Web & threat intelligence
The full reference for website and URL analysis, security posture, vulnerability lookups, and threat-database cross-referencing — tool by tool, with inputs, outputs, and data source.
This category looks at the web layer — a specific site or URL — and at whether an indicator you already have is known to be malicious.
| Tool | Input | Returns | Data source |
|---|---|---|---|
| URL Analyzer | A URL | Its components broken out, plus heuristic flags (IP-literal host, suspicious encoding, and more) | Local |
| Website Analysis | A URL | One-shot recon of the page: fetch, detected technology stack, and headline findings | Live |
| Web Crawler | A target site, crawl depth/limits | A bounded breadth-first crawl extracting links, emails, and phone numbers found across the pages | Live |
| Robots & Sitemap | A domain | The site's robots.txt and declared sitemaps (or the conventional locations) | Live |
| Wayback Lookup | A URL | Historical Wayback Machine snapshots via the CDX index | Network |
| Wayback Diff | A URL and two points in time | A line-based diff between two Wayback snapshots of the same page | Network |
| URL Redirect | A URL | The redirect chain walked hop by hop, with status and Location at each step | Live |
| Cookie Auditor | One or more Set-Cookie header strings | A per-cookie flag audit (Secure, HttpOnly, SameSite, expiry, and more) | Local |
| WebSocket Inspector | A ws:// or wss:// URL | The result of an RFC 6455 opening handshake against it | Live |
| Tool | Input | Returns | Data source |
|---|---|---|---|
| Security Headers | Pasted HTTP response headers (from curl, a browser network tab, or a proxy) | A per-header grade of the site's security posture | Local |
| CSP Analyzer | A pasted Content-Security-Policy header | A per-directive risk breakdown | Local |
| WAF Fingerprint | A URL | Any WAF/CDN sitting in front of the origin, identified by probing and analyzing the response | Live |
| Favicon Hash | A site's favicon (URL or file) | A Shodan-style mmh3 hash plus SHA-256/SHA-1, and known-icon identification — useful for finding the same site hosted elsewhere | Live |
| Security.txt | A domain | Its RFC 9116 security.txt, fetched and parsed | Live |
| HTTP Methods | A URL | Which HTTP methods it allows, plus read-only WebDAV probes | Live |
| Tracker IDs | A page or URL | Analytics and advertising identifiers found in it, useful for attribution pivots between sites | Live |
| Tool | Input | Returns | Data source |
|---|---|---|---|
| CVE Lookup | A CVE identifier | Full details for that CVE — CIRCL first, NVD as fallback | Network |
| CVE Search | A product name | CVEs that mention the product | Network |
| CVSS Calculator | A CVSS vector string | The score, computed offline | Local |
| Package Intel | A published package name (ecosystem-aware) | Supply-chain intelligence on it | Network |
| Docker Image | A public Docker Hub image name | Metadata on that image | Network |
| Git Repo Intel | A GitHub repository | Intelligence on the repo — activity, contributors, and related signals | Network |
Cross-reference an indicator you already have against public threat intelligence.
| Tool | Input | Returns | Data source |
|---|---|---|---|
| URLhaus | A URL | Whether it's a known-malicious URL in abuse.ch's URLhaus database | Network |
| ThreatFox | An IoC — IP, domain, URL, or hash | Matches in abuse.ch's ThreatFox indicator database | Network |
| MalwareBazaar | A SHA-256 hash | The matching malware sample record in abuse.ch's MalwareBazaar, if any | Network |
| urlscan.io Search | A domain or URL | Recent public scans of it on urlscan.io | Network |
| HIBP Domain | A domain | Have I Been Pwned breaches on record for that domain, via HIBP's free API | Network |
| Sanctions Check | A name | Sanctions/watchlist matches via the OpenSanctions API | Network |
| Tool | Input | Returns | Data source |
|---|---|---|---|
| Search (DuckDuckGo) | A search query | Open-web results via DuckDuckGo's HTML endpoint — no API key needed | Network |
| Pastebin Search | A free-text term | Matches across three paste-dump sources | Network |
| GDELT News | A search query | Matching events from the GDELT global news event archive | Network |
| Wikidata Entity | A name | An identity record with links out to check | Network |