{
  "enrichments": {
    "Threatexpert.com Malicious URLs": {
      "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.",
      "status": "down",
      "pricing": "free",
      "bestFor": "Malware URL intelligence",
      "input": "Domain or URL",
      "output": "Blocklist/Feed format",
      "opsec": "passive",
      "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": true
    },
    "Zeus C2 Tracker": {
      "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Zeus botnet C2 blocking",
      "input": "None (blocklist provider)",
      "output": "Domain/IP blocklist, Snort rules, Squid format",
      "opsec": "passive",
      "opsecNote": "Queries public Zeus tracker database; no active scanning",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "Malware Domains Blacklist": {
      "description": "Historical malware domains blocklist providing hosts file format malicious domain list.",
      "status": "down",
      "pricing": "free",
      "bestFor": "Malware domain blocking (legacy)",
      "input": "None (blocklist provider)",
      "output": "Hosts file format",
      "opsec": "passive",
      "opsecNote": "Legacy service; no longer maintained",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": true
    },
    "Email Domain Validation": {
      "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.",
      "status": "live",
      "pricing": "freemium",
      "bestFor": "Email domain and mailbox verification",
      "input": "Email domain or address",
      "output": "Domain validation report, MX records",
      "opsec": "active",
      "opsecNote": "Active mail server connectivity checks required for validation",
      "localInstall": false,
      "googleDork": false,
      "registration": true,
      "editUrl": false,
      "api": true,
      "invitationOnly": false,
      "deprecated": false
    },
    "Blackweb": {
      "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Squid proxy malware filtering",
      "input": "None (aggregated blocklist)",
      "output": "Squid-compatible blocklist format",
      "opsec": "passive",
      "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification",
      "localInstall": true,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "Critical Stack Intel (R)": {
      "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Network IDS threat intelligence",
      "input": "Bro/Zeek intel format",
      "output": "Intel.log entries, network alerts",
      "opsec": "passive",
      "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds",
      "localInstall": true,
      "googleDork": false,
      "registration": true,
      "editUrl": false,
      "api": true,
      "invitationOnly": false,
      "deprecated": false
    },
    "DNS Sinkhole": {
      "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.",
      "status": "degraded",
      "pricing": "free",
      "bestFor": "DNS-based malware blocking",
      "input": "DNS zone file",
      "output": "Malware domain sinkhole list",
      "opsec": "passive",
      "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "DNS-BH Malware Domain Blocklist": {
      "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.",
      "status": "down",
      "pricing": "free",
      "bestFor": "Malware domain blocking (legacy)",
      "input": "None (blocklist provider)",
      "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)",
      "opsec": "passive",
      "opsecNote": "Service sunset; merged into ShadowNet",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": true
    },
    "Malware Domain List": {
      "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Malware domain reputation queries",
      "input": "Domain name",
      "output": "Domain reputation report",
      "opsec": "passive",
      "opsecNote": "Queries curated malware domain database; passive lookup only",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "MalwareURL (R)": {
      "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.",
      "status": "live",
      "pricing": "freemium",
      "bestFor": "Malware URL reputation checking",
      "input": "URL",
      "output": "Reputation report, blocklist data",
      "opsec": "passive",
      "opsecNote": "Free lookup service available; commercial network integration available",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "scumware.org": {
      "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Malware and spyware domain research",
      "input": "Domain or URL",
      "output": "Domain reputation/blocklist data",
      "opsec": "passive",
      "opsecNote": "Community-maintained research database; passive lookup only",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "ZeuS Tracker": {
      "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Zeus botnet tracking and blocking",
      "input": "None (blocklist provider)",
      "output": "Domain blocklist, IP blocklist, Snort rules, Squid format",
      "opsec": "passive",
      "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "Shadowserver Foundation": {
      "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.",
      "status": "live",
      "pricing": "free",
      "bestFor": "IP/domain reputation and abuse intelligence",
      "input": "IP address or domain",
      "output": "Reputation reports, blocklists, abuse intelligence",
      "opsec": "passive",
      "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": true,
      "invitationOnly": false,
      "deprecated": false
    },
    "vURL Online": {
      "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.",
      "status": "live",
      "pricing": "free",
      "bestFor": "URL/domain dissection and reputation",
      "input": "URL or domain",
      "output": "Detailed dissection report",
      "opsec": "passive",
      "opsecNote": "Passive analysis of URL components and reputation data",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "AlienVault Open Threat Exchange": {
      "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Community threat intelligence sharing",
      "input": "Domain, IP, URL, file hash",
      "output": "Threat pulses, reputation data, indicators",
      "opsec": "passive",
      "opsecNote": "Community-sourced intelligence; free API access with registration",
      "localInstall": false,
      "googleDork": false,
      "registration": true,
      "editUrl": false,
      "api": true,
      "invitationOnly": false,
      "deprecated": false
    },
    "Web Inspector Online Scan": {
      "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Website malware scanning",
      "input": "Website URL",
      "output": "Malware scan report, vulnerability assessment",
      "opsec": "active",
      "opsecNote": "Active scanning required; connects to target website to analyze content",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "Google Safe Browsing API": {
      "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Malware and phishing URL detection",
      "input": "URL or domain",
      "output": "Safe/unsafe classification, threat type",
      "opsec": "passive",
      "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)",
      "localInstall": false,
      "googleDork": false,
      "registration": true,
      "editUrl": false,
      "api": true,
      "invitationOnly": false,
      "deprecated": false
    },
    "Cisco Talos": {
      "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.",
      "status": "live",
      "pricing": "free",
      "bestFor": "IP/domain reputation intelligence",
      "input": "IP address or domain",
      "output": "Reputation score, threat indicators, intelligence reports",
      "opsec": "passive",
      "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "DNS Twist (T)": {
      "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Typosquatting and phishing domain detection",
      "input": "Domain name",
      "output": "Domain permutation list, DNS records, HTTP similarity",
      "opsec": "active",
      "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)",
      "localInstall": true,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "URLCrazy (T)": {
      "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Typosquatting domain discovery",
      "input": "Domain name",
      "output": "Domain variant list, registration status",
      "opsec": "active",
      "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking",
      "localInstall": true,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "dnstwister": {
      "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.",
      "status": "live",
      "pricing": "freemium",
      "bestFor": "Typosquatting monitoring",
      "input": "Domain name",
      "output": "Domain variants, registration status, DNS records",
      "opsec": "active",
      "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "Catphish (T)": {
      "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Red team phishing domain generation",
      "input": "Target domain",
      "output": "Phishing domain variants, categorization status",
      "opsec": "active",
      "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies",
      "localInstall": true,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    },
    "BuiltWith": {
      "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.",
      "status": "live",
      "pricing": "freemium",
      "bestFor": "Web technology intelligence and competitive analysis",
      "input": "Website URL or domain",
      "output": "Technology stack report, lead generation data",
      "opsec": "passive",
      "opsecNote": "Public website analysis; passive technical reconnaissance",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": true,
      "invitationOnly": false,
      "deprecated": false
    },
    "SiteSleuth": {
      "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.",
      "status": "live",
      "pricing": "free",
      "bestFor": "Tracking code intelligence and related domain discovery",
      "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key",
      "output": "List of associated domains and tracking codes",
      "opsec": "passive",
      "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets",
      "localInstall": false,
      "googleDork": false,
      "registration": false,
      "editUrl": false,
      "api": false,
      "invitationOnly": false,
      "deprecated": false
    }
  }
}