Transforms

A transform takes entities of its input type and writes what it finds, mostly entities of its output type linked to the input. How to run one is in transforms . A secret is the name of a key you keep on the Secrets page, never the value itself.

Secrets

ASN

asn_to_cidrs

List the IP ranges an autonomous system announces (RIPEstat).

Takes asn, finds cidr.

Automation

n8n_connector

Send the selected entities to an n8n webhook, for workflows run outside gosint.

Takes any entity, finds phrase.

CIDR

cidr_to_ips

List the addresses of an IP range, up to a limit.

Takes cidr, finds ip.

Crypto wallet

cryptowallet_to_nfts

List the NFT transfers of a wallet (Etherscan).

Takes cryptowallet, finds cryptonft.

cryptowallet_to_transactions

List the first 100 Ethereum transactions of a wallet (Etherscan).

Takes cryptowallet, finds cryptowallettransaction.

Domain

domain_to_asn

Find the autonomous systems hosting a domain’s addresses (RIPEstat).

Takes domain, finds asn.

domain_to_dehashed

Find the breach records of a domain, every account under it in DeHashed and what leaked with it: the password or its hash, names, emails, usernames, phones, IPs.

Takes domain, finds breach.

domain_to_dns

Read a domain’s DNS records: addresses, CNAME, MX and NS hosts as domains, and TXT records.

Takes domain, finds ip.

domain_to_history

Read the WHOIS history of a domain and the contacts it names (Whoxy).

Takes domain, finds domain.

domain_to_hunter

List the email addresses Hunter.io found on a domain, each under the person it names when known.

Takes domain, finds email.

domain_to_ip

Resolve a domain to its IPv4 and IPv6 addresses.

Takes domain, finds ip.

domain_to_root_domain

Find the registrable root domain of a subdomain.

Takes domain, finds domain.

domain_to_securitytrails

List a domain’s subdomains and the addresses its A records point to, from SecurityTrails.

Takes domain, finds domain.

domain_to_subdomains

Find subdomains of a domain with subfinder’s passive sources, or else in certificate transparency logs (crt.sh).

Takes domain, finds domain.

domain_to_tls

Read the TLS certificate a domain serves over https.

Takes domain, finds sslcertificate.

domain_to_urlscan

List the pages urlscan.io scanned under the domain, each with the address it was served from.

Takes domain, finds website.

domain_to_virustotal

Read how many engines call a domain malicious on VirusTotal (any red) and the addresses it resolved to.

Takes domain, finds ip.

domain_to_website

Fetch the website a domain serves, with its title, description, status, server and redirects.

Takes domain, finds website.

domain_to_whois

Read the current WHOIS record of a domain: registrar, dates, registrant.

Takes domain, finds whois.

domain_to_whois_history

Read the WHOIS history records of a domain (WhoisXML API, uses purchase credits).

Takes domain, finds whois.

Email

email_to_breaches

Find the data breaches an email address appears in (Have I Been Pwned).

Takes email, finds breach.

email_to_dehashed

Find the breach records of an email address in DeHashed and what leaked with it: the password or its hash, names, emails, usernames, phones, IPs.

Takes email, finds breach.

email_to_domain

Extract the domain of an email address.

Takes email, finds domain.

email_to_domains

Find the domains registered with an email address (Whoxy reverse WHOIS).

Takes email, finds domain.

email_to_gravatar

Find the Gravatar avatar and public profile of an email address.

Takes email, finds gravatar.

email_to_infostealers

Find computers infected by an infostealer that held a login with this email address, with the stealer and what the free API shows (HudsonRock).

Takes email, finds device.

email_to_username

Extract the username part of an email address.

Takes email, finds username.

Filter

domain_alive

Narrows: keep only the domains that resolve, or that serve a website, and flag the dead ones red and the ones not answering 200 yellow.

Takes domain, finds domain.

domain_root_only

Narrows: keep only the registrable root domains (example.com, not www.example.com ), or only the subdomains.

Takes domain, finds domain.

ip_drop_cdn

Narrows: drop the IP addresses that belong to a CDN or cloud front (Cloudflare, Fastly, AWS, Google Cloud), so the next step probes only the hosts themselves.

Takes ip, finds ip.

ip_public_only

Narrows: drop private, loopback, link-local and reserved addresses, keep the ones routable on the internet. A lab with worker.allow_private_targets on does not want this step.

Takes ip, finds ip.

Graph

fields_to_entities

Draw what this entity’s fields name as entities of their own: a person’s phones, emails, addresses, bank accounts and relatives, an organization’s site, contacts and executives, a device’s addresses, a certificate’s domains, a card’s holder. Nothing is looked up.

Takes any entity, finds what the fields name.

files_to_entities

Draw what the entity’s attached files say about themselves: the place a photo was taken, the person who wrote a document, the camera it was shot with. Nothing is looked up.

Takes any entity, finds what the fields name.

IP

ip_to_abuseipdb

Read an address’s abuse confidence and reports from AbuseIPDB, red from 75 up.

Takes ip, finds ip.

ip_to_asn

Find the autonomous system announcing an IP address (RIPEstat).

Takes ip, finds asn.

ip_to_censys

List the services Censys saw on an address as ports with their software, with its location, network, names and the CVEs Censys matches.

Takes ip, finds port.

ip_to_dehashed

Find the breach records of an IP address in DeHashed and what leaked with it: the password or its hash, names, emails, usernames, phones, IPs.

Takes ip, finds breach.

ip_to_domain

Find domains for an IP address by reverse DNS, or else by certificate transparency.

Takes ip, finds domain.

ip_to_fraudscore

Score how likely an IP address is used for fraud, and flag proxies and VPNs (Scamalytics).

Takes ip, finds riskprofile.

ip_to_greynoise

Ask GreyNoise whether an address scans the internet (noise) or is a known service (riot), malicious ones red.

Takes ip, finds ip.

ip_to_infos

Geolocate an IP address and name its ISP (ip-api.com).

Takes ip, finds ip.

ip_to_ports

List open TCP ports of an IP address, from Shodan InternetDB without contacting the target, or by scanning it with nmap on the server.

Takes ip, finds port.

ip_to_shodan

List the services Shodan saw on an address as ports with their banners, with its location, network, names and the CVEs Shodan matches.

Takes ip, finds port.

ip_to_virustotal

Read how many engines call an address malicious on VirusTotal, any red.

Takes ip, finds ip.

Individual

individual_to_dehashed

Find the breach records of a person by full name in DeHashed and what leaked with it: the password or its hash, names, emails, usernames, phones, IPs.

Takes individual, finds breach.

individual_to_domains

Find the domains registered in a person’s name (Whoxy reverse WHOIS).

Takes individual, finds domain.

Location

location_to_coordinates

Find the latitude and longitude of an address (OpenStreetMap Nominatim).

Takes location, finds location.

Organization

org_to_asn

Find autonomous systems registered under an organization’s name (RIPEstat).

Takes organization, finds asn.

org_to_domains

Find the domains registered to an organization (Whoxy reverse WHOIS).

Takes organization, finds domain.

Phone

phone_to_carrier

Find the carrier and country of a phone number (Veriphone).

Takes phone, finds phone.

phone_to_dehashed

Find the breach records of a phone number in DeHashed and what leaked with it: the password or its hash, names, emails, usernames, phones, IPs.

Takes phone, finds breach.

phone_to_infostealers

Find computers infected by an infostealer that held a login with this phone number, with the stealer and what the free API shows (HudsonRock).

Takes phone, finds device.

Security

cve_to_details

Fill a CVE from the NVD (page, description, CVSS, severity, CWE, published, references, CISA KEV) and FIRST (EPSS score and percentile).

Takes cve, finds cve.

cve_to_vulnerability

Make a vulnerability of a CVE, with its severity, CVSS, CWE, description and references, open and linked to the CVE.

Takes cve, finds vulnerability.

finding_to_vulnerability

Confirm a finding: draw the vulnerability it is, with its severity, place, description and CVE, and mark the finding confirmed.

Takes finding, finds vulnerability.

vulnerability_to_details

Fill a vulnerability’s empty fields from the NVD record of its CVE (severity, CVSS, CWE, description, references) and link the CVE.

Takes vulnerability, finds cve.

Social

username_to_accounts

Find the sites a username has a profile on, by asking each one (GitHub, YouTube, Steam and more).

Takes username, finds socialaccount.

username_to_dehashed

Find the breach records of a username in DeHashed and what leaked with it: the password or its hash, names, emails, usernames, phones, IPs.

Takes username, finds breach.

username_to_infostealers

Find computers infected by an infostealer that held a login with this username, with the stealer and what the free API shows (HudsonRock).

Takes username, finds device.

Website

tech_detect

Detect the technologies a website runs, from its headers and HTML.

Takes website, finds technology.

website_to_crawler

Crawl a website for the email addresses and international phone numbers it publishes.

Takes website, finds email.

website_to_domain

Extract the domain of a website, without www.

Takes website, finds domain.

website_to_links

Crawl a website and link it to the sites its pages link to.

Takes website, finds website.

website_to_subdomains

Find the subdomains of a website, from subfinder and crt.sh, or from c99.nl with its address and Cloudflare flag.

Takes website, finds website.

website_to_text

Extract the visible text of a website.

Takes website, finds phrase.

website_to_webtrackers

Find the analytics and advertising IDs a website embeds (Google, Meta, Hotjar, Yandex).

Takes website, finds webtracker.