SpiderFoot v4.0.0

Scan Name

Scan Target

Your scan target may be one of the following. SpiderFoot will automatically detect the target type based on the format of your input:

Domain Name: e.g. example.com
IPv4 Address: e.g. 1.2.3.4
IPv6 Address: e.g. 2606:4700:4700::1111
Hostname/Sub-domain: e.g. abc.example.com
Subnet: e.g. 1.2.3.0/24
Bitcoin Address: e.g. 1HesYJSP1QqcyPEjnQ9vzBL1wujruNGe7R

E-mail address: e.g. bob@example.com
Phone Number: e.g. +12345678901 (E.164 format)
Human Name: e.g. "John Smith" (must be in quotes)
Username: e.g. "jsmith2000" (must be in quotes)
Network ASN: e.g. 1234

	All	Get anything and everything about the target. All SpiderFoot modules will be enabled (slow) but every possible piece of information about the target will be obtained and analysed.
	Footprint	Understand what information this target exposes to the Internet. Gain an understanding about the target's network perimeter, associated identities and other information that is obtained through a lot of web crawling and search engine use.
	Investigate	Best for when you suspect the target to be malicious but need more information. Some basic footprinting will be performed in addition to querying of blacklists and other sources that may have information about your target's maliciousness.
	Passive	When you don't want the target to even suspect they are being investigated. As much information will be gathered without touching the target or their affiliates, therefore only modules that do not touch the target will be enabled.

	Account on External Site		Affiliate - Company Name
	Affiliate - Domain Name		Affiliate - Domain Name Unregistered
	Affiliate - Domain Whois		Affiliate - Email Address
	Affiliate - IP Address		Affiliate - IPv6 Address
	Affiliate - Internet Name		Affiliate - Internet Name - Unresolved
	Affiliate - Internet Name Hijackable		Affiliate - Web Content
	Affiliate Description - Abstract		Affiliate Description - Category
	App Store Entry		BGP AS Membership
	BGP AS Ownership		Base64-encoded Data
	Bitcoin Address		Bitcoin Balance
	Blacklisted Affiliate IP Address		Blacklisted Affiliate Internet Name
	Blacklisted Co-Hosted Site		Blacklisted IP Address
	Blacklisted IP on Owned Netblock		Blacklisted IP on Same Subnet
	Blacklisted Internet Name		Cloud Storage Bucket
	Cloud Storage Bucket Open		Co-Hosted Site
	Co-Hosted Site - Domain Name		Co-Hosted Site - Domain Whois
	Company Name		Compromised Password
	Compromised Password Hash		Cookies
	Country Name		Credit Card Number
	DNS SPF Record		DNS SRV Record
	DNS TXT Record		Darknet Mention URL
	Darknet Mention Web Content		Date of Birth
	Defaced		Defaced Affiliate
	Defaced Affiliate IP Address		Defaced Co-Hosted Site
	Defaced IP Address		Deliverable Email Address
	Description - Abstract		Description - Category
	Device Type		Disposable Email Address
	Domain Name		Domain Name (Parent)
	Domain Registrar		Domain Whois
	Email Address		Email Address - Generic
	Email Gateway (DNS MX Records)		Error Message
	Ethereum Address		Ethereum Balance
	Externally Hosted Javascript		HTTP Headers
	HTTP Status Code		Hacked Account on External Site
	Hacked Email Address		Hacked User Account on External Site
	Hash		Historic Interesting File
	Historic URL (Accepts Passwords)		Historic URL (Accepts Uploads)
	Historic URL (Form)		Historic URL (Purely Static)
	Historic URL (Uses Flash)		Historic URL (Uses Java Applet)
	Historic URL (Uses Javascript)		Historic URL (Uses a Web Framework)
	Hosting Provider		Human Name
	IBAN Number		IP Address
	IP Address - Internal Network		IPv6 Address
	Interesting File		Internal SpiderFoot Root event
	Internet Name		Internet Name - Unresolved
	Job Title		Junk File
	Leak Site Content		Leak Site URL
	Legal Entity Identifier		Linked URL - External
	Linked URL - Internal		Malicious AS
	Malicious Affiliate		Malicious Affiliate IP Address
	Malicious Bitcoin Address		Malicious Co-Hosted Site
	Malicious E-mail Address		Malicious IP Address
	Malicious IP on Owned Netblock		Malicious IP on Same Subnet
	Malicious Internet Name		Malicious Phone Number
	Name Server (DNS NS Records)		Netblock IPv6 Membership
	Netblock IPv6 Ownership		Netblock Membership
	Netblock Ownership		Netblock Whois
	Non-Standard HTTP Header		Open TCP Port
	Open TCP Port Banner		Open UDP Port
	Open UDP Port Information		Operating System
	PGP Public Key		Phone Number
	Phone Number Compromised		Phone Number Type
	Physical Address		Physical Coordinates
	Physical Location		Proxy Host
	Public Code Repository		Raw DNS Records
	Raw Data from RIRs/APIs		Raw File Meta Data
	SSL Certificate - Issued by		SSL Certificate - Issued to
	SSL Certificate - Raw Data		SSL Certificate Expired
	SSL Certificate Expiring		SSL Certificate Host Mismatch
	Search Engine Web Content		Similar Account on External Site
	Similar Domain		Similar Domain - Whois
	Social Media Presence		Software Used
	TOR Exit Node		Telecommunications Provider
	URL (Accepts Passwords)		URL (Accepts Uploads)
	URL (AdBlocked External)		URL (AdBlocked Internal)
	URL (Form)		URL (Purely Static)
	URL (Uses Flash)		URL (Uses Java Applet)
	URL (Uses Javascript)		URL (Uses a Web Framework)
	Undeliverable Email Address		Username
	VPN Host		Vulnerability - CVE Critical
	Vulnerability - CVE High		Vulnerability - CVE Low
	Vulnerability - CVE Medium		Vulnerability - General
	Vulnerability - Third Party Disclosure		Web Analytics
	Web Content		Web Content Type
	Web Server		Web Technology
	WiFi Access Point Nearby		Wikipedia Page Edit

	AbstractAPI	Look up domain, phone and IP address information from AbstractAPI.
	abuse.ch	Check if a host/domain, IP address or netblock is malicious according to Abuse.ch.
	AbuseIPDB	Check if an IP address is malicious according to AbuseIPDB.com blacklist.
	Abusix Mail Intelligence	Check if a netblock or IP address is in the Abusix Mail Intelligence blacklist.
	Account Finder	Look for possible associated accounts on over 500 social and other websites such as Instagram, Reddit, etc.
	AdBlock Check	Check if linked pages would be blocked by AdBlock Plus.
	AdGuard DNS	Check if a host would be blocked by AdGuard DNS.
	Ahmia	Search Tor 'Ahmia' search engine for mentions of the target.
	AlienVault IP Reputation	Check if an IP or netblock is malicious according to the AlienVault IP Reputation database.
	AlienVault OTX	Obtain information from AlienVault Open Threat Exchange (OTX)
	Amazon S3 Bucket Finder	Search for potential Amazon S3 buckets associated with the target and attempt to list their contents.
	Apple iTunes	Search Apple iTunes for mobile apps.
	Archive.org	Identifies historic versions of interesting files/pages from the Wayback Machine.
	ARIN	Queries ARIN registry for contact information.
	Azure Blob Finder	Search for potential Azure blobs associated with the target and attempt to list their contents.
	Base64 Decoder	Identify Base64-encoded strings in URLs, often revealing interesting hidden information.
	BGPView	Obtain network information from BGPView API.
	Binary String Extractor	Attempt to identify strings in binary content.
	BinaryEdge	Obtain information from BinaryEdge.io Internet scanning systems, including breaches, vulnerabilities, torrents and passive DNS.
	Bing	Obtain information from bing to identify sub-domains and links.
	Bing (Shared IPs)	Search Bing for hosts sharing the same IP.
	Bitcoin Finder	Identify bitcoin addresses in scraped webpages.
	Bitcoin Who's Who	Check for Bitcoin addresses against the Bitcoin Who's Who database of suspect/malicious addresses.
	BitcoinAbuse	Check Bitcoin addresses against the bitcoinabuse.com database of suspect/malicious addresses.
	Blockchain	Queries blockchain.info to find the balance of identified bitcoin wallet addresses.
	blocklist.de	Check if a netblock or IP is malicious according to blocklist.de.
	BotScout	Searches BotScout.com's database of spam-bot IP addresses and e-mail addresses.
	botvrij.eu	Check if a domain is malicious according to botvrij.eu.
	BuiltWith	Query BuiltWith.com's Domain API for information about your target's web technology stack, e-mail addresses and more.
	C99	Queries the C99 API which offers various data (geo location, proxy detection, phone lookup, etc).
	CallerName	Lookup US phone number location and reputation information.
	Censys	Obtain host information from Censys.io.
	Certificate Transparency	Gather hostnames from historical certificates in crt.sh.
	CertSpotter	Gather information about SSL certificates from SSLMate CertSpotter API.
	CINS Army List	Check if a netblock or IP address is malicious according to Collective Intelligence Network Security (CINS) Army list.
	CIRCL.LU	Obtain information from CIRCL.LU's Passive DNS and Passive SSL databases.
	CleanBrowsing.org	Check if a host would be blocked by CleanBrowsing.org DNS content filters.
	CleanTalk Spam List	Check if a netblock or IP address is on CleanTalk.org's spam IP list.
	Clearbit	Check for names, addresses, domains and more based on lookups of e-mail addresses on clearbit.com.
	CloudFlare DNS	Check if a host would be blocked by CloudFlare DNS.
	CoinBlocker Lists	Check if a domain appears on CoinBlocker lists.
	CommonCrawl	Searches for URLs found through CommonCrawl.org.
	Comodo Secure DNS	Check if a host would be blocked by Comodo Secure DNS.
	Company Name Extractor	Identify company names in any obtained data.
	Cookie Extractor	Extract Cookies from HTTP headers.
	Country Name Extractor	Identify country names in any obtained data.
	Credit Card Number Extractor	Identify Credit Card Numbers in any data
	Crobat API	Search Crobat API for subdomains.
	Cross-Referencer	Identify whether other domains are associated ('Affiliates') of the target by looking for links back to the target site(s).
	CRXcavator	Search CRXcavator for Chrome extensions.
	Custom Threat Feed	Check if a host/domain, netblock, ASN or IP is malicious according to your custom feed.
	CyberCrime-Tracker.net	Check if a host/domain or IP address is malicious according to CyberCrime-Tracker.net.
	Debounce	Check whether an email is disposable
	Dehashed	Gather breach data from Dehashed API.
	Digital Ocean Space Finder	Search for potential Digital Ocean Spaces associated with the target and attempt to list their contents.
	DNS Brute-forcer	Attempts to identify hostnames through brute-forcing common names and iterations.
	DNS Common SRV	Attempts to identify hostnames through brute-forcing common DNS SRV records.
	DNS for Family	Check if a host would be blocked by DNS for Family.
	DNS Look-aside	Attempt to reverse-resolve the IP addresses next to your target to see if they are related.
	DNS Raw Records	Retrieves raw DNS records such as MX, TXT and others.
	DNS Resolver	Resolves hosts and IP addresses identified, also extracted from raw content.
	DNS Zone Transfer	Attempts to perform a full DNS zone transfer.
	DNSDB	Query FarSight's DNSDB for historical and passive DNS data.
	DNSDumpster	Passive subdomain enumeration using HackerTarget's DNSDumpster
	DNSGrep	Obtain Passive DNS information from Rapid7 Sonar Project using DNSGrep API.
	DroneBL	Query the DroneBL database for open relays, open proxies, vulnerable servers, etc.
	DuckDuckGo	Query DuckDuckGo's API for descriptive information about your target.
	E-Mail Address Extractor	Identify e-mail addresses in any obtained data.
	EmailCrawlr	Search EmailCrawlr for email addresses and phone numbers associated with a domain.
	EmailFormat	Look up e-mail addresses on email-format.com.
	EmailRep	Search EmailRep.io for email address reputation.
	Emerging Threats	Check if a netblock or IP address is malicious according to EmergingThreats.net.
	Error String Extractor	Identify common error messages in content like SQL errors, etc.
	Ethereum Address Extractor	Identify ethereum addresses in scraped webpages.
	Etherscan	Queries etherscan.io to find the balance of identified ethereum wallet addresses.
	F-Secure Riddler.io	Obtain network information from F-Secure Riddler.io API.
	File Metadata Extractor	Extracts meta data from documents and images.
	Flickr	Search Flickr for domains, URLs and emails related to the specified domain.
	Focsec	Look up IP address information from Focsec.
	FortiGuard Antispam	Check if an IP address is malicious according to FortiGuard Antispam.
	Fraudguard	Obtain threat information from Fraudguard.io
	FullContact	Gather domain and e-mail information from FullContact.com API.
	FullHunt	Identify domain attack surface using FullHunt API.
	Github	Identify associated public code repositories on Github.
	GLEIF	Look up company information from Global Legal Entity Identifier Foundation (GLEIF).
	Google	Obtain information from the Google Custom Search API to identify sub-domains and links.
	Google Maps	Identifies potential physical addresses and latitude/longitude coordinates.
	Google Object Storage Finder	Search for potential Google Object Storage buckets associated with the target and attempt to list their contents.
	Google SafeBrowsing	Check if the URL is included on any of the Safe Browsing lists.
	Google Tag Manager	Search Google Tag Manager (GTM) for hosts sharing the same GTM code.
	Gravatar	Retrieve user information from Gravatar API.
	Grayhat Warfare	Find bucket names matching the keyword extracted from a domain from Grayhat API.
	Greensnow	Check if a netblock or IP address is malicious according to greensnow.co.
	grep.app	Search grep.app API for links and emails related to the specified domain.
	GreyNoise	Obtain IP enrichment data from GreyNoise
	GreyNoise Community	Obtain IP enrichment data from GreyNoise Community API
	HackerOne (Unofficial)	Check external vulnerability scanning/reporting service h1.nobbd.de to see if the target is listed.
	HackerTarget	Search HackerTarget.com for hosts sharing the same IP.
	Hash Extractor	Identify MD5 and SHA hashes in web content, files and more.
	HaveIBeenPwned	Check HaveIBeenPwned.com for hacked e-mail addresses identified in breaches.
	Host.io	Obtain information about domain names from host.io.
	Hosting Provider Identifier	Find out if any IP addresses identified fall within known 3rd party hosting ranges, e.g. Amazon, Azure, etc.
	Human Name Extractor	Attempt to identify human names in fetched content.
	Hunter.io	Check for e-mail addresses and names on hunter.io.
	Hybrid Analysis	Search Hybrid Analysis for domains and URLs related to the target.
	IBAN Number Extractor	Identify International Bank Account Numbers (IBANs) in any data.
	Iknowwhatyoudownload.com	Check iknowwhatyoudownload.com for IP addresses that have been using torrents.
	IntelligenceX	Obtain information from IntelligenceX about identified IP addresses, domains, e-mail addresses and phone numbers.
	Interesting File Finder	Identifies potential files of interest, e.g. office documents, zip files.
	Internet Storm Center	Check if an IP address is malicious according to SANS ISC.
	ipapi.co	Queries ipapi.co to identify geolocation of IP Addresses using ipapi.co API
	ipapi.com	Queries ipapi.com to identify geolocation of IP Addresses using ipapi.com API
	IPInfo.io	Identifies the physical location of IP addresses identified using ipinfo.io.
	IPQualityScore	Determine if target is malicious using IPQualityScore API
	ipregistry	Query the ipregistry.co database for reputation and geo-location.
	ipstack	Identifies the physical location of IP addresses identified using ipstack.com.
	JsonWHOIS.com	Search JsonWHOIS.com for WHOIS records associated with a domain.
	Junk File Finder	Looks for old/temporary and other similar files.
	Keybase	Obtain additional information about domain names and identified usernames.
	Koodous	Search Koodous for mobile apps.
	Leak-Lookup	Searches Leak-Lookup.com's database of breaches.
	LeakIX	Search LeakIX for host data leaks, open ports, software and geoip.
	Maltiverse	Obtain information about any malicious activities involving IP addresses
	MalwarePatrol	Searches malwarepatrol.net's database of malicious URLs/IPs.
	MetaDefender	Search MetaDefender API for IP address and domain IP reputation.
	Mnemonic PassiveDNS	Obtain Passive DNS information from PassiveDNS.mnemonic.no.
	multiproxy.org Open Proxies	Check if an IP address is an open proxy according to multiproxy.org open proxy list.
	MySpace	Gather username and location from MySpace.com profiles.
	NameAPI	Check whether an email is disposable
	NetworksDB	Search NetworksDB.io API for IP address and domain information.
	NeutrinoAPI	Search NeutrinoAPI for phone location information, IP address information, and host reputation.
	numverify	Lookup phone number location and carrier information from numverify.com.
	Onion.link	Search Tor 'Onion City' search engine for mentions of the target domain using Google Custom Search.
	Onionsearchengine.com	Search Tor onionsearchengine.com for mentions of the target domain.
	Onyphe	Check Onyphe data (threat list, geo-location, pastries, vulnerabilities) about a given IP.
	Open Bug Bounty	Check external vulnerability scanning/reporting service openbugbounty.org to see if the target is listed.
	OpenCorporates	Look up company information from OpenCorporates.
	OpenDNS	Check if a host would be blocked by OpenDNS.
	OpenNIC DNS	Resolves host names in the OpenNIC alternative DNS system.
	OpenPhish	Check if a host/domain is malicious according to OpenPhish.com.
	OpenStreetMap	Retrieves latitude/longitude coordinates for physical addresses from OpenStreetMap API.
	Page Information	Obtain information about web pages (do they take passwords, do they contain forms, etc.)
	PasteBin	PasteBin search (via Google Search API) to identify related content.
	PGP Key Servers	Look up domains and e-mail addresses in PGP public key servers.
	PhishStats	Check if a netblock or IP address is malicious according to PhishStats.
	PhishTank	Check if a host/domain is malicious according to PhishTank.
	Phone Number Extractor	Identify phone numbers in scraped webpages.
	Port Scanner - TCP	Scans for commonly open TCP ports on Internet-facing systems.
	Project Honey Pot	Query the Project Honey Pot database for IP addresses.
	ProjectDiscovery Chaos	Search for hosts/subdomains using chaos.projectdiscovery.io
	Psbdmp	Check psbdmp.cc (PasteBin Dump) for potentially hacked e-mails and domains.
	Pulsedive	Obtain information from Pulsedive's API.
	PunkSpider	Check the QOMPLX punkspider.io service to see if the target is listed as vulnerable.
	Quad9	Check if a host would be blocked by Quad9 DNS.
	ReverseWhois	Reverse Whois lookups using reversewhois.io.
	RIPE	Queries the RIPE registry (includes ARIN data) to identify netblocks and other info.
	RiskIQ	Obtain information from RiskIQ's (formerly PassiveTotal) Passive DNS and Passive SSL databases.
	Robtex	Search Robtex.com for hosts sharing the same IP.
	searchcode	Search searchcode for code repositories mentioning the target domain.
	SecurityTrails	Obtain Passive DNS and other information from SecurityTrails
	Seon	Queries seon.io to gather intelligence about IP Addresses, email addresses, and phone numbers
	SHODAN	Obtain information from SHODAN about identified IP addresses.
	Similar Domain Finder	Search various sources to identify similar looking domain names, for instance squatted domains.
	Skymem	Look up e-mail addresses on Skymem.
	SlideShare	Gather name and location from SlideShare profiles.
	Snov	Gather available email IDs from identified domains
	Social Links	Queries SocialLinks.io to gather intelligence from social media platforms and dark web.
	Social Media Profile Finder	Tries to discover the social media profiles for human names identified.
	Social Network Identifier	Identify presence on social media networks such as LinkedIn, Twitter and others.
	SORBS	Query the SORBS database for open relays, open proxies, vulnerable servers, etc.
	SpamCop	Check if a netblock or IP address is in the SpamCop database.
	Spamhaus Zen	Check if a netblock or IP address is in the Spamhaus Zen database.
	spur.us	Obtain information about any malicious activities involving IP addresses found
	SpyOnWeb	Search SpyOnWeb for hosts sharing the same IP address, Google Analytics code, or Google Adsense code.
	SSL Certificate Analyzer	Gather information about SSL certificates used by the target's HTTPS sites.
	StackOverflow	Search StackOverflow for any mentions of a target domain. Returns potentially related information.
	Steven Black Hosts	Check if a domain is malicious (malware or adware) according to Steven Black Hosts list.
	Strange Header Identifier	Obtain non-standard HTTP headers returned by web servers.
	Subdomain Takeover Checker	Check if affiliated subdomains are vulnerable to takeover.
	Sublist3r PassiveDNS	Passive subdomain enumeration using Sublist3r's API
	SURBL	Check if a netblock, IP address or domain is in the SURBL blacklist.
	Talos Intelligence	Check if a netblock or IP address is malicious according to TalosIntelligence.
	TextMagic	Obtain phone number type from TextMagic API
	Threat Jammer	Check if an IP address is malicious according to ThreatJammer.com
	ThreatCrowd	Obtain information from ThreatCrowd about identified IP addresses, domains and e-mail addresses.
	ThreatFox	Check if an IP address is malicious according to ThreatFox.
	ThreatMiner	Obtain information from ThreatMiner's database for passive DNS and threat intelligence.
	TLD Searcher	Search all Internet TLDs for domains with the same name as the target (this can be very slow.)
	Tool - CMSeeK	Identify what Content Management System (CMS) might be used.
	Tool - DNSTwist	Identify bit-squatting, typo and other similar domains to the target using a local DNSTwist installation.
	Tool - nbtscan	Scans for open NETBIOS nameservers on your target's network.
	Tool - Nmap	Identify what Operating System might be used.
	Tool - Nuclei	Fast and customisable vulnerability scanner.
	Tool - onesixtyone	Fast scanner to find publicly exposed SNMP services.
	Tool - Retire.js	Scanner detecting the use of JavaScript libraries with known vulnerabilities
	Tool - snallygaster	Finds file leaks and other security problems on HTTP servers.
	Tool - testssl.sh	Identify various TLS/SSL weaknesses, including Heartbleed, CRIME and ROBOT.
	Tool - TruffleHog	Searches through git repositories for high entropy strings and secrets, digging deep into commit history.
	Tool - WAFW00F	Identify what web application firewall (WAF) is in use on the specified website.
	Tool - Wappalyzer	Wappalyzer indentifies technologies on websites.
	Tool - WhatWeb	Identify what software is in use on the specified website.
	TOR Exit Nodes	Check if an IP adddress or netblock appears on the Tor Metrics exit node list.
	TORCH	Search Tor 'TORCH' search engine for mentions of the target domain.
	Trashpanda	Queries Trashpanda to gather intelligence about mentions of target in pastesites
	Trumail	Check whether an email is disposable
	Twilio	Obtain information from Twilio about phone numbers. Ensure you have the Caller Name add-on installed in Twilio.
	Twitter	Gather name and location from Twitter profiles.
	UCEPROTECT	Check if a netblock or IP address is in the UCEPROTECT database.
	URLScan.io	Search URLScan.io cache for domain information.
	Venmo	Gather user information from Venmo API.
	ViewDNS.info	Identify co-hosted websites and perform reverse Whois lookups using ViewDNS.info.
	VirusTotal	Obtain information from VirusTotal about identified IP addresses.
	VoIP Blacklist (VoIPBL)	Check if an IP address or netblock is malicious according to VoIP Blacklist (VoIPBL).
	VXVault.net	Check if a domain or IP address is malicious according to VXVault.net.
	Web Analytics Extractor	Identify web analytics IDs in scraped webpages and DNS TXT records.
	Web Framework Identifier	Identify the usage of popular web frameworks like jQuery, YUI and others.
	Web Server Identifier	Obtain web server banners to identify versions of web servers being used.
	Web Spider	Spidering of web-pages to extract content for searching.
	WhatCMS	Check web technology using WhatCMS.org API.
	Whois	Perform a WHOIS look-up on domain names and owned netblocks.
	Whoisology	Reverse Whois lookups using Whoisology.com.
	Whoxy	Reverse Whois lookups using Whoxy.com.
	WiGLE	Query WiGLE to identify nearby WiFi access points.
	Wikileaks	Search Wikileaks for mentions of domain names and e-mail addresses.
	Wikipedia Edits	Identify edits to Wikipedia articles made from a given IP address or username.
	XForce Exchange	Obtain IP reputation and passive DNS information from IBM X-Force Exchange.
	Yandex DNS	Check if a host would be blocked by Yandex DNS.
	Zetalytics	Query the Zetalytics database for hosts on your target domain(s).
	Zone-H Defacement Check	Check if a hostname/domain appears on the zone-h.org 'special defacements' RSS feed.
	ZoneFile.io	Search ZoneFiles.io Domain query API for domain information.

New Scan