SiteCheck Web Intel

Lists the TCP ports Shodan has seen open on an IPv4 address, from its pre-collected passive scan data (not a live scan: nothing connects to the address now). The record can be days old, and an address with no record returns known=false, which does not prove the ports are closed.

Reports whether Shodan's pre-collected passive scan data shows TCP port 53 (DNS) open on an IPv4 address. It is a passive port fact only: it does not send a query, so it cannot say whether the server answers recursively for outside names. Absence means not seen, not closed.

Checks a URL or host against the OpenPhish public phishing feed (about 300 currently active phishing URLs, updated continuously). Returns whether the exact URL or any URL on the same host is listed, the feed size and up to 5 example URLs. Not listed does not mean safe; the feed is short and changes fast.

Looks one http or https URL up in the PhishTank phishing database (live checkurl lookup, no key). Returns whether PhishTank has the URL and, if so, its phish id, verification flag and validity. Absence means PhishTank has no record of this exact URL, not that it is safe.

Checks Shodan's passive scan records for TCP port 3389 (RDP) on an IPv4 address. Says whether RDP was seen open (not a live test, and the record can be days old). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.

Reads a site's Referrer-Policy header and its <meta name=referrer> tag from the home page, works out the policy a browser would apply, and rates how much of the URL it sends to other sites (strict, moderate or leaky). One GET; links on other pages can set their own policy.

Reverse DNS (PTR) names for an IPv4 address, and forward-confirmed reverse DNS: whether each PTR name resolves back (A record) to the same address. Up to 3 PTR names are checked. Many addresses have no PTR record; that is a normal answer.

Checks the live HTTP response headers of a site's home page (one GET, https) for Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and Cross-Origin-Opener-Policy. Returns present/missing headers with their values and a score out of 7. It does not judge the quality of the values.

Checks Shodan's passive scan records for TCP port 445 (SMB) on an IPv4 address. Says whether SMB was seen open and when the record was last refreshed by the host data (not a live test). An address with no Shodan record returns seen=false with known=false; that is not proof the port is closed.

Reports whether Shodan's pre-collected passive scan data shows SNMP (UDP port 161) seen open on an IPv4 address. Passive and possibly old; no community string is tried, so default or public community access is not tested.

Checks an IPv4 mail-sending address against the SpamEatingMonkey DNS blocklist (bl.spameatingmonkey.net) through public DNS. A listed address returns its 127.0.0.x return code; an unlisted one returns no record. Listings change often; this is a point-in-time answer.

Spamhaus blocklist check through Spamhaus's official Data Query Service: an IPv4 address against ZEN (SBL spam sources, CSS snowshoe, XBL exploited/botnet hosts, DROP hijacked ranges, PBL end-user ranges) or a domain against the Domain Block List (spam, phishing, malware, botnet C&C, abused legitimate domains). Returns listed yes/no, every return code with the list it means, and Spamhaus's lookup

From Shodan's pre-collected passive scan data: whether TCP port 22 was seen open on an IPv4 address and any OpenSSH version identified in its software (CPE) list. This is passive and may be days old; it is not a live SSH banner grab or algorithm audit.

HTTPS certificate chain and cipher audit for a host (port 443) from Qualys SSL Labs' cached report: grade, number of certificates in the chain, trust store, TLS versions, weak-cipher count, Heartbleed/POODLE/BEAST flags and HSTS. Only reads reports SSL Labs already has, so a host that was never scanned returns a retry error instead of a new scan.

For a subdomain: finds its CNAME, matches the target against the public can-i-take-over-xyz fingerprint list (services such as GitHub Pages, S3, Azure, WordPress), checks whether the target still resolves, and fetches the subdomain once to look for the service's 'unclaimed' page text. Verdicts are evidence, not proof; the list is community-maintained.

Checks a domain against SURBL's multi-list (multi.surbl.org): whether it appears in spam or phishing URI lists. Listed domains return a 127.0.0.x code. Not listed means not in SURBL's current lists, not that the domain is safe.

Cisco Talos reputation for an IPv4 address: threat level (favorable, neutral, poor, untrusted), web reputation score, forward/reverse DNS match, hostname, owner, location, email volume magnitude (daily, monthly and last 30 days), the /24 network's average magnitude and how many neighbouring addresses in that /24 Talos rates untrusted, poor, neutral or favorable.

Searches abuse.ch ThreatFox for indicators of compromise matching a term (IP, IP:port, domain, URL or file hash): IOC, type, malware family, threat type, confidence, first/last seen, reporter, tags and Malpedia link. Optional exact match and a first-seen window in days.

Reports which newer HTTP protocols a site advertises: HTTP/3 (h3) and older draft or HTTP/2 alternatives in its Alt-Svc response header, and the Alt-Svc max-age. This is what the server announces, not a TLS ALPN negotiation: the fetch this tool makes cannot choose the protocol, so a site that negotiates but does not send Alt-Svc will show as not advertised.

TLS versions a host accepts (SSL 3, TLS 1.0 and 1.1 flagged as deprecated) and its cipher-suite strength from Qualys SSL Labs' cached report: suite count per protocol, weak suites (RC4, 3DES, NULL, EXPORT, DES, anonymous), and whether forward secrecy is offered. Reads existing reports only; a host that was never scanned returns a retry error.

Checks an IPv4 address against the Tor Project's bulk exit list (about 1,200 active exit IPs). If it is an exit, adds the relays for that address from Onionoo: nickname, flags, country, first and last seen. Only exit IPs are on the list; a relay's other IPs are not checked.

Checks whether a host (domain or IP) is known to abuse.ch URLhaus as a malware distribution host: first seen, number of malware URLs, Spamhaus DBL / SURBL status and the latest URLs with status (online/offline), threat type, tags, reporter and URLhaus reference.

Checks an IPv4 address against the public X4BNet list of commercial VPN provider address ranges (about 11,000 CIDR blocks, refreshed by the list's maintainer). Returns whether the address falls in a listed VPN range and which range. A miss does not prove a direct connection, and IPv6 is not covered.

Domain registration facts via RDAP (IANA bootstrap, then the registry's own server): registration, last change and expiry dates, days left, registrar name, status flags, nameservers and DNSSEC delegation flag. Registrant contact data is usually redacted by registries and is not returned.

DataCite DOI search (public REST API, no key): DOI, title, publication year, resource type, publisher, creators and landing page for datasets, software and other research outputs. Metadata only.

US Department of Justice press releases from the justice.gov public RSS feed (keyword filter on title/summary). Latest items only. Public feed, no key.

Checks a certificate SHA-1 fingerprint (40 hex characters) against the abuse.ch SSL Blacklist of certificates seen on malware botnet C2 servers. A hit returns the date added and the malware reason from the list. Only certificates this list tracks are covered.

Top 50 dapps from DappRadar's public rankings page: rank, name, token symbol, chains, market cap, token price, price change, trading volume, unique active wallets (UAW) and TVL, for 24h/7d/30d, optionally for one chain (eth, solana, bnb, base, polygon, arbitrum, tron...). Values in USD as shown by DappRadar; missing values are null. Public page, no key.

Latest Benzinga financial news (the public JSON feed behind benzinga.com): headline, teaser, author, time, URL, tickers, channels and tags. Filter by stock tickers (e.g. AAPL,TSLA) and/or words in the headline/teaser. Newest first, up to 100 stories; no paging into older news, no full article text. Public, no key.