Intelligence sources

What The Gates Query

71 of 105 sources are live on this instance. A source without its API key is switched off rather than failed — the investigation simply proceeds without it, and says so in the report.

danish

Denmark-specific registries. The reason this platform exists in its current shape.

Danish phone numbers (OCH/CPS)

Number series, region and type for Danish numbers, plus the operator behind a CPS code or retail brand from the OCH register.

phone org

Danish reverse number lookup (180.dk)

Subscriber name, website and address behind a Danish phone number, plus how often it has been looked up and reported as nuisance.

phone

Danish address register (DAWA)

Verifies Danish addresses against the official register, canonicalises the spelling, and adds coordinates and municipality.

location

Danish building register (BBR)

What kind of building an address is: how many units share the door, the plot and footprint it stands on, and - with a free Datafordeler account - BBR's year built, floor area, use code and heating.

location

Danish CVR register (official distribution)

The official Danish company register: beneficial and legal owners with percentages, officers with date ranges, production units, former names and addresses, and status history. Needs an Erhvervsstyrelsen system-to-system agreement; without one it hands over the official lookup links instead.

org person phone

Danish CVR register

Danish company register: CVR number, legal name, address, industry, employees, management and contact details. No key needed for light use.

domain org person phone

Danish annual reports

Official Danish annual report filings for a company: every financial year on record with its adoption date, the signing management, the auditor and audit firm, the address on the filing and the headline figures. No key needed.

org

Nordic company registers

Official company data from Norway (Brønnøysund) and Finland (PRH), for companies outside the Danish CVR.

org

Statstidende (Danish state gazette)

Official Danish legal notices with their dates: bankruptcy, compulsory dissolution, reconstruction, debt relief, probate, forced sales and summonses. Free, no key.

org person

Danish person directories (manual leads)

Builds ready-to-click Krak, De Gule Sider, 180.dk and CVR lookup links for a named person. Those sites block automation, so the lookup itself stays manual.

person

Danish courts (Domsdatabasen)

Published Danish court decisions naming a party or counsel: court, case number, instance, date and the ruling's own headline. Decisions are pseudonymised, so private individuals cannot be looked up.

org person

dns

Name resolution and everything published in a zone. Cheap, fast, and the backbone of any infrastructure investigation.

DNS records

A, AAAA, MX, NS, TXT, SOA, CNAME and CAA records, fanning out into every address and name they point at.

hostname domain

Reverse DNS

PTR record for an address, plus the provider domain implied by the reverse name.

Mail security (SPF/DMARC/DKIM)

Email authentication records, the third-party senders they authorise, and whether the domain can be spoofed.

domain hostname

Extended DNS resolution

Resolves a name across record types and detects wildcard zones, so guessed subdomains are not taken at face value.

hostname domain

RDAP registration data

Structured registration data for a domain, address range or ASN - registrar, contacts and lifecycle dates.

domain ip asn

Common subdomains

Resolves around 70 conventional subdomain names (including Danish ones) to find hosts nothing else has published.

domain

Passive DNS (Mnemonic)

Historical DNS: every address a name has resolved to, and every name seen pointing at an address, with dates.

domain hostname ip

Chaos (ProjectDiscovery) — needs your key

A precomputed subdomain dataset for domains running a public bug bounty programme - near-complete for those, empty for everything else.

add your key: chaos

domain

Passive DNS (DNSDB) — needs your key

Every address a name has resolved to and every name seen on an address, with first and last-seen dates and the zone that served each answer.

add your key: dnsdb_key

domain hostname ip

Passive subdomain discovery

Subdomain names collected from certificate logs, passive DNS and search indexes across many providers.

domain

CIRCL Passive DNS + Passive SSL — needs your key

Historical DNS from CIRCL's European sensor network back to 2012, and - unique here - every TLS certificate an address has ever presented, including self-signed ones no transparency log holds.

add your key: circl_user, circl_password

domain hostname ip

HackerTarget

Reverse IP lookup and host search: the other names on an address, and the hostnames of a domain.

ip domain

SecurityTrails — needs your key

Complete subdomain inventory plus historical A-record and nameserver data for a domain.

add your key: securitytrails

domain

ViewDNS.info — needs your key

Historical addresses for a domain, other names on an address, and the domains sharing a nameserver or mail server.

add your key: viewdns

ip domain hostname

Typosquat and lookalike domains

Registered lookalike domains - homoglyphs, misspellings and TLD swaps - and which of them can receive mail.

domain

exposure

Blockchain activity

Balance, totals, transaction count and first and last use of a Bitcoin or Ethereum address.

wallet

File metadata

Author, organisation, software, GPS coordinates and timestamps out of a discovered document or image.

file url

Dark web monitor — needs your key

What a monitored catalogue of onion services knows about an address - name, category, and when it was last reachable.

add your key: darkweb_monitor

onion_service

Onion service probe

Fetches an onion service over Tor right now: whether it answers, its title, server and what it asks of a visitor.

onion_service

Public cloud buckets

Guesses cloud-storage bucket names from the subject's own name and reports which exist and which are world-readable.

org domain

LeakIX (open services) — needs your key

Services left answering without authentication - open databases, exposed .git and .env files, unprotected admin consoles - for an address, domain or hostname.

add your key: leakix

ip domain hostname

Public SaaS workspaces

Slack, Atlassian, Trello, GitBook, Zendesk and Freshdesk workspaces under a slug guessed from the organisation's name.

org domain

Paste and dump index — needs your key

Public pastes and leak dumps that mention an address, domain, IP or handle - identity, date and size only, never the contents.

add your key: intelx

email domain ip username

Repository secret detection

Credentials committed to a public repository's history, with each hit tested against the issuing provider.

repository

infrastructure

Who owns the address space, who registered the name, and where it physically sits.

ASN & geolocation

Autonomous system, network owner and approximate location for an address, from the GeoLite2 databases.

IP-to-ASN (Team Cymru)

Live announcing AS, covering prefix, registry and allocation date for an address, over a single DNS query.

RIPEstat

Routing state, announcing AS, covering prefix and registry abuse contact for an address, prefix or ASN.

ip netblock asn

IPinfo — needs your key

Company, network and privacy detection for an address - VPN, proxy, Tor, hosting or relay.

add your key: ipinfo

Domain WHOIS

Registrar, registration and expiry dates, nameservers, and registrant/admin contacts where the registry discloses them.

domain

IP WHOIS (RIR)

Netblock, holder organisation, abuse contact and registry persons for an address, from RIPE/ARIN/APNIC and friends.

Corporate tenant discovery

Which identity platform a domain uses - Microsoft 365, Google Workspace, Okta - and the tenant it belongs to.

domain

PeeringDB

Operator-published network detail: exchange and facility presence, peering policy and contact addresses.

asn

Shodan — needs your key

Open ports, service banners, product versions and known CVEs for an address, from Shodan's index.

add your key: shodan

Netlas — needs your key

Open ports, detected software, TLS certificates and related domains for an address, domain or hostname, from Netlas's internet-wide scan index.

add your key: netlas

ip domain hostname

Censys — needs your key

Open services, detected software with CPEs, TLS certificates and known vulnerabilities for an address - and, on a paid tier, the addresses that have presented a certificate naming a domain.

add your key: censys_pat

ip domain hostname

ONYPHE — needs your key

Scan observations, resolver history, certificate transparency, paste sightings and threat-feed membership for an address, domain or hostname, from ONYPHE's own EU-operated collection.

add your key: onyphe

ip domain hostname

THUGS(red) Wardrive

WiFi access points whose SSID resembles a name, with the coordinate they were observed at.

org person domain hostname location wifi_network

Aircraft register and movement

Resolves a registration or ICAO 24-bit address to the airframe behind it, its country of registry and its recorded operator, and reports where it was last seen transmitting - as an observation at a stated moment, never as a current location.

aircraft org

people

Identity pivots: addresses, handles, accounts and exposure.

Email breakdown

Splits an address into username and domain, checks deliverability and Gravatar, and classifies the provider.

Gravatar profile

The public profile, display name and linked accounts attached to an email address on Gravatar.

Wikidata

Structured public facts about a named person or organisation: handles, website, employer, education, places and registry identifiers.

person org

Web search (exact name) — needs your key

Searches the web for the exact quoted name or handle across Brave, Google and Bing, using whichever of those you hold a key for.

add your key: a key for Brave Search, Google Programmable Search or Bing

person org username email

ORCID

The researcher identity register: a stable identifier, current institution and publishing affiliations for a named academic.

person

Phone validation (Abstract / numverify) — needs your key

Whether a phone number is valid, what kind of line it is, and which carrier and country it belongs to - any country, on a free-tier key.

add your key: abstractapi_phone, numverify

phone

Username across platforms

Checks around 50 public profile pages - code hosting, social, gaming, media and blogs - for the same handle.

username

EmailRep reputation — needs your key

Reputation, credential-leak and breach flags, first- and last-seen dates, and the platforms an email address has been observed on.

add your key: emailrep

GitHub — needs your key

Profile, organisations, repositories and the author email addresses behind an account's public commits.

add your key: github

username domain org

WebFinger / fediverse

Resolves an address or handle to its fediverse profile, and detects a domain running a Mastodon-style server.

email domain hostname

Bluesky (AT Protocol)

Public Bluesky profile, every handle the account has ever used, and domain-verified handles.

username domain

GitLab

GitLab.com profile, public projects, languages and the groups a name matches. Works without a token.

username org

Open Library

Published books under a name, with the alternate spellings and pen names the same author has published under.

person

Telegram username

Whether a Telegram username exists and what it is - person, channel or group - from the public preview page.

username

Reddit — needs your key

Account age, karma, suspension state, the communities a handle posts in and the hours of day it is active.

add your key: reddit_client_id, reddit_client_secret

username

GLEIF (LEI register)

Legal entity identifier, registered address, legal form and the corporate parent chain for a company.

org

OpenCorporates — needs your key

Company and officer records across 140-plus jurisdictions - the breadth source when no national register applies.

add your key: opencorporates

org person

Have I Been Pwned — needs your key

Known breaches containing an email address, with the data classes each breach exposed.

add your key: hibp

Hunter.io — needs your key

Published email addresses for a domain, the organisation's address pattern, and the people behind them.

add your key: hunter

domain

ENS name records

Resolves an ENS name to its wallet and back, and reads the social handles, email and website the holder published on it.

wallet username domain

Location context (OpenStreetMap)

Checks what is actually mapped at an address or coordinate - the kind of building, the land use, and the named businesses within 50 metres, including mail-forwarding and virtual-office providers.

location

ICIJ Offshore Leaks (manual lookup)

Prepares Offshore Leaks searches for a name, company or place. The database is open but its search blocks automation, so the lookup itself stays with the researcher. A hit is never evidence of wrongdoing.

person org location

Username sweep across platforms

Checks a handle against ~260 sites and mines the profiles it finds for names, places and other handles.

username

Account registration check

Which of ~120 sites an email address is registered at. Interacts with the subject's account-recovery flows and may alert them.

Phone numbers worldwide (HLR / MNP / NT) — needs your key

Number type, validity and the operator that actually serves a phone number today - any country, portability included - plus, on request, whether the handset is currently reachable and roaming.

add your key: hlr_lookups_key, hlr_lookups_secret

phone

reputation

Whether anyone else has already seen this host behaving badly.

Exploitation status (KEV + EPSS)

Whether a CVE is known to be exploited in the wild, and its modelled probability of exploitation.

cve

DNS blocklists

Checks an address or domain against Spamhaus, SpamCop, Barracuda, SORBS and SURBL over plain DNS, and decodes why it is listed.

ip domain

VirusTotal — needs your key

Vendor reputation verdicts, categories and passive DNS resolutions for a domain or address.

add your key: virustotal

domain ip

GreyNoise — needs your key

Whether an address is internet background noise, a benign crawler or a known malicious scanner, with its observed tooling.

add your key: greynoise

AbuseIPDB — needs your key

Community abuse reports for an address: confidence score, report categories and operator details.

add your key: abuseipdb

AlienVault OTX — needs your key

Passive DNS, observed URLs and community threat reports naming a domain, host or address.

add your key: otx

domain hostname ip

Pulsedive

Community risk score, named threats, threat-feed membership and the passive DNS, TLS and HTTP observations behind them.

domain hostname ip url

NVD (CVE records) — needs your key

The official CVE record: description, CVSS severity and affected products, for a CVE or a technology.

add your key: nvd

cve technology

abuse.ch (URLhaus, ThreatFox, MalwareBazaar) — needs your key

Malware distribution URLs and whether they are still live, botnet command-and-control attribution by malware family, and known malware samples by file hash.

add your key: abusech

domain hostname ip url file

Malware sandbox reports — needs your key

Existing sandbox analyses for a file hash or URL: score, family, and the hosts, domains and addresses the sample contacted when it ran.

add your key: triage

file url

OpenSanctions (sanctions, PEP, watchlists) — needs your key

Screens a person, company, address or crypto wallet against consolidated sanctions, PEP and enforcement watchlists. Reports possible matches with their score - never a verdict.

add your key: opensanctions

person org location wallet

Vulners (exploit availability) — needs your key

Whether public exploit code exists for a vulnerability and where it is published, plus vendor-curated version matching for a product and version.

add your key: vulners

cve technology

Flare — needs your key

Leaked credentials, stealer-log infections, breaches and dark-web mentions for a domain, email, host, IP or username.

add your key: flare

domain hostname email ip username org

GrayHatWarfare (open buckets) — needs your key

Publicly readable cloud buckets and files matching a domain, hostname or company name - the accidental disclosures nobody involved knows are open.

add your key: grayhatwarfare

domain hostname org website

web

What the web servers, certificates and archives disclose about an estate.

Domain popularity (Tranco)

Where a domain sits in Tranco's daily research ranking of the most-visited domains, and how that has moved - context for weighing every other finding.

domain

HTTP probe

Landing page title, server banner, technology fingerprints, redirect chain and missing security headers.

hostname domain ip url

TLS certificate

Live certificate subject, issuer, validity and every hostname in the SAN list.

hostname domain

HTTP service fingerprint

CDN and WAF in front of a host, TLS certificate, detected technologies with CPEs, and the favicon hash.

hostname domain website

Favicon hash pivot

Hashes the site icon the way Shodan and FOFA index it, and finds other hosts serving the identical artwork.

website domain hostname

Web platform and versions

The CMS, framework, server and libraries a site is built on, with version numbers where the site discloses them, plus whatever is filtering in front of it.

hostname domain website

Certificate Transparency

Subdomains and historical certificates for a domain, from the public CT logs via crt.sh.

domain

Cert Spotter (SSLMate)

Subdomains and issuing CAs from Certificate Transparency via SSLMate Cert Spotter - a second CT source, independent of crt.sh.

domain

SSL Labs (TLS configuration grade)

Grades a host's whole TLS configuration - protocols, ciphers, forward secrecy, HSTS and named protocol vulnerabilities - against the Qualys rubric.

hostname domain website

Wayback Machine

Historical URLs and subdomains from the Internet Archive CDX index, including files that are no longer published.

domain

Common Crawl

Subdomains, paths and archived documents from Common Crawl's open monthly web index - a second corpus alongside the Wayback Machine.

domain hostname

urlscan.io

Existing public page scans for a domain: page titles, servers, screenshots and the domains each scan contacted. Key optional.

domain

Website content

Reads a site's own pages - contact, about, terms, imprint - for the addresses, numbers, company registrations, people and accounts it publishes about itself.

website domain hostname url

GitHub code search — needs your key

Public source code that mentions a domain, company name or address - internal hostnames and credential files committed by others.

add your key: github

domain org email

Sourcegraph code search

Regular-expression search of public source code: every subdomain of a domain, or a company name, wherever somebody has committed it.

domain org

Analytics and tag ids

Reads the analytics, tag manager and advertising ids a site publishes in its own markup, and - with a provider key - finds the other sites carrying the same id. Two domains sharing one are administered together even when WHOIS is redacted.

website domain

Rendered page capture

Opens the page in a real browser and keeps a picture of it, with the rendered title and the address it actually ends up at.

website url

Collection ethics

Everything here is passive. Public DNS, public WHOIS, public transparency logs, public archives, and vendor APIs reporting what they already indexed. The only requests made to a target are ordinary HTTP GETs to its front page on port 80 or 443 — the same thing a browser does — plus a TLS handshake to read the certificate it presents to everyone.

Outbound requests are rate limited per source so a wide fan-out does not look like an attack to the far end, and every response is cached so re-opening an investigation tomorrow costs the source nothing.

Start an investigation