mirror of
https://github.com/lockfale/OSINT-Framework.git
synced 2026-09-02 22:58:49 +02:00
s0lrayandPaperclip
0905218daa
Add comprehensive enrichment fields for the following 25 Domain Name tools: - Threatexpert.com Malicious URLs - Zeus C2 Tracker - Malware Domains Blacklist - Blackweb - Critical Stack Intel (R) - DNS Sinkhole - DNS-BH Malware Domain Blocklist - Malware Domain List - MalwareURL (R) - scumware.org - ZeuS Tracker - Shadowserver Foundation - Email Domain Validation - vURL Online - AlienVault Open Threat Exchange - Web Inspector Online Scan - Google Safe Browsing API - Cisco Talos - DNS Twist (T) - URLCrazy (T) - dnstwister - Catphish (T) - BuiltWith - SiteSleuth Populated fields for each tool: - description: 1-2 sentence summary - status: live/down/degraded - pricing: free/freemium/paid - bestFor: primary use-case - input/output: data format - opsec: passive/active/Unknown - opsecNote: OPSEC implications - Badges: localInstall, googleDork, registration, editUrl, api, invitationOnly, deprecated Co-Authored-By: Paperclip <noreply@paperclip.ing>
413 lines
16 KiB
JSON
413 lines
16 KiB
JSON
{
|
|
"enrichments": {
|
|
"Threatexpert.com Malicious URLs": {
|
|
"description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.",
|
|
"status": "down",
|
|
"pricing": "free",
|
|
"bestFor": "Malware URL intelligence",
|
|
"input": "Domain or URL",
|
|
"output": "Blocklist/Feed format",
|
|
"opsec": "passive",
|
|
"opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": true
|
|
},
|
|
"Zeus C2 Tracker": {
|
|
"description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Zeus botnet C2 blocking",
|
|
"input": "None (blocklist provider)",
|
|
"output": "Domain/IP blocklist, Snort rules, Squid format",
|
|
"opsec": "passive",
|
|
"opsecNote": "Queries public Zeus tracker database; no active scanning",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"Malware Domains Blacklist": {
|
|
"description": "Historical malware domains blocklist providing hosts file format malicious domain list.",
|
|
"status": "down",
|
|
"pricing": "free",
|
|
"bestFor": "Malware domain blocking (legacy)",
|
|
"input": "None (blocklist provider)",
|
|
"output": "Hosts file format",
|
|
"opsec": "passive",
|
|
"opsecNote": "Legacy service; no longer maintained",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": true
|
|
},
|
|
"Email Domain Validation": {
|
|
"description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.",
|
|
"status": "live",
|
|
"pricing": "freemium",
|
|
"bestFor": "Email domain and mailbox verification",
|
|
"input": "Email domain or address",
|
|
"output": "Domain validation report, MX records",
|
|
"opsec": "active",
|
|
"opsecNote": "Active mail server connectivity checks required for validation",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": true,
|
|
"editUrl": false,
|
|
"api": true,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"Blackweb": {
|
|
"description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Squid proxy malware filtering",
|
|
"input": "None (aggregated blocklist)",
|
|
"output": "Squid-compatible blocklist format",
|
|
"opsec": "passive",
|
|
"opsecNote": "Aggregates existing public blacklist sources; requires DNS verification",
|
|
"localInstall": true,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"Critical Stack Intel (R)": {
|
|
"description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Network IDS threat intelligence",
|
|
"input": "Bro/Zeek intel format",
|
|
"output": "Intel.log entries, network alerts",
|
|
"opsec": "passive",
|
|
"opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds",
|
|
"localInstall": true,
|
|
"googleDork": false,
|
|
"registration": true,
|
|
"editUrl": false,
|
|
"api": true,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"DNS Sinkhole": {
|
|
"description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.",
|
|
"status": "degraded",
|
|
"pricing": "free",
|
|
"bestFor": "DNS-based malware blocking",
|
|
"input": "DNS zone file",
|
|
"output": "Malware domain sinkhole list",
|
|
"opsec": "passive",
|
|
"opsecNote": "Public malware database; Cloudflare CAPTCHA protection added",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"DNS-BH Malware Domain Blocklist": {
|
|
"description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.",
|
|
"status": "down",
|
|
"pricing": "free",
|
|
"bestFor": "Malware domain blocking (legacy)",
|
|
"input": "None (blocklist provider)",
|
|
"output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)",
|
|
"opsec": "passive",
|
|
"opsecNote": "Service sunset; merged into ShadowNet",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": true
|
|
},
|
|
"Malware Domain List": {
|
|
"description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Malware domain reputation queries",
|
|
"input": "Domain name",
|
|
"output": "Domain reputation report",
|
|
"opsec": "passive",
|
|
"opsecNote": "Queries curated malware domain database; passive lookup only",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"MalwareURL (R)": {
|
|
"description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.",
|
|
"status": "live",
|
|
"pricing": "freemium",
|
|
"bestFor": "Malware URL reputation checking",
|
|
"input": "URL",
|
|
"output": "Reputation report, blocklist data",
|
|
"opsec": "passive",
|
|
"opsecNote": "Free lookup service available; commercial network integration available",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"scumware.org": {
|
|
"description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Malware and spyware domain research",
|
|
"input": "Domain or URL",
|
|
"output": "Domain reputation/blocklist data",
|
|
"opsec": "passive",
|
|
"opsecNote": "Community-maintained research database; passive lookup only",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"ZeuS Tracker": {
|
|
"description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Zeus botnet tracking and blocking",
|
|
"input": "None (blocklist provider)",
|
|
"output": "Domain blocklist, IP blocklist, Snort rules, Squid format",
|
|
"opsec": "passive",
|
|
"opsecNote": "Public tracker; passive monitoring of Zeus C2 activity",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"Shadowserver Foundation": {
|
|
"description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "IP/domain reputation and abuse intelligence",
|
|
"input": "IP address or domain",
|
|
"output": "Reputation reports, blocklists, abuse intelligence",
|
|
"opsec": "passive",
|
|
"opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": true,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"vURL Online": {
|
|
"description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "URL/domain dissection and reputation",
|
|
"input": "URL or domain",
|
|
"output": "Detailed dissection report",
|
|
"opsec": "passive",
|
|
"opsecNote": "Passive analysis of URL components and reputation data",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"AlienVault Open Threat Exchange": {
|
|
"description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Community threat intelligence sharing",
|
|
"input": "Domain, IP, URL, file hash",
|
|
"output": "Threat pulses, reputation data, indicators",
|
|
"opsec": "passive",
|
|
"opsecNote": "Community-sourced intelligence; free API access with registration",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": true,
|
|
"editUrl": false,
|
|
"api": true,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"Web Inspector Online Scan": {
|
|
"description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Website malware scanning",
|
|
"input": "Website URL",
|
|
"output": "Malware scan report, vulnerability assessment",
|
|
"opsec": "active",
|
|
"opsecNote": "Active scanning required; connects to target website to analyze content",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"Google Safe Browsing API": {
|
|
"description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Malware and phishing URL detection",
|
|
"input": "URL or domain",
|
|
"output": "Safe/unsafe classification, threat type",
|
|
"opsec": "passive",
|
|
"opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": true,
|
|
"editUrl": false,
|
|
"api": true,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"Cisco Talos": {
|
|
"description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "IP/domain reputation intelligence",
|
|
"input": "IP address or domain",
|
|
"output": "Reputation score, threat indicators, intelligence reports",
|
|
"opsec": "passive",
|
|
"opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"DNS Twist (T)": {
|
|
"description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Typosquatting and phishing domain detection",
|
|
"input": "Domain name",
|
|
"output": "Domain permutation list, DNS records, HTTP similarity",
|
|
"opsec": "active",
|
|
"opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)",
|
|
"localInstall": true,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"URLCrazy (T)": {
|
|
"description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Typosquatting domain discovery",
|
|
"input": "Domain name",
|
|
"output": "Domain variant list, registration status",
|
|
"opsec": "active",
|
|
"opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking",
|
|
"localInstall": true,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"dnstwister": {
|
|
"description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.",
|
|
"status": "live",
|
|
"pricing": "freemium",
|
|
"bestFor": "Typosquatting monitoring",
|
|
"input": "Domain name",
|
|
"output": "Domain variants, registration status, DNS records",
|
|
"opsec": "active",
|
|
"opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"Catphish (T)": {
|
|
"description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Red team phishing domain generation",
|
|
"input": "Target domain",
|
|
"output": "Phishing domain variants, categorization status",
|
|
"opsec": "active",
|
|
"opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies",
|
|
"localInstall": true,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"BuiltWith": {
|
|
"description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.",
|
|
"status": "live",
|
|
"pricing": "freemium",
|
|
"bestFor": "Web technology intelligence and competitive analysis",
|
|
"input": "Website URL or domain",
|
|
"output": "Technology stack report, lead generation data",
|
|
"opsec": "passive",
|
|
"opsecNote": "Public website analysis; passive technical reconnaissance",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": true,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
},
|
|
"SiteSleuth": {
|
|
"description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.",
|
|
"status": "live",
|
|
"pricing": "free",
|
|
"bestFor": "Tracking code intelligence and related domain discovery",
|
|
"input": "Domain, Google Analytics ID, AdSense ID, or Stripe key",
|
|
"output": "List of associated domains and tracking codes",
|
|
"opsec": "passive",
|
|
"opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets",
|
|
"localInstall": false,
|
|
"googleDork": false,
|
|
"registration": false,
|
|
"editUrl": false,
|
|
"api": false,
|
|
"invitationOnly": false,
|
|
"deprecated": false
|
|
}
|
|
}
|
|
}
|