ZeroTrace OSINT
Web & threat intelligence
The full reference for website and URL analysis, security posture, vulnerability lookups, and threat-database cross-referencing — tool by tool, with inputs, outputs, and data source.
Web & threat intelligence
This category looks at the web layer — a specific site or URL — and at whether an indicator you already have is known to be malicious.
| Tool | Input | Returns | Data source |
|---|---|---|---|
| URL Analyzer | A URL | Its components broken out, plus heuristic flags (IP-literal host, suspicious encoding, and more) | Local |
| Website Analysis | A URL | One-shot recon of the page: fetch, detected technology stack, and headline findings | Live |
| Web Crawler | A target site, crawl depth/limits | A bounded breadth-first crawl extracting links, emails, and phone numbers found across the pages | Live |
| Robots & Sitemap | A domain | The site's robots.txt and declared sitemaps (or the conventional locations) | Live |
| Wayback Lookup | A URL | Historical Wayback Machine snapshots via the CDX index | Network |
| Wayback Diff | A URL and two points in time | A line-based diff between two Wayback snapshots of the same page | Network |
| URL Redirect | A URL | The redirect chain walked hop by hop, with status and Location at each step | Live |
| Cookie Auditor | One or more Set-Cookie header strings | A per-cookie flag audit (Secure, HttpOnly, SameSite, expiry, and more) | Local |
| WebSocket Inspector | A ws:// or wss:// URL | The result of an RFC 6455 opening handshake against it | Live |
A tool marked Live in this category opens a real connection to the site you point it at — the site can see the request arrive. A tool marked Network instead queries a third-party service about the site, without the site itself being contacted. See Local, network, and live for the full model.
This table covers the web and threat-intel tools currently in the library. Use the command palette to confirm you're seeing the current set.