Enumerate accounts linked to an email using holehe. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Enumerate and verify platforms where a username is registered, using sherlock plus a WhatsMyName subset of modern/niche sites. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Broad username/identity discovery across 3,400+ sites via maigret (also extracts profile details). Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Check if an email appears in data breaches via HaveIBeenPwned. Requires HIBP_API_KEY env var. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Look up an email's public Gravatar profile: avatar, display name, bio, location, and linked/verified accounts. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Email reputation and footprint summary via EmailRep.io (profiles seen, breach/abuse flags). Requires EMAILREP_API_KEY. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Validate a Bitcoin or Ethereum address and return a keyless on-chain summary (balance, transactions, total received). Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Passive organisation/domain recon via theHarvester: emails, people, and subdomains from public sources (passive only, no active probing). Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Retrieve WHOIS registration data for a domain. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Retrieve geolocation and ASN data for an IP address via ipinfo.io. Omit 'ip' (or pass 'me') to auto-detect the caller's own public IP. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Risk-ranked IP exposure report (geolocation, ASN, reverse-DNS, DNS blocklists, VPN/Tor flags). Omit 'ip' (or pass 'me') to check the caller's own public IP. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Enumerate subdomains of a target domain using sublist3r. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Enumerate subdomains from certificate transparency logs via crt.sh. Keyless and purely passive (public CA logs), surfaces internal/staging hosts that never resolve publicly. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

List URLs archived under a domain in the Internet Archive (Wayback Machine) via the keyless CDX API. Passive; recovers deleted, forgotten, or historical pages. Pairs with scrape_url to fetch a recovered page. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Check an IP against the GreyNoise Community API: internet background noise (mass scanner) vs. potentially targeted actor. Returns classification, noise/RIOT flags, org, and last-seen. Community tier is 50 lookups/week, so use selectively. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Check whether an email or username appears in Hudson Rock's free Cavalier infostealer index (malware-stolen credentials). Reports exposure yes/no plus infection metadata (count, dates, OS, antivirus, malware file, affected-service counts). AUTHORIZED-USE ONLY: for your own or an authorized identifier's exposure so credentials can be rotated. Uses only the free masked tier; never returns passwords or login URLs. Keyless. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Generate targeted Google dork URLs for any target (name, email, username, domain). Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Search public paste sites for an email or username (HIBP paste index + search-engine dorking). Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Gather carrier and geolocation data for a phone number using phoneinfoga. Use E.164 format. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Query Shodan for host intelligence or banner search. IP address → host lookup (open ports, org, CVEs). Any other string → keyword/service search. Requires SHODAN_API_KEY env var. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Check IP, domain, URL, or file hash against VirusTotal's 70+ antivirus engines and threat intelligence. Auto-detects input type. Requires VIRUSTOTAL_API_KEY env var. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Search Censys for internet-facing infrastructure data. IP address → open ports, services, ASN, country. Domain → certificate history, SANs, issuer, first/last seen. Requires CENSYS_PAT (free plan = IP lookups; domain search is paid). Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Enhanced IP intelligence using IP2Location Security Plan. Returns geolocation, ISP, ASN, and detects VPN, proxy, Tor exit nodes, and datacenter hosting. Sponsored integration. Requires IP2LOCATION_API_KEY env var. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Check an IP address against the AbuseIPDB v2 API for abuse reputation. Returns abuse confidence score (0–100%), total reports, country, ISP, domain, and last reported timestamp. Shows a warning when score exceeds 50%. Requires ABUSEIPDB_API_KEY env var. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Search GitHub for a username, email, or keyword. For exact username matches: returns full profile, recent repos, and emails discovered from commit history. For other queries: top 5 matching accounts. With a GITHUB_TOKEN it also searches public code for secrets/keys tied to the target, reported as exposure (location and type only, never the value). Optional GITHUB_TOKEN env var raises rate limit from 60 to 5000 req/h. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Comprehensive DNS record enumeration (A, AAAA, MX, NS, TXT, CNAME, SOA). Highlights email security misconfigurations: missing SPF, weak SPF policy, missing or unenforced DMARC, and absent DKIM across common selectors. No external API or credentials required. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Extract embedded metadata (EXIF/IPTC/XMP) from a local file via exiftool, camera make/model, software, timestamps, author, and GPS coordinates. Flags embedded GPS location. Input is a local file path. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Execute Google dork queries for a target via the Bright Data SERP API, returning live structured results (title, URL, snippet). Runs up to 5 dorks by default, each is a billable API call. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_SERP_ZONE env vars. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Fetch any public URL through the Bright Data Web Unlocker API, bypassing Cloudflare, CAPTCHA, and bot-protection. Returns the page as clean Markdown. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE env vars. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Find a target's real public profiles by searching the web (entity-type-aware: email, username, domain, phone, full name). Returns structured results and Entity Correlation Graph nodes/edges. Works free via DuckDuckGo; uses Bright Data SERP (Google) automatically if configured. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.

Investigate multiple targets in parallel using the full OSINT tool chain. Each target gets its own report file. A summary report is also generated. Maximum 10 targets. Requires ANTHROPIC_API_KEY env var. Authorized use only: your own assets or a target you are authorized to assess. Passive, public-source collection.