| AbstractAPI | Look up domain, phone and IP address information from AbstractAPI. |
| abuse.ch | Check if a host/domain, IP address or netblock is malicious according to Abuse.ch. |
| AbuseIPDB | Check if an IP address is malicious according to AbuseIPDB.com blacklist. |
| Abusix Mail Intelligence | Check if a netblock or IP address is in the Abusix Mail Intelligence blacklist. |
| Account Finder | Look for possible associated accounts on nearly 200 websites like Ebay, Slashdot, reddit, etc. |
| AdBlock Check | Check if linked pages would be blocked by AdBlock Plus. |
| AdGuard DNS | Check if a host would be blocked by AdGuard DNS. |
| Ahmia | Search Tor 'Ahmia' search engine for mentions of the target. |
| AlienVault IP Reputation | Check if an IP or netblock is malicious according to the AlienVault IP Reputation database. |
| AlienVault OTX | Obtain information from AlienVault Open Threat Exchange (OTX) |
| Amazon S3 Bucket Finder | Search for potential Amazon S3 buckets associated with the target and attempt to list their contents. |
| Apple iTunes | Search Apple iTunes for mobile apps. |
| Archive.org | Identifies historic versions of interesting files/pages from the Wayback Machine. |
| ARIN | Queries ARIN registry for contact information. |
| Azure Blob Finder | Search for potential Azure blobs associated with the target and attempt to list their contents. |
| Bad Packets | Obtain information about any malicious activities involving IP addresses found |
| Base64 Decoder | Identify Base64-encoded strings in URLs, often revealing interesting hidden information. |
| BGPView | Obtain network information from BGPView API. |
| Binary String Extractor | Attempt to identify strings in binary content. |
| BinaryEdge | Obtain information from BinaryEdge.io Internet scanning systems, including breaches, vulnerabilities, torrents and passive DNS. |
| Bing | Obtain information from bing to identify sub-domains and links. |
| Bing (Shared IPs) | Search Bing for hosts sharing the same IP. |
| Bitcoin Finder | Identify bitcoin addresses in scraped webpages. |
| Bitcoin Who's Who | Check for Bitcoin addresses against the Bitcoin Who's Who database of suspect/malicious addresses. |
| BitcoinAbuse | Check Bitcoin addresses against the bitcoinabuse.com database of suspect/malicious addresses. |
| Blockchain | Queries blockchain.info to find the balance of identified bitcoin wallet addresses. |
| blocklist.de | Check if a netblock or IP is malicious according to blocklist.de. |
| BotScout | Searches BotScout.com's database of spam-bot IP addresses and e-mail addresses. |
| botvrij.eu | Check if a domain is malicious according to botvrij.eu. |
| BuiltWith | Query BuiltWith.com's Domain API for information about your target's web technology stack, e-mail addresses and more. |
| C99 | Queries the C99 API which offers various data (geo location, proxy detection, phone lookup, etc). |
| CallerName | Lookup US phone number location and reputation information. |
| Censys | Obtain host information from Censys.io. |
| Certificate Transparency | Gather hostnames from historical certificates in crt.sh. |
| CertSpotter | Gather information about SSL certificates from SSLMate CertSpotter API. |
| CINS Army List | Check if a netblock or IP address is malicious according to Collective Intelligence Network Security (CINS) Army list. |
| CIRCL.LU | Obtain information from CIRCL.LU's Passive DNS and Passive SSL databases. |
| CleanBrowsing.org | Check if a host would be blocked by CleanBrowsing.org DNS content filters. |
| CleanTalk Spam List | Check if a netblock or IP address is on CleanTalk.org's spam IP list. |
| Clearbit | Check for names, addresses, domains and more based on lookups of e-mail addresses on clearbit.com. |
| CloudFlare DNS | Check if a host would be blocked by CloudFlare DNS. |
| CoinBlocker Lists | Check if a domain appears on CoinBlocker lists. |
| CommonCrawl | Searches for URLs found through CommonCrawl.org. |
| Comodo Secure DNS | Check if a host would be blocked by Comodo Secure DNS. |
| Company Name Extractor | Identify company names in any obtained data. |
| Cookie Extractor | Extract Cookies from HTTP headers. |
| Country Name Extractor | Identify country names in any obtained data. |
| Credit Card Number Extractor | Identify Credit Card Numbers in any data |
| Crobat API | Search Crobat API for subdomains. |
| Cross-Referencer | Identify whether other domains are associated ('Affiliates') of the target by looking for links back to the target site(s). |
| CRXcavator | Search CRXcavator for Chrome extensions. |
| Custom Threat Feed | Check if a host/domain, netblock, ASN or IP is malicious according to your custom feed. |
| CyberCrime-Tracker.net | Check if a host/domain or IP address is malicious according to CyberCrime-Tracker.net. |
| Darksearch | Search the Darksearch.io Tor search engine for mentions of the target domain. |
| Debounce | Check whether an email is disposable |
| Dehashed | Gather breach data from Dehashed API. |
| Digital Ocean Space Finder | Search for potential Digital Ocean Spaces associated with the target and attempt to list their contents. |
| DNS Brute-forcer | Attempts to identify hostnames through brute-forcing common names and iterations. |
| DNS Common SRV | Attempts to identify hostnames through brute-forcing common DNS SRV records. |
| DNS for Family | Check if a host would be blocked by DNS for Family. |
| DNS Look-aside | Attempt to reverse-resolve the IP addresses next to your target to see if they are related. |
| DNS Raw Records | Retrieves raw DNS records such as MX, TXT and others. |
| DNS Resolver | Resolves hosts and IP addresses identified, also extracted from raw content. |
| DNS Zone Transfer | Attempts to perform a full DNS zone transfer. |
| DNSDB | Query FarSight's DNSDB for historical and passive DNS data. |
| DNSDumpster | Passive subdomain enumeration using HackerTarget's DNSDumpster |
| DNSGrep | Obtain Passive DNS information from Rapid7 Sonar Project using DNSGrep API. |
| DroneBL | Query the DroneBL database for open relays, open proxies, vulnerable servers, etc. |
| DuckDuckGo | Query DuckDuckGo's API for descriptive information about your target. |
| E-Mail Address Extractor | Identify e-mail addresses in any obtained data. |
| EmailCrawlr | Search EmailCrawlr for email addresses and phone numbers associated with a domain. |
| EmailFormat | Look up e-mail addresses on email-format.com. |
| EmailRep | Search EmailRep.io for email address reputation. |
| Emerging Threats | Check if a netblock or IP address is malicious according to EmergingThreats.net. |
| Error String Extractor | Identify common error messages in content like SQL errors, etc. |
| Ethereum Address Extractor | Identify ethereum addresses in scraped webpages. |
| Etherscan | Queries etherscan.io to find the balance of identified ethereum wallet addresses. |
| F-Secure Riddler.io | Obtain network information from F-Secure Riddler.io API. |
| File Metadata Extractor | Extracts meta data from documents and images. |
| Flickr | Search Flickr for domains, URLs and emails related to the specified domain. |
| Focsec | Look up IP address information from Focsec. |
| FortiGuard Antispam | Check if an IP address is malicious according to FortiGuard Antispam. |
| Fraudguard | Obtain threat information from Fraudguard.io |
| FullContact | Gather domain and e-mail information from FullContact.com API. |
| FullHunt | Identify domain attack surface using FullHunt API. |
| Github | Identify associated public code repositories on Github. |
| GLEIF | Look up company information from Global Legal Entity Identifier Foundation (GLEIF). |
| Google | Obtain information from the Google Custom Search API to identify sub-domains and links. |
| Google Maps | Identifies potential physical addresses and latitude/longitude coordinates. |
| Google Object Storage Finder | Search for potential Google Object Storage buckets associated with the target and attempt to list their contents. |
| Google SafeBrowsing | Check if the URL is included on any of the Safe Browsing lists. |
| Gravatar | Retrieve user information from Gravatar API. |
| Grayhat Warfare | Find bucket names matching the keyword extracted from a domain from Grayhat API. |
| Greensnow | Check if a netblock or IP address is malicious according to greensnow.co. |
| grep.app | Search grep.app API for links and emails related to the specified domain. |
| GreyNoise | Obtain IP enrichment data from GreyNoise |
| HackerOne (Unofficial) | Check external vulnerability scanning/reporting service h1.nobbd.de to see if the target is listed. |
| HackerTarget | Search HackerTarget.com for hosts sharing the same IP. |
| Hash Extractor | Identify MD5 and SHA hashes in web content, files and more. |
| HaveIBeenPwned | Check HaveIBeenPwned.com for hacked e-mail addresses identified in breaches. |
| Host.io | Obtain information about domain names from host.io. |
| Hosting Provider Identifier | Find out if any IP addresses identified fall within known 3rd party hosting ranges, e.g. Amazon, Azure, etc. |
| Human Name Extractor | Attempt to identify human names in fetched content. |
| Hunter.io | Check for e-mail addresses and names on hunter.io. |
| Hybrid Analysis | Search Hybrid Analysis for domains and URLs related to the target. |
| IBAN Number Extractor | Identify International Bank Account Numbers (IBANs) in any data. |
| Iknowwhatyoudownload.com | Check iknowwhatyoudownload.com for IP addresses that have been using torrents. |
| Instagram | Gather information from Instagram profiles. |
| IntelligenceX | Obtain information from IntelligenceX about identified IP addresses, domains, e-mail addresses and phone numbers. |
| Interesting File Finder | Identifies potential files of interest, e.g. office documents, zip files. |
| Internet Storm Center | Check if an IP address is malicious according to SANS ISC. |
| ipapi.co | Queries ipapi.co to identify geolocation of IP Addresses using ipapi.co API |
| ipapi.com | Queries ipapi.com to identify geolocation of IP Addresses using ipapi.com API |
| IPInfo.io | Identifies the physical location of IP addresses identified using ipinfo.io. |
| IPQualityScore | Determine if target is malicious using IPQualityScore API |
| ipregistry | Query the ipregistry.co database for reputation and geo-location. |
| ipstack | Identifies the physical location of IP addresses identified using ipstack.com. |
| JsonWHOIS.com | Search JsonWHOIS.com for WHOIS records associated with a domain. |
| Junk File Finder | Looks for old/temporary and other similar files. |
| Keybase | Obtain additional information about domain names and identified usernames. |
| Koodous | Search Koodous for mobile apps. |
| Leak-Lookup | Searches Leak-Lookup.com's database of breaches. |
| LeakIX | Search LeakIX for host data leaks, open ports, software and geoip. |
| Maltiverse | Obtain information about any malicious activities involving IP addresses |
| MalwarePatrol | Searches malwarepatrol.net's database of malicious URLs/IPs. |
| MetaDefender | Search MetaDefender API for IP address and domain IP reputation. |
| Mnemonic PassiveDNS | Obtain Passive DNS information from PassiveDNS.mnemonic.no. |
| multiproxy.org Open Proxies | Check if an IP address is an open proxy according to multiproxy.org open proxy list. |
| MySpace | Gather username and location from MySpace.com profiles. |
| NameAPI | Check whether an email is disposable |
| NetworksDB | Search NetworksDB.io API for IP address and domain information. |
| NeutrinoAPI | Search NeutrinoAPI for phone location information, IP address information, and host reputation. |
| numverify | Lookup phone number location and carrier information from numverify.com. |
| Onion.link | Search Tor 'Onion City' search engine for mentions of the target domain using Google Custom Search. |
| Onionsearchengine.com | Search Tor onionsearchengine.com for mentions of the target domain. |
| Onyphe | Check Onyphe data (threat list, geo-location, pastries, vulnerabilities) about a given IP. |
| Open Bug Bounty | Check external vulnerability scanning/reporting service openbugbounty.org to see if the target is listed. |
| Open Passive DNS Database | Obtain passive DNS information from pdns.daloo.de Open passive DNS database. |
| OpenCorporates | Look up company information from OpenCorporates. |
| OpenDNS | Check if a host would be blocked by OpenDNS. |
| OpenNIC DNS | Resolves host names in the OpenNIC alternative DNS system. |
| OpenPhish | Check if a host/domain is malicious according to OpenPhish.com. |
| OpenStreetMap | Retrieves latitude/longitude coordinates for physical addresses from OpenStreetMap API. |
| Page Information | Obtain information about web pages (do they take passwords, do they contain forms, etc.) |
| PasteBin | PasteBin search (via Google Search API) to identify related content. |
| PGP Key Servers | Look up domains and e-mail addresses in PGP public key servers. |
| PhishStats | Check if a netblock or IP address is malicious according to PhishStats. |
| PhishTank | Check if a host/domain is malicious according to PhishTank. |
| Phone Number Extractor | Identify phone numbers in scraped webpages. |
| Port Scanner - TCP | Scans for commonly open TCP ports on Internet-facing systems. |
| Project Honey Pot | Query the Project Honey Pot database for IP addresses. |
| ProjectDiscovery Chaos | Search for hosts/subdomains using chaos.projectdiscovery.io |
| Psbdmp | Check psbdmp.cc (PasteBin Dump) for potentially hacked e-mails and domains. |
| Pulsedive | Obtain information from Pulsedive's API. |
| PunkSpider | Check the QOMPLX punkspider.io service to see if the target is listed as vulnerable. |
| Quad9 | Check if a host would be blocked by Quad9 DNS. |
| Recon.dev | Search Recon.dev for subdomains. |
| ReverseWhois | Reverse Whois lookups using reversewhois.io. |
| RIPE | Queries the RIPE registry (includes ARIN data) to identify netblocks and other info. |
| RiskIQ | Obtain information from RiskIQ's (formerly PassiveTotal) Passive DNS and Passive SSL databases. |
| Robtex | Search Robtex.com for hosts sharing the same IP. |
| Scylla | Gather breach data from Scylla API. |
| searchcode | Search searchcode for code repositories mentioning the target domain. |
| SecurityTrails | Obtain Passive DNS and other information from SecurityTrails |
| Seon | Queries seon.io to gather intelligence about IP Addresses, email addresses, and phone numbers |
| SHODAN | Obtain information from SHODAN about identified IP addresses. |
| Similar Domain Finder | Search various sources to identify similar looking domain names, for instance squatted domains. |
| Skymem | Look up e-mail addresses on Skymem. |
| SlideShare | Gather name and location from SlideShare profiles. |
| Snov | Gather available email IDs from identified domains |
| Social Links | Queries SocialLinks.io to gather intelligence from social media platforms and dark web. |
| Social Media Profile Finder | Tries to discover the social media profiles for human names identified. |
| Social Network Identifier | Identify presence on social media networks such as LinkedIn, Twitter and others. |
| SORBS | Query the SORBS database for open relays, open proxies, vulnerable servers, etc. |
| SpamCop | Check if a netblock or IP address is in the SpamCop database. |
| Spamhaus Zen | Check if a netblock or IP address is in the Spamhaus Zen database. |
| spur.us | Obtain information about any malicious activities involving IP addresses found |
| SpyOnWeb | Search SpyOnWeb for hosts sharing the same IP address, Google Analytics code, or Google Adsense code. |
| Spyse | Search Spyse.com Internet assets registry for information about domains, IP addresses, host info, potential vulnerabilities, passive DNS, etc. |
| SSL Certificate Analyzer | Gather information about SSL certificates used by the target's HTTPS sites. |
| StackOverflow | Search StackOverflow for any mentions of a target domain. Returns potentially related information. |
| Steven Black Hosts | Check if a domain is malicious (malware or adware) according to Steven Black Hosts list. |
| Strange Header Identifier | Obtain non-standard HTTP headers returned by web servers. |
| Subdomain Takeover Checker | Check if affiliated subdomains are vulnerable to takeover. |
| Sublist3r PassiveDNS | Passive subdomain enumeration using Sublist3r's API |
| SURBL | Check if a netblock, IP address or domain is in the SURBL blacklist. |
| Talos Intelligence | Check if a netblock or IP address is malicious according to TalosIntelligence. |
| TextMagic | Obtain phone number type from TextMagic API |
| ThreatCrowd | Obtain information from ThreatCrowd about identified IP addresses, domains and e-mail addresses. |
| ThreatFox | Check if an IP address is malicious according to ThreatFox. |
| ThreatMiner | Obtain information from ThreatMiner's database for passive DNS and threat intelligence. |
| TLD Searcher | Search all Internet TLDs for domains with the same name as the target (this can be very slow.) |
| Tool - CMSeeK | Identify what Content Management System (CMS) might be used. |
| Tool - DNSTwist | Identify bit-squatting, typo and other similar domains to the target using a local DNSTwist installation. |
| Tool - nbtscan | Scans for open NETBIOS nameservers on your target's network. |
| Tool - Nmap | Identify what Operating System might be used. |
| Tool - Nuclei | Fast and customisable vulnerability scanner. |
| Tool - onesixtyone | Fast scanner to find publicly exposed SNMP services. |
| Tool - Retire.js | Scanner detecting the use of JavaScript libraries with known vulnerabilities |
| Tool - snallygaster | Finds file leaks and other security problems on HTTP servers. |
| Tool - testssl.sh | Identify various TLS/SSL weaknesses, including Heartbleed, CRIME and ROBOT. |
| Tool - TruffleHog | Searches through git repositories for high entropy strings and secrets, digging deep into commit history. |
| Tool - WAFW00F | Identify what web application firewall (WAF) is in use on the specified website. |
| Tool - Wappalyzer | Wappalyzer indentifies technologies on websites. |
| Tool - WhatWeb | Identify what software is in use on the specified website. |
| TOR Exit Nodes | Check if an IP adddress or netblock appears on the Tor Metrics exit node list. |
| TORCH | Search Tor 'TORCH' search engine for mentions of the target domain. |
| Trashpanda | Queries Trashpanda to gather intelligence about mentions of target in pastesites |
| Trumail | Check whether an email is disposable |
| Twilio | Obtain information from Twilio about phone numbers. Ensure you have the Caller Name add-on installed in Twilio. |
| Twitter | Gather name and location from Twitter profiles. |
| UCEPROTECT | Check if a netblock or IP address is in the UCEPROTECT database. |
| URLScan.io | Search URLScan.io cache for domain information. |
| Venmo | Gather user information from Venmo API. |
| ViewDNS.info | Identify co-hosted websites and perform reverse Whois lookups using ViewDNS.info. |
| VirusTotal | Obtain information from VirusTotal about identified IP addresses. |
| VoIP Blacklist (VoIPBL) | Check if an IP address or netblock is malicious according to VoIP Blacklist (VoIPBL). |
| VXVault.net | Check if a domain or IP address is malicious according to VXVault.net. |
| Web Analytics Extractor | Identify web analytics IDs in scraped webpages and DNS TXT records. |
| Web Framework Identifier | Identify the usage of popular web frameworks like jQuery, YUI and others. |
| Web Server Identifier | Obtain web server banners to identify versions of web servers being used. |
| Web Spider | Spidering of web-pages to extract content for searching. |
| WhatCMS | Check web technology using WhatCMS.org API. |
| Whois | Perform a WHOIS look-up on domain names and owned netblocks. |
| Whoisology | Reverse Whois lookups using Whoisology.com. |
| Whoxy | Reverse Whois lookups using Whoxy.com. |
| WiGLE | Query WiGLE to identify nearby WiFi access points. |
| Wikileaks | Search Wikileaks for mentions of domain names and e-mail addresses. |
| Wikipedia Edits | Identify edits to Wikipedia articles made from a given IP address or username. |
| XForce Exchange | Obtain IP reputation and passive DNS information from IBM X-Force Exchange. |
| Yandex DNS | Check if a host would be blocked by Yandex DNS. |
| Zetalytics | Query the Zetalytics database for hosts on your target domain(s). |
| Zone-H Defacement Check | Check if a hostname/domain appears on the zone-h.org 'special defacements' RSS feed. |