS feeds.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Global Fishing Watch", "type": "url", - "url": "https://globalfishingwatch.org" + "url": "https://globalfishingwatch.org", + "description": "Nonprofit maritime transparency platform that maps global fishing activity from AIS/VMS-derived signals.", + "status": "live", + "pricing": "free", + "bestFor": "Illegal fishing detection and fisheries activity intelligence", + "input": "Vessel name/IMO, geography, and date range", + "output": "Fishing effort maps, vessel profiles, transshipment, and port visit patterns", + "opsec": "passive", + "opsecNote": "Aggregated environmental and vessel tracking data with read-only access.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4450,24 +10499,84 @@ { "name": "Deutsche Bahn Open-Data-Portal (German)", "type": "url", - "url": "https://data.deutschebahn.com/opendata" + "url": "https://data.deutschebahn.com/opendata", + "description": "German rail open-data portal for station, network, timetable, and real-time transportation datasets.", + "status": "live", + "pricing": "free", + "bestFor": "German rail infrastructure and schedule intelligence", + "input": "Station ID, route query, or timetable parameters", + "output": "Station metadata, track/network data, timetables, and service status", + "opsec": "passive", + "opsecNote": "Open government transport data consumption through public endpoints.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenRailwayMap", "type": "url", - "url": "https://www.openrailwaymap.org/" + "url": "https://www.openrailwaymap.org/", + "description": "OpenStreetMap-based global railway map visualizing rail lines, infrastructure characteristics, and operations context.", + "status": "live", + "pricing": "free", + "bestFor": "Rail infrastructure mapping and line characteristic analysis", + "input": "Map coordinates, region, or railway line context", + "output": "Track layouts, rail types, electrification, speed classes, and map overlays", + "opsec": "passive", + "opsecNote": "Crowd-sourced mapping interface with passive read-only usage.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "Satellite Tracking", "type": "url", - "url": "https://www.n2yo.com/" + "url": "https://www.n2yo.com/", + "description": "Satellite orbit tracking entry point for monitoring spacecraft position, trajectory, and pass predictions.", + "status": "live", + "pricing": "free", + "bestFor": "Space object and satellite movement monitoring", + "input": "Satellite name, NORAD ID, or orbital element query", + "output": "Orbital position, pass timing, altitude, and trajectory context", + "opsec": "passive", + "opsecNote": "Uses public orbital datasets and tracking visualizations without active targeting.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Track-Trace", "type": "url", - "url": "https://www.track-trace.com/" + "url": "https://www.track-trace.com/", + "description": "Multi-carrier shipment tracking aggregator for parcel and freight status across global postal and logistics providers.", + "status": "live", + "pricing": "free", + "bestFor": "Package tracking and supply-chain movement checks", + "input": "Tracking number and optional carrier selection", + "output": "Shipment milestones, current location, route progress, and delivery status", + "opsec": "passive", + "opsecNote": "Reads carrier-provided tracking records via public lookup interfaces.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4889,27 +10998,102 @@ { "name": "Searchcode", "type": "url", - "url": "https://searchcode.com/" + "url": "https://searchcode.com/", + "description": "Code search engine that indexes public source code from GitHub, GitLab, Bitbucket, and other repositories; useful for finding code examples and identifying technology usage patterns.", + "status": "live", + "pricing": "freemium", + "bestFor": "Source code snippet and function discovery across public repositories", + "input": "Code snippet, function name, or keyword", + "output": "Matching source code files with context and repository links", + "opsec": "passive", + "opsecNote": "Searches are routed through Searchcode's servers; no direct contact with target repositories.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "NerdyData", "type": "url", - "url": "https://www.nerdydata.com/reports/new" + "url": "https://www.nerdydata.com/reports/new", + "description": "Source code search engine for website technology reconnaissance that indexes HTML, CSS, and JavaScript across millions of live websites to identify technology and library usage.", + "status": "live", + "pricing": "freemium", + "bestFor": "Identifying websites using specific technologies, libraries, or code patterns", + "input": "Code snippet, library name, or technology string", + "output": "List of websites containing matching source code", + "opsec": "passive", + "opsecNote": "Searches NerdyData's pre-built index; no direct contact with target websites.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Gitrob (T)", "type": "url", - "url": "https://github.com/michenriksen/gitrob" + "url": "https://github.com/michenriksen/gitrob", + "description": "CLI tool for reconnaissance on GitHub organizations and users; clones repositories and scans commit history for sensitive files, exposed credentials, and configuration data.", + "status": "live", + "pricing": "free", + "bestFor": "GitHub organization reconnaissance for exposed secrets and sensitive files in commit history", + "input": "GitHub username or organization name", + "output": "List of potentially sensitive files and paths found across repositories", + "opsec": "active", + "opsecNote": "Directly queries the GitHub API and clones repositories; API activity is logged and may alert security monitoring.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Github-Dorks (T)", "type": "url", - "url": "https://github.com/techgaun/github-dorks" + "url": "https://github.com/techgaun/github-dorks", + "description": "Collection of GitHub advanced search operators and a CLI tool that automates searching GitHub for exposed credentials, API keys, configuration files, and other sensitive information.", + "status": "live", + "pricing": "free", + "bestFor": "Finding exposed credentials and sensitive files on GitHub via advanced search dorks", + "input": "Target username, organization, or domain", + "output": "GitHub search results matching dork patterns for sensitive data exposure", + "opsec": "active", + "opsecNote": "Queries the GitHub search API; activity is logged by GitHub and may trigger alerts for repository owners.", + "localInstall": true, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "GitLeaks", "type": "url", - "url": "https://github.com/gitleaks/gitleaks" + "url": "https://github.com/gitleaks/gitleaks", + "description": "Open-source SAST tool for detecting hardcoded secrets, API keys, passwords, and credentials in git repositories and file systems using customizable regex-based detection rules.", + "status": "live", + "pricing": "free", + "bestFor": "Scanning git repositories for hardcoded secrets, API keys, and leaked credentials", + "input": "Git repository path, remote URL, or file system path", + "output": "Report of detected secrets with file location, matched rule, commit hash, and line context", + "opsec": "active", + "opsecNote": "Remote scans require cloning the target repository; clone activity may be logged by the hosting platform.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4920,17 +11104,62 @@ { "name": "GlobalFile", "type": "url", - "url": "https://globalfilesearch.com/" + "url": "https://globalfilesearch.com/", + "description": "FTP file search engine that indexes publicly accessible FTP servers; allows searching for specific file types including images, videos, software, and archives.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering publicly accessible files on FTP servers by filename or file type", + "input": "Filename, file extension, or keyword", + "output": "List of matching files with FTP server addresses and paths", + "opsec": "passive", + "opsecNote": "Searches GlobalFile's pre-built index of FTP servers; no direct connection to target FTP servers.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FTP Google Dork (D)", "type": "url", - "url": "https://www.google.com/search?q=inurl%3Aftp+-inurl%3Ahttp+-inurl%3Ahttps+ftpsearchterm" + "url": "https://www.google.com/search?q=inurl%3Aftp+-inurl%3Ahttp+-inurl%3Ahttps+ftpsearchterm", + "description": "Google dork technique using inurl:ftp operators to discover publicly indexed FTP server directories and files through Google's web index.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering publicly indexed FTP server directories and files via Google dorking", + "input": "Search term appended to the dork URL", + "output": "Google search results showing indexed FTP server directories", + "opsec": "passive", + "opsecNote": "Searches are routed through Google; no direct contact with target FTP servers.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Napalm FTP", "type": "url", - "url": "https://www.searchftps.net/" + "url": "https://www.searchftps.net/", + "description": "FTP indexer and search engine with over 329 million files indexed across 1,200+ FTP servers; supports advanced filtering by file type, size, and server location.", + "status": "live", + "pricing": "free", + "bestFor": "Large-scale FTP file discovery across hundreds of indexed public servers", + "input": "Filename, file type, or keyword", + "output": "Matching files with FTP server address, path, file size, and date", + "opsec": "passive", + "opsecNote": "Searches Napalm FTP's index; no direct connection to target FTP servers during search.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4941,87 +11170,342 @@ { "name": "PubPeer", "type": "url", - "url": "https://pubpeer.com/" + "url": "https://pubpeer.com/", + "description": "Post-publication peer review platform where researchers comment on and flag issues with published scientific papers; useful for identifying retracted or problematic research.", + "status": "live", + "pricing": "free", + "bestFor": "Verifying scientific publication credibility and finding post-publication corrections or retractions", + "input": "DOI, paper title, or author name", + "output": "Peer comments, flags, and discussion threads attached to the publication", + "opsec": "passive", + "opsecNote": "Queries PubPeer's public database; searches are not disclosed to paper authors.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bielefeld Academic Search Engine", "type": "url", - "url": "https://www.base-search.net/Search/Advanced" + "url": "https://www.base-search.net/Search/Advanced", + "description": "Academic search engine indexing over 400 million documents from 12,000+ content providers including institutional repositories, open-access journals, and research databases worldwide.", + "status": "live", + "pricing": "free", + "bestFor": "Broad academic literature search across open-access and institutional repositories", + "input": "Author, title, keyword, DOI, or subject", + "output": "Academic papers, theses, and research documents with metadata and links", + "opsec": "passive", + "opsecNote": "Searches BASE's aggregated index; no direct contact with source institutions.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Scholar", "type": "url", - "url": "https://scholar.google.com/" + "url": "https://scholar.google.com/", + "description": "Multidisciplinary academic search engine indexing journal articles, theses, books, conference papers, and patents; includes citation counts and related work discovery.", + "status": "live", + "pricing": "free", + "bestFor": "Comprehensive academic literature discovery with citation tracking across all disciplines", + "input": "Author, paper title, keyword, or institution", + "output": "Academic publications with citation counts, links to full text, and related work", + "opsec": "passive", + "opsecNote": "Searches are logged by Google; results reflect Google's index with no direct contact to journals or authors.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PubMed - National Center for Biotechnology Information", "type": "url", - "url": "https://pubmed.ncbi.nlm.nih.gov/" + "url": "https://pubmed.ncbi.nlm.nih.gov/", + "description": "Free biomedical and life sciences literature database maintained by the NCBI with over 40 million citations; includes abstracts and links to full-text articles.", + "status": "live", + "pricing": "free", + "bestFor": "Biomedical, clinical, and life sciences literature research with high-quality metadata", + "input": "Author, MeSH term, keyword, PMID, or DOI", + "output": "Citation records with abstracts, MeSH terms, and links to full-text sources", + "opsec": "passive", + "opsecNote": "Searches are routed through NCBI servers; queries are subject to NCBI's usage policies.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Open Library", "type": "url", - "url": "https://openlibrary.org/" + "url": "https://openlibrary.org/", + "description": "Internet Archive's open catalog of over 3 million books with borrowable digital editions; provides bibliographic data and full-text access for many out-of-print titles.", + "status": "live", + "pricing": "free", + "bestFor": "Finding and borrowing digitized books, especially out-of-print or historical publications", + "input": "Title, author, ISBN, or subject", + "output": "Book records with metadata, cover images, and links to borrowable or readable editions", + "opsec": "passive", + "opsecNote": "Public searches require no account; borrowing requires free registration which logs activity.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "JURN", "type": "url", - "url": "https://www.jurn.org/" + "url": "https://www.jurn.org/", + "description": "Multidisciplinary search engine indexing freely accessible academic articles; covers arts, humanities, ecology, and social sciences with a focus on open-access content.", + "status": "live", + "pricing": "free", + "bestFor": "Open-access academic article discovery in arts, humanities, and social sciences", + "input": "Keyword, author, or subject", + "output": "Links to freely accessible academic articles across indexed journals", + "opsec": "passive", + "opsecNote": "Searches via JURN's Google Custom Search integration; queries are processed by Google.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "UK National Archives", "type": "url", - "url": "https://discovery.nationalarchives.gov.uk/" + "url": "https://discovery.nationalarchives.gov.uk/", + "description": "Official online catalog for the UK National Archives providing access to over 32 million records spanning 1,000 years of UK government, legal, and historical documents.", + "status": "live", + "pricing": "free", + "bestFor": "UK historical records, government documents, and legal archives research", + "input": "Person name, place, date, or record reference", + "output": "Archive catalog entries with descriptions, dates, and ordering information for physical or digital access", + "opsec": "passive", + "opsecNote": "Searches the public catalog; no account required for browsing though some documents require in-person access.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenGrey EU Papers", "type": "url", - "url": "https://opengrey.eu/" + "url": "https://opengrey.eu/", + "description": "Former European grey literature database maintained by INIST-CNRS that indexed non-conventional scientific and technical documents; archived in 2020 and no longer updated.", + "status": "live", + "pricing": "free", + "bestFor": "Historical European grey literature and non-conventional scientific documents (pre-2020)", + "input": "Keyword, author, or subject", + "output": "Grey literature records including reports, theses, and technical documents", + "opsec": "passive", + "opsecNote": "Static archive; no active data collection occurs during searches.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "US Gov Publishing Office - FDsys", "type": "url", - "url": "https://www.gpo.gov/fdsys/" + "url": "https://www.gpo.gov/fdsys/", + "description": "Legacy US Government Publishing Office document system (FDsys) that has been superseded by GovInfo (govinfo.gov); the URL now redirects to the modernized GovInfo platform.", + "status": "live", + "pricing": "free", + "bestFor": "US federal government publications, congressional records, and regulatory documents (use GovInfo instead)", + "input": "Document title, agency, or collection name", + "output": "US government publications in PDF, XML, and other formats", + "opsec": "passive", + "opsecNote": "Government-operated service; searches are logged per federal government policies.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "OpenDOAR", "type": "url", - "url": "https://www.opendoar.org/search.php" + "url": "https://www.opendoar.org/search.php", + "description": "Global directory of open-access repositories with over 6,000 academic repositories from 130+ countries; useful for locating institutional repositories and discipline-specific archives.", + "status": "live", + "pricing": "free", + "bestFor": "Finding open-access repositories by institution, country, or subject discipline", + "input": "Institution name, country, or subject area", + "output": "List of matching open-access repositories with metadata and direct links", + "opsec": "passive", + "opsecNote": "Searches OpenDOAR's directory; no direct contact with listed repositories.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Microsoft Academic", "type": "url", - "url": "https://academic.microsoft.com/" + "url": "https://academic.microsoft.com/", + "description": "Microsoft's academic search service indexing hundreds of millions of research papers; note that the original Microsoft Academic service was discontinued in December 2021 and this URL may redirect.", + "status": "live", + "pricing": "free", + "bestFor": "Academic paper discovery with author disambiguation and citation graph analysis", + "input": "Author, title, keyword, or institution", + "output": "Research paper records with metadata, citations, and author profiles", + "opsec": "passive", + "opsecNote": "Searches are processed by Microsoft servers; activity may be subject to Microsoft's privacy policy.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Science Direct", "type": "url", - "url": "https://www.sciencedirect.com/" + "url": "https://www.sciencedirect.com/", + "description": "Elsevier's platform for peer-reviewed scientific literature with access to over 2,900 journals and 30,000 e-books; freely searchable with full-text access requiring subscription or institutional access.", + "status": "live", + "pricing": "freemium", + "bestFor": "Scientific and technical literature search across Elsevier's extensive journal catalog", + "input": "Author, title, keyword, DOI, or journal name", + "output": "Article records with abstracts; full text requires subscription or per-article purchase", + "opsec": "passive", + "opsecNote": "Searches are logged by Elsevier; institutional access requires login which creates an activity record.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Think Tank Search", "type": "url", - "url": "https://guides.library.harvard.edu/hks/think_tank_search" + "url": "https://guides.library.harvard.edu/hks/think_tank_search", + "description": "Harvard Kennedy School Library guide for searching think tank research and policy reports; the referenced Think Tank Search service was deprecated in February 2025.", + "status": "live", + "pricing": "free", + "bestFor": "Policy research and think tank report discovery (see Policy Commons as current alternative)", + "input": "Topic, organization, or keyword", + "output": "Links to think tank research guides and policy report databases", + "opsec": "passive", + "opsecNote": "Accesses a public library guide page; no tracking beyond standard web server logs.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Library Databases", "type": "url", - "url": "https://guides.uflib.ufl.edu/az.php" + "url": "https://guides.uflib.ufl.edu/az.php", + "description": "University of Florida Library's A-Z database directory providing access to hundreds of academic databases covering all disciplines; useful as a reference for locating specialized research databases.", + "status": "live", + "pricing": "free", + "bestFor": "Identifying specialized academic databases by subject for deep literature research", + "input": "Subject area or database name", + "output": "List of academic databases with descriptions and access links", + "opsec": "passive", + "opsecNote": "Public library guide; no account required for browsing the directory.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Copyscape Plagiarism Checker", "type": "url", - "url": "https://www.copyscape.com/" + "url": "https://www.copyscape.com/", + "description": "Online plagiarism detection service that searches the web for copies of submitted text or URLs; useful for verifying content originality or tracing where text has been republished.", + "status": "live", + "pricing": "freemium", + "bestFor": "Detecting plagiarism and tracing where specific text or content has been copied or republished online", + "input": "URL or pasted text", + "output": "List of web pages containing matching or similar text with percentage match scores", + "opsec": "passive", + "opsecNote": "Searches are processed by Copyscape's servers; submitted text is sent to Copyscape for comparison.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Lazy Scholar (T)", "type": "url", - "url": "https://lazyscholar.org/" + "url": "https://lazyscholar.org/", + "description": "Browser extension that automatically finds free legal full-text versions of academic papers when viewing paywalled content; checks open-access repositories and PubMed Central.", + "status": "live", + "pricing": "free", + "bestFor": "Finding free full-text access to paywalled academic papers without institutional subscription", + "input": "Paywalled journal article URL or DOI (via browser extension)", + "output": "Links to free legal full-text versions of the paper from open-access sources", + "opsec": "passive", + "opsecNote": "Extension queries open-access databases in the background; no personal data sent to external servers.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Open Access Scholarly Journals", "type": "url", - "url": "https://www.pagepress.org/" + "url": "https://www.pagepress.org/", + "description": "PAGEPress open-access publisher hosting peer-reviewed journals across biomedical, natural, and social sciences; provides free access to published research articles.", + "status": "live", + "pricing": "free", + "bestFor": "Accessing open-access peer-reviewed research in biomedical and natural sciences", + "input": "Article title, author, or journal name", + "output": "Freely accessible full-text research articles in PDF and HTML formats", + "opsec": "passive", + "opsecNote": "Publicly accessible journal platform; no account required to read articles.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "The Open Syllabus Project", @@ -5169,27 +11653,102 @@ { "name": "pagodo - Passive Google Dork (T)", "type": "url", - "url": "https://github.com/opsdisk/pagodo" + "url": "https://github.com/opsdisk/pagodo", + "description": "Python CLI tool that automates passive Google dork searches using the Google Hacking Database (GHDB), supporting HTTP/SOCKS5 proxies to avoid rate-limiting.", + "status": "live", + "pricing": "free", + "bestFor": "Automated passive Google dork enumeration from GHDB", + "input": "GHDB dork categories, target domain", + "output": "Google search result URLs matching dork patterns", + "opsec": "passive", + "opsecNote": "Queries public Google search only; supports proxy configuration to reduce exposure. No direct target system contact.", + "localInstall": true, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Trends", "type": "url", - "url": "https://trends.google.com/trends/" + "url": "https://trends.google.com/trends/", + "description": "Google's free tool for analyzing search interest trends over time and by geography, providing anonymized and aggregated data.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking topic interest, comparing search terms, identifying trend patterns", + "input": "Search term or topic", + "output": "Trend graphs, regional interest data, related queries", + "opsec": "passive", + "opsecNote": "Queries Google's anonymized aggregated data; no personal data exposure and no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dorksearch.com", "type": "url", - "url": "https://www.dorksearch.com/" + "url": "https://www.dorksearch.com/", + "description": "Web-based Google dork builder and search tool that integrates with Shodan, Censys, and GitHub for comprehensive OSINT searches.", + "status": "live", + "pricing": "free", + "bestFor": "Building complex Google dorks with API cross-referencing", + "input": "Target domain, keywords, dork parameters", + "output": "Google search queries with optional Shodan/Censys/GitHub results", + "opsec": "passive", + "opsecNote": "Constructs and executes Google dork queries; API integrations may send queries to third-party services.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "dorkgenerator.pages.dev", "type": "url", - "url": "https://dorkgenerator.pages.dev/" + "url": "https://dorkgenerator.pages.dev/", + "description": "Online dork generator for creating custom Google search parameter queries to assist in OSINT and security research.", + "status": "live", + "pricing": "free", + "bestFor": "Quick generation of custom Google dork queries", + "input": "Target, search parameters, dork type", + "output": "Constructed Google dork search URL", + "opsec": "passive", + "opsecNote": "Generates query strings locally; executing the dork in Google is passive public search.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dorksearch.netlify.app", "type": "url", - "url": "https://dorksearch.netlify.app/" + "url": "https://dorksearch.netlify.app/", + "description": "Lightweight web interface for building and executing Google dork searches with minimal dependencies.", + "status": "live", + "pricing": "free", + "bestFor": "Fast, simple Google dork query generation", + "input": "Keywords and dork operators", + "output": "Google dork search URL", + "opsec": "passive", + "opsecNote": "Generates and redirects to Google search queries; passive public search only.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5200,17 +11759,62 @@ { "name": "Google Hacking Database", "type": "url", - "url": "https://www.exploit-db.com/google-hacking-database" + "url": "https://www.exploit-db.com/google-hacking-database", + "description": "Offensive Security's curated database of Google dork queries, organized by category, used for finding sensitive information exposed on the web.", + "status": "live", + "pricing": "free", + "bestFor": "Finding proven dork queries by category for security research", + "input": "Category or keyword search within GHDB", + "output": "Curated Google dork queries with descriptions", + "opsec": "passive", + "opsecNote": "Reference database only; executing dorks against Google is passive public search with no direct target contact.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Search Operators Guide", "type": "url", - "url": "https://www.googleguide.com/advanced_operators_reference.html" + "url": "https://www.googleguide.com/advanced_operators_reference.html", + "description": "Official Google documentation covering all supported search operators, syntax, and advanced search techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Reference for Google search operator syntax and capabilities", + "input": "N/A (reference document)", + "output": "Documentation on operators, syntax, and examples", + "opsec": "passive", + "opsecNote": "Static reference documentation; no data is submitted or queries executed.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Guide Cheat Sheet", "type": "url", - "url": "https://www.googleguide.com/help/calculator.html" + "url": "https://www.googleguide.com/help/calculator.html", + "description": "Quick-reference cheat sheet for Google search operators and advanced search syntax from Google Guide.", + "status": "live", + "pricing": "free", + "bestFor": "Quick lookup of Google search operator syntax", + "input": "N/A (reference document)", + "output": "Tabular reference of operators with examples", + "opsec": "passive", + "opsecNote": "Static reference page; no queries executed or data submitted.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -5227,12 +11831,42 @@ { "name": "Live Journal Seek", "type": "url", - "url": "https://ljseek.com/" + "url": "https://ljseek.com/", + "description": "Search tool for LiveJournal journals and communities across public entries that are indexed.", + "status": "live", + "pricing": "free", + "bestFor": "Finding public LiveJournal entries and historical community discussions", + "input": "Keywords and search terms", + "output": "Matching journal entries with author, date, and snippets", + "opsec": "passive", + "opsecNote": "Searches publicly indexed content and does not contact journal owners directly; queries are likely logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Blog Search Engine", "type": "url", - "url": "https://www.blogsearchengine.org/" + "url": "https://www.blogsearchengine.org/", + "description": "Blog-focused search engine for discovering blog posts, directories, and RSS-connected content.", + "status": "live", + "pricing": "free", + "bestFor": "Blog discovery and topic-focused blog post searching", + "input": "Keywords and blog topics", + "output": "Matching blog posts, listings, and feed-linked results", + "opsec": "passive", + "opsecNote": "Aggregates publicly indexed blog data without direct user contact to target blogs; queries are logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5243,17 +11877,62 @@ { "name": "Discord Bot List", "type": "url", - "url": "https://discord.bots.gg/" + "url": "https://discord.bots.gg/", + "description": "Searchable directory of Discord bots with listings, categories, and discovery metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Discord bot discovery and ecosystem mapping", + "input": "Bot names, keywords, and categories", + "output": "Bot profiles with descriptions, ratings, and invite metadata", + "opsec": "passive", + "opsecNote": "Enumerates publicly listed bots and does not require direct Discord account interaction for browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "ReconXplorer (T)", "type": "url", - "url": "https://github.com/root7am/ReconXplorer" + "url": "https://github.com/root7am/ReconXplorer", + "description": "Open-source reconnaissance toolkit with modules for IP, email, and Discord-focused lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-input OSINT checks from a local scriptable toolkit", + "input": "IP addresses, emails, Discord tokens, and host data", + "output": "Recon results including geolocation, service, and account-related metadata", + "opsec": "active", + "opsecNote": "Runs direct external queries from the operator environment and may trigger service-side detection or logging.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Top.gg", "type": "url", - "url": "https://top.gg/" + "url": "https://top.gg/", + "description": "Large Discord bot and app discovery platform with ranking, filtering, and listing data.", + "status": "live", + "pricing": "free", + "bestFor": "Discord bot ranking analysis and app discovery", + "input": "Bot names, tags, and search filters", + "output": "Bot listings with popularity, server counts, and profile details", + "opsec": "passive", + "opsecNote": "Uses public listing data and does not require direct target interaction for standard browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5264,27 +11943,102 @@ { "name": "BoardReader", "type": "url", - "url": "https://boardreader.com/" + "url": "https://boardreader.com/", + "description": "Forum search engine that indexes discussions across message boards and community platforms.", + "status": "live", + "pricing": "free", + "bestFor": "Finding forum threads and topic-centric discussion history", + "input": "Keywords, forum names, and topical queries", + "output": "Indexed posts and thread references with source links", + "opsec": "passive", + "opsecNote": "Searches indexed forum content and avoids direct interaction with target forum users.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Omgili", "type": "url", - "url": "https://webz.io/" + "url": "https://webz.io/", + "description": "Forum and discussion search capability operated through Webz.io infrastructure and data products.", + "status": "live", + "pricing": "freemium", + "bestFor": "Forum discussion discovery with optional API-driven workflows", + "input": "Keywords and Boolean-style forum queries", + "output": "Discussion posts and thread-level matching results", + "opsec": "passive", + "opsecNote": "Uses indexed discussion datasets from a third-party provider; user-side browsing is passive.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Craigslist Forums", "type": "url", - "url": "https://forums.craigslist.org/" + "url": "https://forums.craigslist.org/", + "description": "Craigslist-hosted forum system for public community discussions and region-oriented threads.", + "status": "live", + "pricing": "free", + "bestFor": "Reviewing Craigslist community discussions and regional forum activity", + "input": "Forum categories, keywords, and regional navigation", + "output": "Forum threads, post content, and timing context", + "opsec": "passive", + "opsecNote": "Reads publicly visible forum content and does not require direct messaging or contact with users.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Delphi Forum Search", "type": "url", - "url": "https://www.delphiforums.com/" + "url": "https://www.delphiforums.com/", + "description": "Forum platform with searchable user communities across niche interest categories.", + "status": "live", + "pricing": "freemium", + "bestFor": "Niche forum discovery and historical community thread review", + "input": "Forum names, categories, and keywords", + "output": "Forum listings, thread titles, and message pages", + "opsec": "passive", + "opsecNote": "Public forum browsing is passive; some communities may require registration for deeper access.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Groups Search", "type": "url", - "url": "https://groups.google.com/forum/#!overview" + "url": "https://groups.google.com/forum/#!overview", + "description": "Search interface for Google Groups and archived discussion content, including historical threads.", + "status": "live", + "pricing": "free", + "bestFor": "Researching archived mailing-list and discussion-group content", + "input": "Keywords, group names, authors, and date ranges", + "output": "Thread messages and group-level discussion results", + "opsec": "passive", + "opsecNote": "Searches archived public discussions through Google-hosted infrastructure where activity is logged.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5295,22 +12049,82 @@ { "name": "Mibbit", "type": "url", - "url": "https://search.mibbit.com/" + "url": "https://search.mibbit.com/", + "description": "Former web IRC client and channel search service that is no longer operational.", + "status": "down", + "pricing": "free", + "bestFor": "Legacy reference for historical IRC channel search workflows", + "input": "Channel or keyword queries (historical behavior)", + "output": "No current output; service is discontinued", + "opsec": "Unknown", + "opsecNote": "Service shut down on August 30, 2024 and cannot be relied on for active workflows.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "IRCP (T)", "type": "url", - "url": "https://github.com/internet-relay-chat/IRCP" + "url": "https://github.com/internet-relay-chat/IRCP", + "description": "Python-based IRC probing utility for scanning servers and collecting network/channel metadata.", + "status": "live", + "pricing": "free", + "bestFor": "IRC server enumeration and protocol-level reconnaissance", + "input": "Target ranges, IRC ports, and server parameters", + "output": "Server and channel metadata in machine-readable output", + "opsec": "active", + "opsecNote": "Actively connects to IRC services and may be detectable by network monitoring and server logs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ircsnapshot (T)", "type": "url", - "url": "https://github.com/bwall/ircsnapshot" + "url": "https://github.com/bwall/ircsnapshot", + "description": "IRC data collection tool that connects bots to servers for user and channel mapping.", + "status": "live", + "pricing": "free", + "bestFor": "IRC topology mapping and user/channel relationship analysis", + "input": "IRC server details, bot config, and channel targets", + "output": "Collected user, hostmask, and channel affiliation data", + "opsec": "active", + "opsecNote": "Requires active network participation via bot accounts and is likely visible to channel operators.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "netsplit.de", "type": "url", - "url": "https://netsplit.de/channels/search.php" + "url": "https://netsplit.de/channels/search.php", + "description": "IRC directory and search portal for channel listings, network stats, and discovery workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Passive IRC channel discovery and network trend checks", + "input": "Channel names, keywords, and network filters", + "output": "Channel listings with network and user-count context", + "opsec": "passive", + "opsecNote": "Uses aggregated indexed IRC data and does not require direct IRC server interaction for searches.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5321,17 +12135,62 @@ { "name": "Arctic Shift", "type": "url", - "url": "https://arctic-shift.photon-reddit.com/" + "url": "https://arctic-shift.photon-reddit.com/", + "description": "Search and access layer for Reddit datasets with tools for historical content retrieval and analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical Reddit dataset analysis and subreddit research", + "input": "Search terms, dataset queries, or API-style requests", + "output": "Matching Reddit posts, comments, and metadata from indexed datasets", + "opsec": "passive", + "opsecNote": "Works against archived or indexed data sources without requiring direct engagement with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cama's Reddit Search", "type": "url", - "url": "https://camas.github.io/reddit-search/" + "url": "https://camas.github.io/reddit-search/", + "description": "Web tool for searching Reddit posts and comments by author, subreddit, text, and time filters.", + "status": "live", + "pricing": "free", + "bestFor": "Reddit user and subreddit content discovery", + "input": "Usernames, subreddits, keywords, and date constraints", + "output": "Filtered post/comment search results with metadata", + "opsec": "passive", + "opsecNote": "Uses public data indexing paths; original GitHub hosting was discontinued but alternative hosting remains available.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reveddit", "type": "url", - "url": "https://www.reveddit.com/" + "url": "https://www.reveddit.com/", + "description": "Interface for viewing Reddit content removals using archived and moderation-related visibility signals.", + "status": "live", + "pricing": "free", + "bestFor": "Investigating deleted or removed Reddit discussions", + "input": "Reddit URLs, usernames, or subreddit paths", + "output": "Recovered or flagged removed-content views with moderation indicators", + "opsec": "passive", + "opsecNote": "Queries archive-backed sources and public content pathways without direct contact to target users.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -5899,7 +12758,7 @@ { "name": "Online OCR", "type": "url", - "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" + "url": "https://www.onlineocr.net/" }, { "name": "i2OCR", @@ -5910,11 +12769,6 @@ "name": "New OCR", "type": "url", "url": "https://www.newocr.com/" - }, - { - "name": "Online OCR", - "type": "url", - "url": "https://www.onlineocr.net/" } ] }, @@ -6168,17 +13022,62 @@ { "name": "Reddit Deep Web", "type": "url", - "url": "https://www.reddit.com/r/deepweb/" + "url": "https://www.reddit.com/r/deepweb/", + "description": "Subreddit focused on dark web discussions, beginner guidance, and community-sourced OSINT references.", + "status": "live", + "pricing": "free", + "bestFor": "Community discussion on dark web OSINT topics", + "input": "Posts, comments, and search queries", + "output": "Community-shared links, advice, and discussion threads", + "opsec": "passive", + "opsecNote": "Browsing is passive but account activity is logged by Reddit.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Reddit Onions", "type": "url", - "url": "https://www.reddit.com/r/onions/" + "url": "https://www.reddit.com/r/onions/", + "description": "Subreddit for .onion service discussion, availability reports, and tool recommendations.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking .onion ecosystem changes via community reports", + "input": "Posts, comments, and subreddit search terms", + "output": "User-reported onion links and operational status discussions", + "opsec": "passive", + "opsecNote": "Content consumption is passive; authenticated interactions are attributable to Reddit accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Reddit Darknet", "type": "url", - "url": "https://www.reddit.com/r/darknet/" + "url": "https://www.reddit.com/r/darknet/", + "description": "Community forum discussing darknet marketplaces, ecosystem events, and related threat activity.", + "status": "live", + "pricing": "free", + "bestFor": "Market ecosystem pulse and discussion-driven lead generation", + "input": "Posts, comments, and subreddit search terms", + "output": "Discussion intelligence, incident chatter, and directional leads", + "opsec": "passive", + "opsecNote": "Passive reading is low-risk, but participation creates account-linked activity trails.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6189,17 +13088,62 @@ { "name": "Tor Download (T)", "type": "url", - "url": "https://www.torproject.org/download/" + "url": "https://www.torproject.org/download/", + "description": "Official Tor Project distribution page for Tor Browser and related anonymity tooling.", + "status": "live", + "pricing": "free", + "bestFor": "Obtaining trusted Tor Browser binaries", + "input": "Platform selection and download request", + "output": "Official Tor Browser installer packages", + "opsec": "passive", + "opsecNote": "Download activity is visible to network observers unless additional transport protections are used.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Freenet Project (T)", "type": "url", - "url": "https://freenetproject.org/pages/download.html" + "url": "https://www.hyphanet.org/", + "description": "Hyphanet (formerly Freenet) is a decentralized, privacy-oriented network for anonymous publishing and file sharing.", + "status": "live", + "pricing": "free", + "bestFor": "Anonymous peer-to-peer content distribution", + "input": "Locally hosted or requested content within the network", + "output": "Distributed content retrieval and sharing", + "opsec": "passive", + "opsecNote": "Traffic is routed through a decentralized overlay, reducing direct source attribution.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "I2P Anonymous Network (T)", "type": "url", - "url": "https://geti2p.net/en/" + "url": "https://i2p.net/", + "description": "I2P is an anonymous overlay network supporting eepsites, messaging, and peer-to-peer services.", + "status": "live", + "pricing": "free", + "bestFor": "Accessing and hosting services inside the I2P anonymity network", + "input": "Local I2P router traffic and destination lookups", + "output": "Anonymized in-network service access", + "opsec": "passive", + "opsecNote": "Garlic routing and distributed peers obscure endpoint relationships.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6210,37 +13154,142 @@ { "name": "OnionScan", "type": "url", - "url": "https://github.com/s-rah/onionscan" + "url": "https://github.com/s-rah/onionscan", + "description": "Open-source scanner for .onion services that identifies metadata leaks and potential OPSEC weaknesses.", + "status": "live", + "pricing": "free", + "bestFor": "Assessing exposed metadata and weak configurations on hidden services", + "input": ".onion targets", + "output": "Scan findings and metadata leak indicators", + "opsec": "active", + "opsecNote": "Direct probing of hidden services can be logged and may alert target operators.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TorBot", "type": "url", - "url": "https://github.com/DedSecInside/TorBot" + "url": "https://github.com/DedSecInside/TorBot", + "description": "Python-based crawler for discovering and indexing .onion links and related metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Automated dark web crawling and onion link collection", + "input": "Seed onion links and crawl configuration", + "output": "Crawled onion pages, discovered links, and metadata", + "opsec": "active", + "opsecNote": "Crawling generates repeated target requests that can be detected by destination services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Tor Scan", "type": "url", - "url": "https://www.torscan.io/" + "url": "https://www.torscan.io/", + "description": "Legacy or ambiguous dark web scanning entry with unclear maintenance and uncertain distinction from OnionScan.", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy reference for Tor scanning workflows pending mapping cleanup", + "input": ".onion targets", + "output": "Potential scan intelligence when service is available", + "opsec": "active", + "opsecNote": "Any scan-style use is active probing and may expose investigator patterns.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Onioff", "type": "url", - "url": "https://github.com/k4m4/onioff" + "url": "https://github.com/k4m4/onioff", + "description": "Onion URL inspection utility for checking reachability and extracting metadata from hidden service links.", + "status": "live", + "pricing": "free", + "bestFor": "Quick inspection of onion links and service metadata", + "input": ".onion URLs", + "output": "Link metadata and availability information", + "opsec": "active", + "opsecNote": "Inspection requests contact target onion services through Tor and can be observed by targets.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunchly Hidden Services Report", "type": "url", - "url": "https://darkweb.hunch.ly/" + "url": "https://darkweb.hunch.ly/", + "description": "Daily feed of newly observed hidden services and associated monitoring data from Hunchly.", + "status": "live", + "pricing": "free", + "bestFor": "Monitoring new hidden-service discovery trends", + "input": "Feed queries and subscription requests", + "output": "Hidden service report data and update feeds", + "opsec": "passive", + "opsecNote": "Primarily consumes third-party aggregated reporting rather than probing targets directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "docker-onion-nmap (T)", "type": "url", - "url": "https://github.com/milesrichardson/docker-onion-nmap" + "url": "https://github.com/milesrichardson/docker-onion-nmap", + "description": "Dockerized nmap/proxychains workflow for enumerating exposed ports on onion services through Tor.", + "status": "degraded", + "pricing": "free", + "bestFor": "Containerized port enumeration of hidden services", + "input": ".onion hosts", + "output": "Network scan results and open-port findings", + "opsec": "active", + "opsecNote": "Port scanning is high-signal active probing and is likely visible to target operators.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Onion Investigator", "type": "url", - "url": "https://oint.ctrlbox.com/" + "url": "https://oint.ctrlbox.com/", + "description": "Ambiguous investigation entry with limited current validation and unclear relation to other onion analysis tools.", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy onion investigation reference pending mapping decision", + "input": "Unknown", + "output": "Unknown", + "opsec": "unknown", + "opsecNote": "Insufficient current evidence on operating model; treat as potentially active until clarified.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -6251,12 +13300,42 @@ { "name": "Onion Cab", "type": "url", - "url": "https://onion.cab/" + "url": "https://onion.cab/", + "description": "Dark web search/directory endpoint with intermittent reliability and limited contemporary documentation.", + "status": "degraded", + "pricing": "free", + "bestFor": "Supplemental onion discovery when primary search tools miss coverage", + "input": "Keywords and category browsing", + "output": "Directory-style onion link listings", + "opsec": "passive", + "opsecNote": "Directory browsing is generally passive, but gateway logging policies are often opaque.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Ahmia", "type": "url", - "url": "https://ahmia.fi/" + "url": "https://ahmia.fi/", + "description": "Well-known Tor search engine indexing onion services with clearnet accessibility for discovery workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Primary onion search and service discovery", + "input": "Search keywords", + "output": "Indexed onion search results", + "opsec": "passive", + "opsecNote": "Query activity is mediated by Ahmia rather than direct probing of each destination.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6267,19 +13346,64 @@ { "name": "Hidden Wiki", "type": "url", - "url": "https://thehiddenwiki.org/" + "url": "https://thehiddenwiki.org/", + "description": "Historically popular onion directory with variable trustworthiness, mirror churn, and high link rot.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference for onion directory structures", + "input": "Category browsing", + "output": "Curated onion link lists when accessible", + "opsec": "passive", + "opsecNote": "Directory browsing is passive, but listed links often carry high operational risk.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, { "name": "Web O Proxy", "type": "url", - "url": "https://weboproxy.com/" + "url": "https://weboproxy.com/", + "description": "Web-based onion proxy/gateway style entry with uncertain current reliability and attribution risk.", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy gateway access reference for onion destinations", + "input": ".onion URLs", + "output": "Gateway-mediated onion page access", + "opsec": "unknown", + "opsecNote": "Gateway models can expose user IP/activity to operators; treat as high-risk unless verified.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "IACA Dark Web Investigation Support", "type": "url", - "url": "https://iaca-darkweb-tools.com/" + "url": "https://iaca-darkweb-tools.com/", + "description": "International Anti Crime Academy dark web investigation support portal for federated search workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Federated dark web investigation support and discovery", + "input": "Keywords and investigative query terms", + "output": "Aggregated search intelligence", + "opsec": "passive", + "opsecNote": "Primarily query-mediated discovery; avoid entering sensitive operational indicators into shared portals.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6294,42 +13418,162 @@ { "name": "DeepFake-Detect", "type": "url", - "url": "https://github.com/aaronchong888/DeepFake-Detect" + "url": "https://github.com/dessa-oss/DeepFake-Detection", + "description": "Open-source deepfake detection project built with PyTorch and ResNet18 for classifying manipulated media.", + "status": "live", + "pricing": "free", + "bestFor": "Research-grade deepfake detection model experimentation", + "input": "Image or video files", + "output": "Real/fake classification scores", + "opsec": "passive", + "opsecNote": "Local/open-source workflow can run fully offline when self-hosted.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DeepFake-Image-Detection", "type": "url", - "url": "https://github.com/sky787770/DeepFake-Image-Detection" + "url": "https://github.com/rmkemker/DeepFake-Image-Detection", + "description": "Archived deepfake image detection repository previously used for forensic model experimentation.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference for legacy deepfake image detection approaches", + "input": "Image datasets", + "output": "Legacy model outputs and experiment artifacts", + "opsec": "passive", + "opsecNote": "Repository currently unavailable; no active service to query.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "DeepSafe", "type": "url", - "url": "https://github.com/siddharthksah/DeepSafe" + "url": "https://github.com/siddharthksah/DeepSafe", + "description": "Containerized deepfake detection suite combining multiple models with both web and extension interfaces.", + "status": "live", + "pricing": "free", + "bestFor": "Ensemble deepfake detection for image and video investigations", + "input": "Image and video files", + "output": "Detection verdicts with confidence metrics", + "opsec": "active", + "opsecNote": "Hosted mode uploads media externally; local Docker deployment reduces exposure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DeepfakeBench", "type": "url", - "url": "https://github.com/SCLBD/DeepfakeBench" + "url": "https://github.com/SCLBD/DeepfakeBench", + "description": "Benchmark framework for deepfake detection with multiple datasets and standardized evaluation pipelines.", + "status": "live", + "pricing": "free", + "bestFor": "Comparing deepfake detector performance across common benchmarks", + "input": "Deepfake datasets and benchmark configs", + "output": "Evaluation metrics such as AUC and model comparisons", + "opsec": "passive", + "opsecNote": "Research framework executed locally without required external submissions.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DeepfakeDetector", "type": "url", - "url": "https://github.com/TRahulsingh/DeepfakeDetector" + "url": "https://github.com/TRahulsingh/DeepfakeDetector", + "description": "Open-source deepfake detector with EfficientNet-based models and a web-facing analysis workflow.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid deepfake checks with optional self-hosted deployment", + "input": "Image/video files or media URLs", + "output": "Detection results with confidence scoring", + "opsec": "active", + "opsecNote": "Public web deployments may log submitted content; local hosting is safer for sensitive media.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FaceForensics++", "type": "url", - "url": "https://github.com/ondyari/FaceForensics" + "url": "https://www.faceforensics.com/", + "description": "Academic deepfake forensics dataset with manipulated video samples, masks, and aligned benchmarks.", + "status": "live", + "pricing": "free", + "bestFor": "Training and benchmarking deepfake detection models", + "input": "Registration request and dataset usage context", + "output": "Curated deepfake datasets with annotations and metadata", + "opsec": "passive", + "opsecNote": "Dataset access requires form submission but does not require uploading investigative targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "InVID-WeVerify Verification Plugin", "type": "url", - "url": "https://chromewebstore.google.com/detail/fake-news-debunker-by-inv/mhccpoafgdgbhnjfhkcmgknndkeenfhe" + "url": "https://www.invid-project.eu/tools-and-services/invid-verification-plugin/", + "description": "Journalist-focused browser plugin for media verification, reverse image search, metadata checks, and video keyframe analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Social media image/video verification workflows", + "input": "Web pages, social posts, images, and videos", + "output": "Verification artifacts, reverse-search pivots, and extracted media context", + "opsec": "active", + "opsecNote": "Extension-driven workflows query external platforms and search engines, creating third-party telemetry.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TruthScan Deepfake Detector", "type": "url", - "url": "https://truthscan.com/deepfake-detector" + "url": "https://truthscan.com/", + "description": "Cloud-based deepfake detection platform offering forensic analysis for manipulated video and audio.", + "status": "live", + "pricing": "freemium", + "bestFor": "Operational deepfake triage with enterprise-grade reporting", + "input": "Uploaded audio/video files", + "output": "Probability scores, forensic indicators, and analysis reports", + "opsec": "active", + "opsecNote": "Media must be uploaded to a third-party cloud platform for processing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6340,32 +13584,122 @@ { "name": "Duke Reporters' Lab", "type": "url", - "url": "https://reporterslab.org/fact-checking/" + "url": "https://reporterslab.org/", + "description": "Duke University journalism lab tracking global fact-checking initiatives, tools, and ecosystem trends.", + "status": "live", + "pricing": "free", + "bestFor": "Finding and benchmarking fact-checking organizations worldwide", + "input": "Research queries on fact-checking organizations and projects", + "output": "Directories, datasets, and reports on fact-checking initiatives", + "opsec": "passive", + "opsecNote": "Read-only research portal with standard website analytics.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hoaxy", "type": "url", - "url": "https://hoaxy.iuni.iu.edu/" + "url": "https://hoaxy.osome.iu.edu/", + "description": "Visualization platform for tracking how claims and fact-checking spread through social media networks.", + "status": "down", + "pricing": "free", + "bestFor": "Historical social diffusion analysis of misinformation and debunks", + "input": "Keywords, URLs, and social media topics", + "output": "Network graphs and timeline views of information spread", + "opsec": "active", + "opsecNote": "Service appears offline; historical design required querying social-platform data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "PolitiFact", "type": "url", - "url": "https://www.politifact.com/" + "url": "https://www.politifact.com/", + "description": "Fact-checking publication that rates political claims and documents supporting evidence.", + "status": "live", + "pricing": "free", + "bestFor": "Verifying political statements and tracing source-backed ratings", + "input": "Public claims from politicians and media figures", + "output": "Structured fact-check articles and truth ratings", + "opsec": "passive", + "opsecNote": "Public read-only use does not interact with targets directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SciCheck", "type": "url", - "url": "https://www.factcheck.org:443/scicheck/" + "url": "https://factcheck.org/scicheck/", + "description": "FactCheck.org section dedicated to scientific and health misinformation analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Validating scientific and medical claims in public discourse", + "input": "Scientific or health-related claims", + "output": "Evidence-backed explanatory fact-check articles", + "opsec": "passive", + "opsecNote": "Standard web consumption with no required interaction with investigated subjects.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Snopes", "type": "url", - "url": "https://www.snopes.com/" + "url": "https://www.snopes.com/", + "description": "Long-running debunking site covering rumors, hoaxes, and viral misinformation claims.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid validation of widely shared rumors and internet folklore", + "input": "Rumors, claims, memes, and circulating stories", + "output": "Investigative write-ups with verdicts and citation trails", + "opsec": "passive", + "opsecNote": "Public resource; user activity is limited to normal web browsing telemetry.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Stop Fake Tools", "type": "url", - "url": "https://www.stopfake.org/en/category/tools/" + "url": "http://www.stopfake.org/", + "description": "Ukrainian anti-disinformation initiative publishing fact-checks, analysis, and media literacy resources.", + "status": "live", + "pricing": "free", + "bestFor": "Investigating Ukraine-focused propaganda and disinformation narratives", + "input": "Claims, narratives, and media artifacts related to regional information operations", + "output": "Debunks, context analysis, and educational guidance", + "opsec": "passive", + "opsecNote": "Read-only consumption of published reporting and educational content.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6376,12 +13710,42 @@ { "name": "ImgOps", "type": "url", - "url": "https://imgops.com/" + "url": "https://imgops.com/", + "description": "Meta-search utility that routes an image to multiple reverse search and forensic services.", + "status": "live", + "pricing": "free", + "bestFor": "Fast multi-engine reverse image analysis from one entry point", + "input": "Image URL, uploaded file, or pasted image", + "output": "Pivot links and results across reverse-search and image-analysis engines", + "opsec": "active", + "opsecNote": "Routes images to third-party services, which may log content and request metadata.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TinEye Reverse Image Search", "type": "url", - "url": "https://tineye.com/" + "url": "https://tineye.com/", + "description": "Reverse image search engine that finds where an image appears online and identifies modified versions.", + "status": "live", + "pricing": "freemium", + "bestFor": "Tracing original publication and reuse of visual media", + "input": "Uploaded image or direct image URL", + "output": "Matched occurrences, oldest-known instances, and related variants", + "opsec": "active", + "opsecNote": "Image queries are processed on TinEye infrastructure and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6392,17 +13756,62 @@ { "name": "FotoForensics", "type": "url", - "url": "https://fotoforensics.com/" + "url": "https://fotoforensics.com/", + "description": "Image forensics platform with error level analysis and metadata-oriented integrity checks.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting likely image manipulation and compression artifacts", + "input": "Image upload or image URL", + "output": "Forensic visualizations and manipulation indicators", + "opsec": "active", + "opsecNote": "Uploaded files are processed by a third-party online service.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Verification Handbook", "type": "url", - "url": "https://verificationhandbook.com/" + "url": "https://verificationhandbook.com/", + "description": "Reference handbook for journalists covering verification methodologies for digital investigations.", + "status": "live", + "pricing": "free", + "bestFor": "Learning repeatable verification workflows for UGC and breaking news", + "input": "Verification learning needs and workflow questions", + "output": "Structured guidance, case studies, and checklists", + "opsec": "passive", + "opsecNote": "Static documentation site with no investigative target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Verification Junkie", "type": "url", - "url": "https://verificationjunkie.com/" + "url": "https://verificationjunkie.com/", + "description": "Curated directory of verification resources, tools, and training materials for journalists.", + "status": "degraded", + "pricing": "free", + "bestFor": "Discovering verification tools and practitioner-oriented references", + "input": "Category browsing and keyword searches", + "output": "Collections of linked tools and verification guidance", + "opsec": "passive", + "opsecNote": "Site has certificate issues; treat access as unstable and verify links before relying on them.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -6711,7 +14120,22 @@ { "name": "ClearImage Barcode Reader", "type": "url", - "url": "https://online-barcode-reader.inliteresearch.com/" + "url": "https://online-barcode-reader.inliteresearch.com/", + "description": "Web-based barcode and QR code recognition tool using Inlite Research ClearImage technology for common image and document formats.", + "status": "live", + "pricing": "free", + "bestFor": "Barcode and QR code decoding from uploaded files", + "input": "Image files and PDFs containing barcode or QR symbols", + "output": "Decoded barcode and QR payload values", + "opsec": "active", + "opsecNote": "Uploaded files are processed by a third-party web service and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6722,32 +14146,122 @@ { "name": "JS Beautifier", "type": "url", - "url": "https://beautifier.io/" + "url": "https://beautifier.io/", + "description": "Open-source JavaScript formatter that rewrites minified or obfuscated code into readable, consistently indented source.", + "status": "live", + "pricing": "free", + "bestFor": "Fast readability improvements for packed JavaScript", + "input": "Minified or obfuscated JavaScript source text", + "output": "Formatted JavaScript with normalized structure and spacing", + "opsec": "passive", + "opsecNote": "Typical use is low-risk code formatting through a public web interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "JS NICE", "type": "url", - "url": "https://jsnice.org/" + "url": "https://jsnice.org/", + "description": "Legacy JavaScript reverse-engineering service that previously improved variable names and recovered structure from minified code.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference for JavaScript decompilation workflows", + "input": "Obfuscated or minified JavaScript code", + "output": "No current output because the public service is unavailable", + "opsec": "Unknown", + "opsecNote": "Service is currently unreachable and should be treated as defunct until replaced.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Firebug (T)", "type": "url", - "url": "https://getfirebug.com/downloads/" + "url": "https://getfirebug.com/downloads/", + "description": "Former Firefox debugging extension that has been retired, with core functionality absorbed into modern Firefox Developer Tools.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical context for legacy JavaScript debugging references", + "input": "Legacy Firefox extension workflows and old debugging material", + "output": "Archived documentation and obsolete download artifacts", + "opsec": "Unknown", + "opsecNote": "Tool is unmaintained and not suitable for active investigative workflows.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "SpiderMonkey (T)", "type": "url", - "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey" + "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey", + "description": "Mozilla JavaScript engine used by Firefox and available for standalone execution and analysis in local environments.", + "status": "live", + "pricing": "free", + "bestFor": "Local JavaScript execution and behavior testing without browser UI", + "input": "JavaScript source code", + "output": "Execution results, runtime behavior, and script output", + "opsec": "passive", + "opsecNote": "Runs locally and avoids sending samples to third-party analysis services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kahu Revelo (T)", "type": "url", - "url": "https://www.kahusecurity.com/tools/" + "url": "https://www.kahusecurity.com/tools/", + "description": "Windows-focused JavaScript deobfuscation utility that executes scripts in a controlled environment to reveal hidden logic.", + "status": "live", + "pricing": "free", + "bestFor": "Unpacking heavily obfuscated JavaScript samples on Windows", + "input": "Obfuscated JavaScript files or script text", + "output": "Deobfuscated code and decoded runtime content", + "opsec": "active", + "opsecNote": "Tool executes suspect code paths, so sandbox or VM isolation is recommended.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "JavaScript Deobfuscator (T)", "type": "url", - "url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/" + "url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/", + "description": "Firefox add-on for inspecting and deobfuscating JavaScript in-browser during page analysis and script review.", + "status": "live", + "pricing": "free", + "bestFor": "Browser-native JavaScript deobfuscation during web investigations", + "input": "JavaScript loaded in Firefox pages or pasted script content", + "output": "Readable deobfuscated script output in browser tooling", + "opsec": "active", + "opsecNote": "Browser execution context can run page scripts and trackers while analyzing content.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6758,7 +14272,22 @@ { "name": "DDecode - PHP Decoder", "type": "url", - "url": "https://ddecode.com/phpdecoder/" + "url": "https://ddecode.com/phpdecoder/", + "description": "Online decoder for layered PHP obfuscation chains such as eval, base64, gzinflate, and related encoding wrappers.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid decoding of obfuscated PHP webshell and malware snippets", + "input": "Encoded or obfuscated PHP code", + "output": "Decoded and expanded PHP source text", + "opsec": "active", + "opsecNote": "Submitted samples are processed by a third-party server, so sensitive code should be sanitized first.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6773,17 +14302,62 @@ { "name": "XORSearch & XORStrings (T)", "type": "url", - "url": "https://blog.didierstevens.com/programs/xorsearch/" + "url": "https://blog.didierstevens.com/programs/xorsearch/", + "description": "Didier Stevens command-line utilities for locating XOR, ROL, ROT, and SHIFT-encoded strings in suspicious binaries.", + "status": "live", + "pricing": "free", + "bestFor": "String extraction and key hunting in encoded malware payloads", + "input": "Binary files and encoded byte streams", + "output": "Decoded candidate strings across transformation and key ranges", + "opsec": "passive", + "opsecNote": "Runs locally on analyst systems and does not require online submission.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "xortool (T)", "type": "url", - "url": "https://github.com/hellman/xortool" + "url": "https://github.com/hellman/xortool", + "description": "Python-based XOR analysis tool that estimates key lengths and recovers likely multi-byte keys via frequency analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Recovering repeating XOR keys from encoded files", + "input": "XOR-encrypted text or binary data", + "output": "Likely XOR keys and candidate decrypted output", + "opsec": "passive", + "opsecNote": "Pure local processing with no required external service calls.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "unxor (T)", "type": "url", - "url": "https://github.com/tomchop/unxor" + "url": "https://github.com/tomchop/unxor", + "description": "Known-plaintext XOR analysis utility for deriving keystreams and recovering original content from encoded samples.", + "status": "live", + "pricing": "free", + "bestFor": "Known-plaintext XOR cracking against malware and encoded artifacts", + "input": "XOR-encoded file plus known plaintext fragments", + "output": "Recovered keystream segments and decoded content", + "opsec": "passive", + "opsecNote": "Local command-line analysis avoids submitting artifacts to remote services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6794,7 +14368,22 @@ { "name": "Kahu Converter Utilities (T)", "type": "url", - "url": "https://www.kahusecurity.com/tools/" + "url": "https://www.kahusecurity.com/tools/", + "description": "Windows utility collection for format conversion, hex/binary transforms, and XOR-related decoding workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Mixed conversion and XOR utility operations on Windows", + "input": "Binary blobs, hex strings, and text samples", + "output": "Converted data and decoded intermediate representations", + "opsec": "passive", + "opsecNote": "Runs locally on analyst systems without mandatory cloud processing.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6805,22 +14394,82 @@ { "name": "iheartxor.py (T)", "type": "url", - "url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html" + "url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html", + "description": "Python script for brute-forcing XOR-obfuscated strings within defined boundaries to reveal hidden text in malware samples.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted extraction of XOR-obfuscated strings from binaries", + "input": "Binary data, dumps, or encoded string segments", + "output": "Recovered candidate strings and associated key bytes", + "opsec": "passive", + "opsecNote": "Offline local script execution keeps sample handling under analyst control.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "XORBruteForcer.py (T)", "type": "url", - "url": "https://eternal-todo.com/var/scripts/xorbruteforcer" + "url": "https://github.com/jesparza/scripts/blob/master/xorBruteForcer.py", + "description": "Single-byte XOR brute-force Python script that iterates candidate key values and surfaces matching decoded output.", + "status": "live", + "pricing": "free", + "bestFor": "Single-byte XOR key brute-forcing and quick validation", + "input": "Encoded file or byte sequence", + "output": "Decoded candidates mapped to tested XOR key values", + "opsec": "passive", + "opsecNote": "Local script analysis avoids artifact upload and minimizes external exposure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NoMoreXOR.py (T)", "type": "url", - "url": "https://github.com/hiddenillusion/NoMoreXOR" + "url": "https://github.com/hiddenillusion/NoMoreXOR", + "description": "Python utility for recovering long XOR keys using character frequency heuristics and YARA-assisted pattern matching.", + "status": "live", + "pricing": "free", + "bestFor": "Recovering long XOR keys in malware binaries", + "input": "Malware sample or obfuscated binary content", + "output": "Likely keys, decoded streams, and extraction hints", + "opsec": "passive", + "opsecNote": "Operates locally and is suitable for isolated malware analysis environments.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Balbuzard (T)", "type": "url", - "url": "https://bitbucket.org/decalage/balbuzard" + "url": "https://github.com/decalage2/balbuzard", + "description": "Python malware analysis toolkit that extracts indicators and brute-forces common obfuscation patterns including XOR and rotation transforms.", + "status": "live", + "pricing": "free", + "bestFor": "Automated deobfuscation and indicator extraction from suspicious files", + "input": "Suspicious binaries and encoded artifact files", + "output": "Decoded content, extracted IoCs, and pattern-analysis results", + "opsec": "passive", + "opsecNote": "Local toolkit execution supports controlled analysis without remote sample submission.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -6829,12 +14478,42 @@ { "name": "CyberChef", "type": "url", - "url": "https://gchq.github.io/CyberChef/" + "url": "https://gchq.github.io/CyberChef/", + "description": "GCHQ-maintained browser workbench for chained encoding, decoding, hashing, crypto, and data transformation operations.", + "status": "live", + "pricing": "free", + "bestFor": "Building and replaying multi-step decode and transform recipes", + "input": "Text, binary, hex, Base64, and structured payloads", + "output": "Transformed output for each selected operation chain", + "opsec": "passive", + "opsecNote": "Public web app use is convenient, but locally hosted builds are preferred for sensitive data.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Functions Online", "type": "url", - "url": "https://www.functions-online.com/" + "url": "https://www.functions-online.com/", + "description": "PHP-oriented online utility suite for common encoding, decoding, hashing, and string-manipulation function tests.", + "status": "live", + "pricing": "free", + "bestFor": "Quick PHP-specific encoding and decoding checks in browser", + "input": "Function parameters and data strings for selected PHP routines", + "output": "Computed function results and transformed data values", + "opsec": "active", + "opsecNote": "Data is processed server-side, so avoid submitting sensitive payloads directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -7701,7 +15380,22 @@ { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Maltiverse", @@ -8197,41 +15891,146 @@ { "name": "GeoGuesser", "type": "url", - "url": "https://www.geoguessr.com/" + "url": "https://www.geoguessr.com/", + "description": "Geography game for geolocation OSINT training; users observe visual clues in Street View panoramas to guess locations worldwide.", + "status": "live", + "pricing": "freemium", + "bestFor": "Geolocation skills, visual intelligence analysis, landmark identification", + "input": "Street View imagery, map interface", + "output": "Accuracy score, location guess feedback, player rankings", + "opsec": "passive", + "opsecNote": "No active reconnaissance; purely observational gameplay using public imagery.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Verif!cation Quiz Bot", "type": "url", - "url": "https://twitter.com/quiztime" + "url": "https://x.com/quiztime", + "description": "Daily OSINT verification challenges posted on X (Twitter), using a community-driven quiz format for image geolocation and source verification.", + "status": "live", + "pricing": "free", + "bestFor": "Community OSINT challenges, image verification techniques, collaborative research", + "input": "Shared images and verification questions from quizmasters", + "output": "Community discussion threads, solution walkthroughs, and learning outcomes", + "opsec": "passive", + "opsecNote": "No active probing; public community engagement via social replies.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "Forensic OSINT KB Guides", "type": "url", - "url": "https://www.forensicosint.com/osint-guide" + "url": "https://www.forensicosint.com/osint-guide", + "description": "Knowledge base of digital forensics guides for evidence capture and court-admissible documentation, including web capture and metadata analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Digital evidence preservation, chain-of-custody documentation, court-ready OSINT reporting", + "input": "Target URLs or digital media requiring forensic capture", + "output": "Timestamped artifacts, metadata analysis guidance, preserved evidence workflows", + "opsec": "passive", + "opsecNote": "Evidence collection focus; requires proper methodology for investigative and legal contexts.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Open Source Intelligence Techniques", "type": "url", - "url": "https://inteltechniques.com/" + "url": "https://inteltechniques.com/", + "description": "Professional OSINT training and certification by IntelTechniques with extensive video modules, documentation, and practical investigative exercises.", + "status": "live", + "pricing": "paid", + "bestFor": "Professional OSINT certification, structured curriculum, advanced investigative techniques", + "input": "Student participation in course modules, notes, and guided practical exercises", + "output": "Course completion, certification-track readiness, and advanced OSINT methodology", + "opsec": "passive", + "opsecNote": "Instructor-led educational platform focused on passive investigative methodology.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Plessas", "type": "url", - "url": "https://plessas.net/online-training" + "url": "https://plessas.net/online-training", + "description": "Expert-led OSINT training courses by Plessas Experts Network, from fundamentals to intensive hands-on investigation programs.", + "status": "live", + "pricing": "paid", + "bestFor": "Professional investigative training, corporate intelligence, legal and compliance investigations", + "input": "Structured coursework, practical OSINT exercises, and instructor interaction", + "output": "Course completion outcomes, investigative skill development, and training credentials", + "opsec": "passive", + "opsecNote": "Educational environment centered on passive research techniques.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "The OSINTion", "type": "url", - "url": "https://www.theosintion.com/courses" + "url": "https://www.theosintion.com/courses", + "description": "Affordable OSINT training courses by Joe Gray, including people OSINT, business investigations, and blockchain-focused instruction.", + "status": "live", + "pricing": "paid", + "bestFor": "Accessible OSINT courses, CTF-style learning, people and business intelligence workflows", + "input": "Live or remote class participation, practical exercises, and case-study analysis", + "output": "Completed coursework, practical investigative techniques, and reusable OSINT workflows", + "opsec": "passive", + "opsecNote": "Training-focused environment without active network probing requirements.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Smart Questions", "type": "url", - "url": "https://www.catb.org/esr/faqs/smart-questions.html" + "url": "https://www.catb.org/esr/faqs/smart-questions.html", + "description": "Foundational guide by Eric S. Raymond on asking effective technical questions in open-source and technical communities.", + "status": "live", + "pricing": "free", + "bestFor": "Research methodology, effective questioning, and stronger information-seeking habits", + "input": "Reader engagement with essay guidelines and practical examples", + "output": "Improved question framing, clearer research requests, and better community responses", + "opsec": "passive", + "opsecNote": "Pure methodology reference; no target interaction or probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } ] -} +} \ No newline at end of file