Blog on Intelx.io Blog

Export Stealer Log

Sun, 08 Feb 2026 00:00:00 +0000

We’ve added a new feature to the Identity Portal: Export Stealer Log. Previously, downloading a complete Stealer Log required multiple individual file downloads.

Now, you can download all files that belong to a single ‘Stealer Log’ as a single ZIP file using this feature:

Find the System ID: It is in the URL on intelx.io after clicking a result, or in the Metadata tab under “Show Expert Information”.
Enter it in the Export Stealer Log section of the Identity Portal.
Download the full ZIP archive. The original folder structure is preserved.

This new function uses its own credits and is implemented in the Leaks API. Previously users needed to use the Search API function /file/read to download each file individually, which consumed one credit per file.

Tool Updates

Fri, 24 Oct 2025 00:00:00 +0000

We just updated our intelx.io/tools page for the first time in years. You can read the changelog here.

New Tree View API Endpoint

Fri, 13 Jun 2025 00:00:00 +0000

We just launched a new Search API endpoint to retrieve the Tree View data!

See the documentation in our help system: help.intelx.io/api/search/#filetreeview

API License

For the first time since launching the API license in 2022, we are increasing its price to € 7.000,- /Year. Since 2022, a lot has happened:

Our total records more than doubled from 100 billion records to more than 220 billion records.
With the increased data comes increased datacenter costs.
Several new features, with the latest being the Tree view endpoint.
We recently launched our new help system at help.intelx.io which we continue to improve and maintain.

New Search API Instances

Sat, 08 Mar 2025 00:00:00 +0000

Earlier this month we changed the Search API instances for non-registered users and free users. The previous instance “api.intelx.io” is retired. To see the API instance and API key assigned to your account, visit the Developer Tab 🔒 on your user account page. The “Search API” is the API that powers intelx.io.

Here is the new list:

Search API Instance	Target
public.intelx.io	Non-registered users
free.intelx.io	Free users (who have signed up on intelx.io)
2.intelx.io	Paid users

User accounts are only valid for their assigned API instance. If you upgrade your account, you must switch the API URL to the paid API instance.

New Category “DNS”

Sun, 12 Jan 2025 00:00:00 +0000

We have added a new category “DNS” to Intelligence X. It indexes DNS records data such as raw TXT records for domains. The bucket name is “dns”. As of today, the bucket stores 204.489.722 records.

Full access to this new category requires a paid account. Access to this data is possible across our product portfolio.

The data can help in investigations of domains to find out ownership and related services. DNS TXT records often contain site-verification tokens for Google and Facebook which can be an important lead if the domains ownership is otherwise not publicly disclosed (privacy protected whois data).

New Identity Portal Version 💥

Fri, 03 Jan 2025 00:00:00 +0000

We added an extremely powerful new feature to our Identity Portal product: Reverse Lookup

You can now search for a domain or URL and get all leaked accounts for a particular service.

Previously you would have to manually search for the domain or URL and click through potentially hundreds or thousands of results. This feature exclusively searches the Stealer Logs data and is currently in beta mode. We will improve the algorithms over time to cover different formats of the Stealer Logs data.

Newsletter 2023-01-01

Sun, 01 Jan 2023 00:00:00 +0000

2023 New Year’s Special 🍾

Our New Year’s Special is live! 🍾🥂

1-month license for € 50!
This offer is valid for a week until January 7, 2023.
Full access (same as Researcher license).
This equals to a 76% discount.

You can order it here: intelx.io/order 💸

2022 for Intelligence X

2022 was an incredible year for us. Our dataset grew to over 100 billion records! Our team had a lot of fun continuing the development of our search engine, and we would like to thank our customers for their trust and support.

Price Increase 2023

Sat, 19 Nov 2022 00:00:00 +0000

Starting with December 1, 2022 we are changing license tiers and adding new tiers. This is essentially a price increase. Orders placed before that date are not affected.

Here are the main changes:

The Professional license will be sunsetted.
A new Researcher (€ 2.500,- /Year) license is introduced which is aimed towards individuals.
A new API license (€ 5.000,- /Year) is required for any organization that integrates our API into their product. This license includes full access via intelx.io. It includes 500 searches per day.
The Identity Portal license increases to € 7.500,- /Year.

Why the increase

In the last 3 years we have not changed our prices. However, since then a lot has changed:

List of buckets

Thu, 05 May 2022 00:00:00 +0000

At Intelligence X we categorize data sources into buckets. Buckets can be used as filters and to broadly identify the source of individual search results. For example, the bucket “Darknet Tor” indicates the result origins from some a Tor hidden service (.onion domain) and was collected by our Tor crawler.

Buckets have human readable names and machine readable names, in the above example, it is “darknet.tor”. Another one would be “web.public.com” for data coming from the public web .com domains.

Adding support for new top-level domains

Wed, 06 Apr 2022 00:00:00 +0000

We just added support for an additional 152 top-level domains (TLDs), increasing the support to 511 TLDs in total.

Support means that you can search for those domains across intelx.io and APIs, and internally that our backend supports processing them.

While you can start searching for them immediately, it will take some time until our indexers are re-processing the existing data set. We will start the re-indexing process soon after adding support for some additional crypto currency addresses (such as Ethereum addresses).

A word of #OPSEC @theguardian

Mon, 07 Mar 2022 00:00:00 +0000

Earlier today at 11:24 The Guardian Journalist Shaun Walker posted the security procedure and the security token used to pass makeshift checkpoints in Ukraine related to the Russian Ukrainian war:

This is a reminder to journalists – and the public – to take OPSEC (operations security) seriously and not endanger people on the ground.

Posting a security token – whether digital (cookies, passwords, keys) or physical is endangering the people this very security token tries to protect.

Newsletter 2022-03-01

Tue, 01 Mar 2022 00:00:00 +0000

We stand with Ukraine 🇺🇦

Intelligence X commends the brave Ukrainian soldiers. 🇺🇦

Free access for the Ukrainian Government

We have whitelisted the domain gov.ua – all accounts signed up on intelx.io with that email ending have full access to 100 billion records. This includes access to our Identity Portal which allows users to quickly identify data leaks and parse through a lot of data.

We extended this access to the European Commission and all institutions working on imposing sanctions on Russia and Belarus.

Newsletter 2021-12-24

Fri, 24 Dec 2021 00:00:00 +0000

December 2021: Christmas Special 🎄🎁

Merry Christmas! To celebrate, we are offering a special 1-month license for € 50. This offer is valid for a week. It provides the same type of access as the Pro license that costs € 2000 /year.

To take advantage of this Christmas special, go to intelx.io/order.

License Changes in 2022

In 2022, we are going to update our pricing page. The base price of 2000 EUR remains, but will be designated for researchers and analysts (humans).

Intelligence X welcomes seasoned Security Expert to Advisory Board

Thu, 02 Dec 2021 00:00:00 +0000

Co-Founder of QuoScient GmbH and QuoLab Technologies Inc., former Global Head of Malware Research and Response at Deutsche Bank joins Intelligence X’s newly created advisory board as the company is gaining momentum.

“We are very happy to welcome Fabien today to our advisory board at a time when we keep expanding on our services beyond collecting data, but also to provide additional value to a growing customer base”, says Peter Kleissner, CEO of Intelligence X. “Fabien brings broad hands-on experience in terms of cyber security operations, both from the technical use cases and product strategy points of view, which will without a doubt greatly support Intelligence X in its mission to deliver the best in class capability to our customers.”

Newsletter 2021-06-29

Tue, 29 Jun 2021 00:00:00 +0000

June 2021: New Usenet data category

We added the new data category Usenet. It contains historical and current data from Usenet, which is “a worldwide distributed discussion system”. Today, Usenet is mostly used for piracy. This new category stores currently 209,469,453 selectors and is expected to grow substantially.

Improved inline statistics

We have improved the inline statistics that appear on intelx.io after you perform a search (the statistics open up when clicking on the summary line or button next to it). To declutter, we grouped all “Web” results separately.

Newsletter 2021-04-16

Fri, 16 Apr 2021 00:00:00 +0000

Intelligence X supports Peernet – Founder’s Statement

I am excited to announce Peernet, a decentralized network that allows sharing of data freely without censorship and restrictions. Here is the pitch deck: peernet.org/dl/Peernet%20Deck.pdf

Peernet is making quick progress from its inception as I am finalizing the whitepaper and developing the core library. I would like to invite anyone who is interested to participate in whatever capacity possible – whether as a member of the public (brainstorming about the protocol and software), a developer, or an investor. We are about to close the initial Seed Round of € 400,000 which will finance the first version of the Peernet Browser.

Newsletter 2021-02-20

Sat, 20 Feb 2021 00:00:00 +0000

February 2021: Launch of the European Internet Archive

The European Internet Archive just launched! 🎉🥳

➡ archive.eu

225 TLDs added to the list of web crawling

We have added 225 top-level domains (TLDs) to the list of web crawling. Find the full list and how we are categorizing them in this blog post.

Our dataset is now growing by 4 billion records per month!

Bot Logs

We have added the new category “Bot Logs”. It contains data collected by and leaked from viruses such as AZORult. Such data is often sold on marketplaces such as the Genesis Market. We decided to index such data into this new category to help filtering out relevant results. You can find this new category in the Advanced menu.

New Category “Bot Logs”

Wed, 10 Feb 2021 00:00:00 +0000

We have added the new category “Bot Logs”. It contains data collected by and leaked from viruses such as Azorult. Such data is often sold on marketplaces such as the Genesis Market. We decided to index such data into this new category to help filtering out relevant results.

You can find this new category in the Advanced menu.

Note that access is exclusively provided to paying customers (with a Professional license or higher), although other licenses can see a preview of its data.

Adding 225 TLDs to the list of web crawling

Thu, 28 Jan 2021 00:00:00 +0000

We are excited to announce that we just added 225 top-level domains (TLDs) to the list of web crawling! Below is the full list. The domain count per TLD represents the domains registered according to DomainTools. We group multiple TLDs into “buckets” to make it manageable – you can select these buckets in the Advanced menu next to the search button on intelx.io!

TLD	Country	Bucket	Domain Count per TLD	Domain Count per Bucket
AT	Austria	web.public.de	1,327,983	18,672,594
DE	Germany		15,106,819
LU	Luxembourg		89,822
LI	Lichtenstein		55,656
CH	Switzerland		2,092,314
UA	Ukraine	web.public.ru	566,476	5,599,820
KZ	Kazakhstan		148,691
RU	Russia		4,884,653
KP		web.public.kp	37	37
COM		web.public.com	150,953,990	150,953,990
BIT		web.public.peer
BAZAR
GOV		web.public.gov	6,324	6,324
ORG		web.public.org	10,317,554	10,317,554
NET		web.public.net	13,291,542	13,291,542
INFO		web.public.info	4,147,726	4,147,726
EU		web.public.eu	3,597,950	3,597,950
CN	China	web.public.cn	13,982,944	13,982,944
UK	United Kingdom	web.public.nord	10,300,887	14,713,717
IE	Ireland		288,539
IS	Iceland		65,529
DK	Denmark		1,306,074
NO	Norway		754,552
FI	Finland		483,625
SE	Sweden		1,508,703
GL	Greenland		5,808
AD	Andorra	web.public.we	2,053	15,862,803
ES	Spain		1,942,335
FR	France		3,593,494
IT	Italy		3,020,524
MC	Monaco		3,927
MT	Malta		15,515
NL	Netherlands		5,371,427
BE	Belgium		1,586,787
PT	Portugal		324,124
SM	San Marino		2,213
VA	Vatican		404
AL	Albania	web.public.cee	21,749	7,762,975
BA	Bosnia & Herzigovina		23,143
BG	Bulgaria		63,485
BY	Belarus		129,091
CZ	Czech Republic		1,271,461
EE	Estonia		128,346
GR	Greece		420,271
HR	Croatia		103,458
HU	Hungary		797,657
LT	Lithuania		198,736
LV	Latvia		113,289
MD	Moldova		25,032
ME	Montenegro		1,025,732
MK	North Macedonia		29,352
PL	Poland		2,240,128
RO	Romania		518,760
RS	Serbia		112,901
SI	Slovenia		124,981
SK	Slovakia		415,403
AG	Antigua and Barbuda	web.public.ams	19,104	13,829,992
AI	Anguilla		83,644
AR	Argentina		482,912
AW	Aruba		697
BB	Barbados		1,592
BM	Bermuda		3,106
BO	Bolivia		12,293
BQ	Caribbean Netherlands		–
BR	Brazil		3,837,643
BS	Bahamas		2,486
BZ	Belize		28,272
CA	Canada		2,871,681
CL	Chile		514,302
CO	Colombia		2,905,726
CR	Costa Rica		16,413
CU	Cuba		1,939
CW	Curaçao		875
DM	Dominican Republic		2,384
DO	Dominican Repuplic		26,031
EC	Ecuador		43,454
FK	Falkland Islands		145
GD	Grenada		2,456
GF	French Guiana		933
GP	Guadeloupe		2,173
GT	Guatemala		18,202
GY	Guyana		3,119
HN	Honduras		7,731
HT	Haiti		2,792
JM	Jamaica		7,386
KN	Saint Kitts and Nevis		829
KY	Cayman Islands		6,480
LC	Saint Lucia		3,729
MQ	Martinique		1,043
MS	Montserrat		8,970
MX	Mexico		929,819
NI	Nicaragua		4,695
PA	Panama		11,365
PE	Peru		112,857
PR	Puerto Rico		4,682
PY	Paraguay		22,897
SR	Suriname		3,165
SV	El Salvador		8,619
SX	Sint Maarten		2,761
TC	Turks and Caicos Islands (UK)		7,415
TT	Trinidad and Tabago		3,946
US	United States		1,661,201
UY	Uruguay		76,013
VC	Saint Vincent and the Grenadines		27,649
VE	Venezuela		26,307
VG	US Virgin Islands		4,481
VI	British Virgin Islands		1,578
AC	Ascension	web.public.af	8,294	16,663,118
DZ	Algeria		9,880
AO	Angola		6,618
BJ	Benin		1,396
BW	Botswana		8,242
BF	Burkina Faso		1,643
BI	Burundi		2,738
CM	Cameroon		49,827
CV	Cape Verde		2,452
CF	Central African Republic		3,918,575
TD	Chad		582
KM	Comoros		141
CD	Democratic Republic of the Congo		6,090
DJ	Djibouti		7,764
EG	Egypt		7,776
GQ	Equatorial Guinea		3,090,022
ER	Eritrea		94
SZ	Eswatini		1,790
ET	Ethiopia		2,583
GA	Gabon		4,227,941
GM	Gambia		1,451
GH	Ghana		2,966
GN	Guinea		416
GW	Guinea-Bissau		238
CI	Ivory Coast		9,447
KE	Kenya		83,325
LS	Lesotho		1,615
LR	Liberia		403
LY	Libya		17,330
MG	Madagascar		4,476
MW	Malawi		2,071
ML	Mali		3,511,703
MR	Mauritania		861
MU	Mauritius		9,938
YT	Mayotte (France)		3,689
MA	Morocco		83,579
MZ	Mozambique		7,129
NA	Namibia		4,564
NE	Niger		811
NG	Nigeria		119,413
CG	Republic of the Congo		1,650
RW	Rwanda		4,772
RE	Réunion (France)		28,150
SH	Saint Helena		14,350
SN	Senegal		5,935
SC	Seychelles		5,043
SL	Sierra Leone		1,992
SO	Somalia		11,183
ZA	South Africa		1,234,532
SS	South Sudan		26
SD	Sudan		3,520
ST	São Tomé and Príncipe		13,920
TZ	Tanzania		18,711
TG	Togo		1,657
TN	Tunisia		43,144
UG	Uganda		7,852
EH	Western Sahara		–
ZM	Zambia		4,152
ZW	Zimbabwe		42,656
AF	Afghanistan	web.public.mea	5,947	9,887,829
AM	Armenia		33,050
AZ	Azerbaijan		26,727
BH	Bahrain		5,040
BD	Bangladesh		25,528
BT	Bhutan		1,824
BN	Brunei		1,366
KH	Cambodia		3,208
CY	Cyprus		17,765
GE	Georgia		42,411
HK	Hongkong		232,505
IN	India		2,349,738
ID	Indonesia		375,112
IR	Iran		1,077,516
IQ	Iraq		2,029
IL	Israel		250,425
JP	Japan		1,506,391
JO	Jordan		4,521
KW	Kuwait		3,943
KG	Kyrgyzstan		11,123
LA	Laos		173,595
LB	Lebanon		4,539
MO	Macao		2,866
MY	Malaysia		247,237
MV	Maldives		5,108
MN	Mongolia		17,124
MM	Myanmar		4,202
NP	Nepal		78,200
OM	Oman		3,815
PK	Pakistan		93,709
PH	Philippines		116,685
QA	Qatar		19,218
SA	Saudi Arabia		64,201
SG	Singapore		175,686
KR	Republic of Korea		973,409
LK	Sri Lanka		68,505
PS	State of Palestine		7,639
SY	Syria		10,577
TW	Taiwan		686,428
TJ	Tajikistan		6,923
TH	Thailand		71,314
TL	Timor-Leste		1,717
TR	Turkey		398,104
TM	Turkmenistan		18,447
AE	United Arab Emirates		157,743
UZ	Uzbekistan		83,594
VN	Vietnam		419,911
YE	Yemen		1,164
AS	American Samoa (US)	web.public.oc	14,474	5,530,037
AU	Australia		2,982,455
CC	Cocos (Keeling) Islands (Australia)		719,256
CK	Cook Islands (NZ)		1,308
FM	Federated States of Micronesia		17,024
FJ	Fiji		3,317
PF	French Polynesia (France)		1,827
GU	Guam (US)		62
KI	Kiribati		553
MH	Marshall Islands		10
NR	Nauru		299
NC	New Caledonia (France)		5,891
NZ	New Zealand		686,488
NF	Norfolk Island (Australia)		1,074
MP	Northern Mariana Islands (US)		653
PW	Palau		400,979
PG	Papua New Guinea		2,147
PN	Pitcairn Islands (UK)		749
WS	Samoa		165,404
SB	Solomon Islands		1,619
TO	Tonga		25,215
TV	Tuvalu		495,755
VU	Vanuatu		1,471
WF	Wallis and Futuna (France)		2,007
AQ	Antarctica	web.public.aq	94	94

It is important to note that a minority of above mentioned TLDs, while formally added, are remaining in wait state because they do not meet our criteria of quality control. In this previous blog post Top-level domain considerations we explained why we are not accepting any TLD that exists (tl;dr: some TLDs such as “ZIP” don’t have enough domains to be worth in comparison to potential false positives).

Newsletter 2021-01-23

Sat, 23 Jan 2021 00:00:00 +0000

January 2021: Capitol Hill Riots Archive, New Features

Our dataset contains now 30 billion records and grows by +3 billion every month. Last year has been incredible for us. We are growing by any metric – all organically. Searches are up 113% Q-on-Q and our user base is growing sustainably at 18% month-on-month.

Capitol Hill Riots

We have sprung into action on January 6, 2021 when Twitter and Facebook started to delete videos of the Capitol Hill riots. It is important evidence for law enforcement & the public. Use the “Tree View” tab to see all pictures and videos! Link: intelx.io/?did=814b39fe-ad98-45a1-9f44-0346bc9f9b94

Archiving Capitol Hill riots’ media

Thu, 07 Jan 2021 00:00:00 +0000

We are archiving media from todays Capitol Hill riots. Follow our Twitter account for updates.

https://twitter.com/_IntelligenceX/status/1346967229187952644

We have archived the Capitol Hill riots media here: intelx.io/?did=814b39fe-ad98-45a1-9f44-0346bc9f9b94

Use the “Tree View” tab to see all pictures and videos. The FTP server stores now 200 GB (about 4000 files).

Note: Some files contain graphic content.

Newsletter 2020-12-22

Tue, 22 Dec 2020 00:00:00 +0000

December 2020: Telegram channel

Subscribe to our new Telegram channel at: t.me/intelxio

New Telegram subscribers receive a free 3-day Professional license code! We will post frequent updates and technical background info to this channel.

🏛 Open Government

We are archiving all .GOV and .MIL websites. Any changes will be preserved, any alterations detected! Read the full blog post here.

You can find it as the “Government US” category in the Advanced menu. It contains already more than 5 TB of public data.

Our statement regarding Ledger’s Content Removal Request

Mon, 21 Dec 2020 00:00:00 +0000

Today at 13:14 we have received the following Content Removal Request from Ledger regarding this search result.

[…] By making this database public, the privacy of over 1 million individuals is violated, which places them at risk of, amongst other things, phishing attacks. We respectfully request that you expeditiously remove the thread. Our client is engaged in crypto currency transaction services and the online presence of the leaked database poses a very serious threat and risk of fraud for Ledger Wallet users. If there is anything that may be preventing you from cooperating with this legitimate takedown request, please let us know. Thank you for your co-operation!

Open Government 🏛

Fri, 20 Nov 2020 00:00:00 +0000

Open government is the governing doctrine which holds that citizens have the right to access the documents and proceedings of the government to allow for effective public oversight.

Wikipedia

After the recent firing of Christopher Krebs, the 1st director of the Cybersecurity and Infrastructure Security Agency (CISA), we decided to leap into action and preserve public data from US governmental websites.

…votes from Trump to Biden, late voting, and many more. Therefore, effective immediately, Chris Krebs has been terminated as Director of the Cybersecurity and Infrastructure Security Agency.

Newsletter 2020-11-17

Tue, 17 Nov 2020 00:00:00 +0000

🎙️ Join the webinar with Media Sonar

Tomorrow at 2 p.m. EST (= 20:00 CET) we are hosting a webinar with Media Sonar!

The title is “How Analysts Use OSINT and Dark Web for Cyber Investigations”. Our CEO will talk about how you can use Intelligence X, and will give some background details and answer questions.

Media Sonar solves the problem of operationalizing OSINT investigations with action-based lookups of robust point of interest data from sources like Intelligence X.

Newsletter 2020-10-19

Mon, 19 Oct 2020 00:00:00 +0000

October 2020: Hunter Biden, Maltego Transform v4, Decentralized TLDs

🥳 It has been 2 years since the launch of Intelligence X!

At this point we would like to thank our users & customers for their trust and we look forward to the future.

-Intelligence X Team

Make sure to follow us on Twitter for the latest updates.

Hunter Biden

The New York Post published an alleged Hunter Biden email. We looked into it in our blog post An OSINT investigation into the alleged Hunter Biden email. tl;dr: It appears that the email addresses in the alleged email are accurate. This does not validate nor refute the content of said email.

An OSINT investigation into the alleged Hunter Biden email

Wed, 14 Oct 2020 00:00:00 +0000

Disclaimer: Intelligence X is politically neutral. This investigation is based on public information (open source intelligence).

tl;dr: It appears that the email addresses appearing in the alleged email are accurate. This does not validate nor refute the content of said email.

The New York Post published today the two articles “Hunter Biden emails show leveraging connections with his father to boost Burisma pay” and “Senate committee investigating alleged Hunter Biden drive, smoking-gun email“. According to The Verge, “Facebook has reduced the reach […] pending a fact-check review”. Vox calls it “a suspicious effort to swing the election”. According to Motherboard, “Twitter […] started blocking sharing of the article in line with the site’s policy against hacked material.”. At the time of writing, this story has not been covered by major outlets, including the New York Times.

Top-level domain considerations

Mon, 21 Sep 2020 00:00:00 +0000

We want to give some insight into top-level domains (TLDs) supported by Intelligence X. Even though there are a total of 1,508 available TLDs (full list by IANA), we choose to only support certain TLDs in order to prevent spam, false positives, and maintain a high quality data set.

Validation of top-level domains appears in these places:

Search term input: Detect when the user enters a valid domain (as well as email address, URL)
Indexing of search results: Detect when a valid domain name appears in text

False Positives

“ZIP” is an example TLD that we intentionally do not support. It has only 2 domains (according to DomainTools), but supporting it would mean millions (if not billions) of false positives, due to its common use as file extension for ZIP files. “test.zip” as filename is on its own indistinguishable from “test.zip” as domain name.

Newsletter 2020-08-27

Thu, 27 Aug 2020 00:00:00 +0000

August 2020: Latest News & Statistics

Public API keys are retired

We have retired public API keys. All 3rd party tools and integrations must use per-user API keys. Note: This also affects SpiderFoot users. We have updated our SDK to reflect that change.

You can find your personal API key here: intelx.io/account?tab=developer

In related news, the tool Intel Owl v1.5.0, which “analyze files, domains, IPs in multiple ways from a single API at scale”, was just released and supports our Phonebook API for observables: github.com/intelowlproject/IntelOwl/releases/tag/v1.5.0.

The road to 100 billion records

Sun, 23 Aug 2020 00:00:00 +0000

At Intelligence X, we value quality over quantity. Our goal is continuous improvement, sustainability, and stability. As we cross the mark of 25 billion records with 100+ TB of storage, it is time to set sail for 100 billion records.

Counting records

A single record is an extracted selector (search term) like “test.com”. A search term might appear in one or multiple documents. Intelligence X is not just a search engine; it is also a data archive that stores copies of the actual search result (i.e. the original document) in its cache.

Newsletter 2020-08-03

Mon, 03 Aug 2020 00:00:00 +0000

August 2020: Recap of 3rd-party OSINT tools and integrations

We are listing all approved 3rd-party integrations here: intelx.io/integrations

h8mail: “an email OSINT and breach hunting tool using different breach and reconnaissance services”
Maltego Transform
subfinder: “subdomain discovery tool that discovers valid subdomains for websites by using passive online sources”
theHarvester: “The tool gathers emails, names, subdomains, IPs and URLs using multiple public data sources”
SpiderFoot: “automates OSINT collection”
Mitaka: “a browser extension for OSINT search”

h8mail is the latest integration and is highly recommended by Intelligence X. The linked integrations page above contains a couple of important basic rules. Public API keys are being discontinued and each user must use their own API key.

Why we are going to block Tor IPs

Sun, 05 Jul 2020 00:00:00 +0000

tl;dr: Nothing ever good comes out of Tor.

We are going to block Tor IP addresses from signup, login, and search starting on July 5, 2020. Our reasons are rooted in:

Tor Hidden Services Are a Failed Technology, Harming Children, Dissidents and Journalists. Read this blog post by lawfare.
According to our own investigation, Tor hidden services are full of spam websites.
Tor exit nodes are known to snoop on user’s traffic, try to decrypt it where they can and mine it.
The Tor network is more often than not used as proxy for hacking, spam and fraud. This is unwanted traffic. According to CloudFlare “94% of requests that we see across the Tor network are per se malicious”.

We have published the code that we use to detect Tor IPs as open source: github.com/IntelligenceX/ip2tor

Maltego Transform released

Sat, 04 Jul 2020 00:00:00 +0000

We just released a Maltego Transform for Intelligence X. The installation instructions are here: github.com/IntelligenceX/SDK/tree/master/Maltego%20Transform

Maltego is “software used for open-source intelligence and forensics, developed by Maltego Technologies”. It can visualize information in a graph format.

An investigation into attempted fraud

Fri, 03 Jul 2020 00:00:00 +0000

We are publishing information about a user who attempted to defraud us. As outlined in previous blog posts and tweets, we are going to aggressively publish the information about anyone trying to attack, hack or defraud us.

The person tried to use alleged stolen credit cards to purchase an Intelligence X subscription.

Email addresses and IPs used by the fraudster:

support@droneitallcreations.com on 2020-06-25 20:00:39
- IP 2600:6c64:607f:eccb:25a7:930a:863a:800
b8nkccartel@pm.me on 2020-06-25 20:01:18 and B8nkCcartel@protonmail.com
- IP 176.113.72.169
sue.rielly010@gmail.com on 2020-07-03 18:09:53
- IP 2600:6c64:607f:eccb:f0e9:ed94:18e3:c15b

The domain droneitallcreations.com (now defunct) was registered on 2020-06-15 and had the website title “Drone It All Creations – Central Massachusetts Aerial Cinematics Offer top quality photos-Prints – and one of a kind drones.”. It was an apparent copy of a legitimate website drone-it-all.business.site.

New: Identity Portal 🎉

Tue, 23 Jun 2020 00:00:00 +0000

We launched a new product: “Identity Portal”! It allows users to find all lines in a text where a search term appears, and to download a list of leaked accounts under a specific domain or email address.

This product is exclusively available on request to companies and governments. If you are interested, please contact us!

List all lines where the search term appears in the results

This function searches for and lists all lines where a search term appears, and like intelx.io, it searches across all data categories. Each line contains first the ID of the search result, which can be opened by clicking on it. The next columns show the file type and the data category, followed by the line where the search term appears.

Newsletter 2020-06-02

Tue, 02 Jun 2020 00:00:00 +0000

June 2020: New Phonebook service! 🎉

We just launched a free new service: phonebook.cz

It lists all email addresses, subdomains, and URLs for the input domain. Try it out – it’s free! It uses the same dataset as intelx.io – which is 20 billion records.

There is an existing phonebook feature at intelx.io since its inception (in the Advanced menu next to the search button), but incorporating it into a separate new website makes it simpler to access.

Newsletter 2020-05-11

Mon, 11 May 2020 00:00:00 +0000

May 2020: New dorks website, Tor, DDoS test and a Europol takedown

Our dataset continues to grow significantly: 17,660,962,195 selectors

In the past few months, we have invested in 200+ TB of enterprise storage which allows us to scale up data collection even more. As for the public web, we are currently crawling these TLDs: DE, AT, LU, CH, UA, KZ, RU

Later this week we will increase our coverage of TLDs and include major ones like .com, .org, .net, and many others.

Can we DDoS ourselves? We are about to find out. Live self-ddos on 10.05.2020 13:00 UTC

Sat, 09 May 2020 00:00:00 +0000

On Sunday, May 10, 2020, we will DDoS our own website, intelx.io. We will live tweet and update this blog post with any developments and the outcome. The attack will be executed in the same fashion as an actual attack: we’ll do some research, then pay a shady DDoS provider in Bitcoin (and hope they don’t scam us) and launch an actual DDoS attack against our own website.

https://twitter.com/_IntelligenceX/status/1259103590427303936

Note: We own 100% of our infrastructure including the servers, network equipment, and even our own BGP router. We are our own ISP and operate our own Autonomous System and IP addresses. We do not recommend anyone to launch DDoS attacks.

Combating spam websites from Tor

Mon, 27 Apr 2020 00:00:00 +0000

Certain actors spam Tor by creating many duplicate websites under different .onion domains and then linking them to each other. The cost of doing that is pretty low, considering that all you need is creating a new public key pair (the onion domain is the hash of the public key). In theory anyone can create an infinite number of onion domains.

Sadly, bad actors are using this spam technique also for promoting websites with child exploitation content. The motivation behind creating many onion domains for essentially the same website (sometimes with rotating the content slightly for each copy) is likely to increase coverage by Tor search engines.

Vanity .onion Tor Addresses

Mon, 27 Apr 2020 00:00:00 +0000

Tor .onion domains are the hashes of public keys. Generally, they look random, but it is possible for am Tor hidden service operator to generate onion domains that start with a human readable part such as “silkroad7rn2puhj.onion”. Those are called “vanity onion addresses” and there are tools like Shallot and Eschalot that will create the customized .onion address.

The number of characters that can be customized are limited by processing power. Shallot published this table with the description “Time to Generate a .onion with a Given Number of Initial Characters on a 1.5Ghz Processor”:

Tor Hidden Services Are a Failed Technology, Harming Children, Dissidents and Journalists

Wed, 22 Apr 2020 00:00:00 +0000

Repost from lawfareblog.com/tor-hidden-services-are-failed-technology-harming-children-dissidents-and-journalists for increased visibility. By Brian Levine, Brian Lynn Friday, January 17, 2020, 8:27 AM. Copyright © 2020 The Lawfare Institute.

A recent series of New York Times articles reported on the deeply disturbing amount of child sexual exploitation material that is available on the Internet. The articles discuss personal accounts of children who have been targeted, how tech companies have provided platforms for perpetrators of what is commonly called child pornography and how law enforcement has gone underfunded for years. In October 2019, Alan Rozenshtein commented on Lawfare that law enforcement’s efforts to combat this issue will become increasingly complicated when Facebook and other platforms roll out end-to-end encryption.

New Python API wrapper and Command Line Interface

Mon, 13 Apr 2020 00:00:00 +0000

We have teamed up with @zer0pwn to develop a completely rewritten Python API wrapper and Command Line Interface.

👉🏼 github.com/IntelligenceX/SDK/tree/master/Python

To install the command line tool run these commands (requires Python 3, tested against latest 3.8.2):

git clone https://github.com/IntelligenceX/SDK
pip3 install SDK/Python

In order to see all results, you should specify your API key via the -apikey [key] argument or put it into the INTELX_KEY environment variable. If you don’t specify one, it will use a default public key, which we may, however, disable in the upcoming weeks. You can get your API key here: intelx.io/account?tab=developer

Newsletter 2020-04-13

Mon, 13 Apr 2020 00:00:00 +0000

April 2020: New Python API wrapper and Command Line Interface

We have teamed up with zer0pwn to develop a new Python API wrapper and Command Line Interface. It is released in our SDK: github.com/IntelligenceX/SDK/tree/master/Python

For details read this blog post: new-python-api-wrapper-and-command-line-interface

Features of the new Python code:

Query search results based on a selector
Filter results based on date from/to, media type
Set sort order, max result limit and timeout
Use the Phonebook to find related emails, sub-domains and URLs for domains
Get statistics
Download individual results
Directly view results (auto-convert any media to text)

Follow-us on Twitter for the latest updates: twitter.com/_IntelligenceX

Newsletter 2020-03-23

Mon, 23 Mar 2020 00:00:00 +0000

March 2020 Updates

How we prepared for the current global situation

We have ordered and deployed 180 TB worth of enterprise storage to be prepared for upcoming price increases and shortages of hard disks. We are reading reports that warn of upcoming delivery delays due to disruptions in the supply chain. We tweeted a picture here of how 100 TB storage looks like in our backend.

https://twitter.com/_IntelligenceX/status/1238622407541362689

Czech Republic is restricting travel from and to the country, which means that our employees are not allowed to leave the country. Fortunately, our datacenter is in Prague and we continue to operate as usual.

Decoding the US Death Master File

Thu, 19 Mar 2020 00:00:00 +0000

“The Death Master File (DMF) is a computer database file made available by the United States Social Security Administration since 1980″ according to Wikipedia. It is available here ladmf.ntis.gov but costs $2,930.00 anually.

The file has since been posted on the internet for free, including here:

ssdmf.info/download.html November 30, 2011
cancelthesefunerals.com/ May 31, 2013
archive.org/details/DeathMasterFile May 31, 2013

This file can be useful for OSINT (Open Source Intelligence) discovery as it contains millions of US SSNs (Social Security Numbers), so we have decided to add it to our search index.

An OSINT investigation into one of our attackers

Thu, 05 Mar 2020 00:00:00 +0000

On December 11, 2019 we have received 31,866 HTTP requests from the IP 81.171.107.57. Below are few sample log entries:

81.171.107.57 - - [11/Dec/2019:13:52:37 +0000] "POST /login HTTP/1.1" 200 7448
81.171.107.57 - - [11/Dec/2019:13:52:37 +0000] "POST /login HTTP/1.1" 200 7443
81.171.107.57 - - [11/Dec/2019:13:52:37 +0000] "POST /login HTTP/1.1" 200 7447
81.171.107.57 - - [11/Dec/2019:13:52:37 +0000] "POST /login HTTP/1.1" 200 7484
81.171.107.57 - - [11/Dec/2019:13:52:37 +0000] "POST /login HTTP/1.1" 200 7481

This IP address logged into intelx.io with the email address “testeur.1@live.fr” on 11.12.2019 13:44:59. The IP address space 81.171.107.0/24 is owned by privado.io – a VPN provider.

Newsletter 2020-03-02

Mon, 02 Mar 2020 00:00:00 +0000

March 2020: New Data Categories

Stay up to date with us on Twitter: twitter.com/_IntelligenceX

Private Data Leaks

We have revised our license system and launched a new data category exclusively for paid Professional users: Private Data Leaks. Trial accounts will see a preview, but you must be a paid member to fully access the category. For more details, read this blog post.

Sci-Hub

We started to index the publicly available documents from Sci-Hub. This category is available for free to all users. Sci-Hub hosts 80 million documents with a total size of 70 TB. Due to the large size, it will take us some time to complete the indexing. We will send updates as the indexing progresses.

Third unsuccessful DDoS attack

Mon, 02 Mar 2020 00:00:00 +0000

We were again under DDoS attack on February 11, 2020. We received 177,261 HTTP requests in a time span of 2 hours from 2,682 unique IPv4s.

As always, this attack was not successful (it had no impact) and was only noticed due to looking into visitor statistics.

The second spike (February 27, 2020) was due to someone trying their luck using the Acunetix vulnerability scanner from the IPs 185.77.248.6 and 31.146.173.102. We tweeted about it:

Revised License System & Private Data Leaks

Thu, 20 Feb 2020 00:00:00 +0000

We have revised our license system! Check out our updated product page intelx.io/product for the details on available licenses and their permissions. Here’s what we published that was not online before:

Detailed list of features available for each license
List of buckets that are available in full and as preview by each license
Pricing scheme for Enterprise customers

The existing licenses “Free” and “Academia” remain the same.

Private Data Leaks

All paying customers with a Professional license were upgraded automatically (for free!) and have now full access to the “Private Leaks” category, which was previously exclusive to our Enterprise tier. Due to the sensitive nature of that data, it is only available as preview for Trial accounts.

Removing X-Score from the user interface

Mon, 17 Feb 2020 00:00:00 +0000

We have just removed the X-Score from the user interface. It was not properly explained and does not bring enough value to merit keeping it.

X-Score is an internal algorithm which ranks results when you select the “Most Relevant” sort order (which is the default). The X-Score number represents how important each individual result might be, and moves it up or down in the result list.

In the old version it showed the X-Score on the right side, next to the date:

Newsletter 2020-02-07

Fri, 07 Feb 2020 00:00:00 +0000

February 2020: WeLeakInfo Seizure & Other News

🕵🏻 OSINT Tools: Google Analytics ID Reverse Lookup

We have added a Google Analytics ID reverse lookup tab: intelx.io/tools?tab=analytics

It will redirect to 3rd party sites that look up a Google Analytics ID and show websites that use the same analytics ID for Google Analytics. This can be an indicator that the resulting websites are operated by the same person.

WeLeakInfo Seizure

The website WeLeakInfo.com was taken down and seized by the FBI on January 16, 2020. The press release from the US Department of Justice is available here. A news report from The Register mentions two 22-year olds who are allegedly involved.

Transparency Report #2

Fri, 07 Feb 2020 00:00:00 +0000

Our last transparency report was published some time ago – it’s time for an update! This report includes information about content removal requests and government orders since the last transparency report. Results are deduplicated.

We have received 44 content removal requests (note that one report may indicate multiple reasons) and complied with all of them:

3 – Patent, Trademark, Trade Secret, Copyright infringement
39 – Personal data
8 – Spam / Malware / Phishing / Hacking
1 – Child pornography
0 – Expressions of racial, ethnic, religious or gender hatred

We have received 0 court orders.

Second DDoS attack against intelx.io

Thu, 06 Feb 2020 00:00:00 +0000

We were under a DDoS attack on January 26, 2020. We received 4,935,580 HTTP requests in 3 minutes from the 2 IPs 149.202.101.151 and 54.38.23.181. It was the second DDoS attack – the last one was on September 19, 2019.

You can see the spike clearly in the monthly usage statistics below. The attack was not successful and was only discovered when creating monthly usage statistics.

weleakinfo.com takedown by FBI & friends

Fri, 17 Jan 2020 00:00:00 +0000

The domain weleakinfo.com was seized yesterday by the FBI. The website shows a takedown notice and shows the logos of NCA, Politie, Police Service Northern Ireland, Department of Justice and Bundeskriminalamt. The note writes:

This domain has been seized
The domain for WELEAKINFO has been seized by the Federal Bureau of Investigation pursuant to a seizure warrant issued by the United States District Court for the District of Columbia under the authority of 18 U.S.C. §§ 981, 982, inter alia, as part of coordinated law enforcement action by: [logos]

Newsletter 2020-01-12

Sun, 12 Jan 2020 00:00:00 +0000

January 2020: OSINT Tool Update & Latest News

🕵🏻 OSINT Tools: Reverse Hash Lookup

We have added a reverse hash lookup: intelx.io/tools?tab=hash

The lookup takes as input a hash of type MD5, SHA1, SHA256, or SHA512. It then redirects the user to 3rd party sites which perform the reverse lookup. Potentially, it can be used to reverse the hashing of a password, email, or domain.

Whois Data Statistics

Every month we continue to index the latest whois data. We took a sample set across one day and analyzed it; here are the results.

Indexing new “whois” data

Thu, 09 Jan 2020 00:00:00 +0000

We are constantly indexing the latest whois data for our whois category. “Whois” data contains information about domain ownership.

We recently indexed the whois data for October, November, and December 2019 which resulted in 21,168,724 selectors. We analyzed a small sample set (1 day, 2019-11-29) and these are the results:

75% of the data is whois protected, which means that the information about the owner (name, email address, postal address) is not available. Often, that data is simply replaced with “Redacted For Privacy” or other dummy data.

Newsletter 2019-11-27

Wed, 27 Nov 2019 00:00:00 +0000

November 2019: Academia Program and Inline Filters

🎓 Academia Program

We are now offering free access to members of schools and universities. Accounts that register on intelx.io with an email address from a school or university get upgraded automatically. We have published a list of supported domains and add new ones on request.

You can find all the details here: intelx.io/academia

📈 Inline Filters

Our dataset keeps growing and just reached 10 billion selectors with 211 million unique results. With the increasing amount of results a better way of sorting through them was required, so we added inline statistics and filtering.

Login Bruteforce attempts against intelx.io

Thu, 21 Nov 2019 00:00:00 +0000

Minutes ago (evening of November 21, 2019) we just stopped an unsuccessful login bruteforce attack. The attacker’s email address is primeday@protonmail.com and the IPs used in the attack are 163.172.225.39 (a NordVPN IP), 94.36.97.33 and 87.0.205.119.

There were 27,601 login attempts from those IPs before stopped by Intelligence X staff.

As clearly stated in our Terms of Service, we are sharing information about attacks with the public and law enforcement.

Inline Filters

Mon, 18 Nov 2019 00:00:00 +0000

We have added inline statistics & filters. After searching, you can filter by data source, file type or date. Click on the summary line to expand the full statistics view and then click on either the data source, file type or the date heatmap.

Newsletter 2019-11-12

Tue, 12 Nov 2019 00:00:00 +0000

November 2019: Tools and Public Web

🕵🏻 OSINT Tools: New Tabs & Updates

We have updated our free OSINT tools: intelx.io/tools

✅ New YouTube DataViewer: Shows metadata and thumbnails
✅ New Vehicle Identification Number (VIN) tab
✅ Added 4 sites to Domain search, including crt.sh, Robtex, and Hurricane Electric
✅ Added 3 sites to IP search

The YouTube DataViewer is forked from Amnesty International’s version. You can access it here: intelx.io/tools?tab=youtube

🌍 Public Web

As announced in our last newsletter from October, we are now indexing the public web. We started to crawl domains from certain TLDs (top-level domains). There are new search categories for the public web, including “Web: Germany”, which covers DE, AT, CH, and LU and “Web: Russia”, which covers RU, KZ, and UA.

Open sourcing our fileconversion library

Wed, 30 Oct 2019 00:00:00 +0000

We released our Go “fileconversion” library here: github.com/IntelligenceX/fileconversion

It supports converting many file formats to plaintext, and provides other related functions. It was tested on 184+ million files and is used for intelx.io. We are happy to contribute back to the open source community.

Newsletter 2019-10-17

Thu, 17 Oct 2019 00:00:00 +0000

October 2019: Russia, Grouping Results, and DDoS attack

🇷🇺 Russia

Want to investigate the Russian government? We are helping with a new search category, “Government: Russia”. It indexes data from Russian governmental domains, including:

gov.ru – Russian Government
mil.ru – Ministry of Defence of the Russian Federation
kremlin.ru – Official website of the President of Russia
fsb.ru – Federal Security Service
government.ru – Russian Government
supcourt.ru – Supreme Court of Russia
cikrf.ru – Central Election Commission of Russia
ombudsmanrf.org – High Commissioner for Human Rights in the Russian Federation

The historical data goes back to December 2017. For details and examples how to search this data, read the blog post.

Want to investigate the Russian government? We are helping.

Sat, 05 Oct 2019 00:00:00 +0000

We just released a new search category “Government: Russia”. It indexes data from Russian governmental domains, including:

*.gov.ru – Russian Government
*.mil.ru – Ministry of Defence of the Russian Federation
kremlin.ru – Official website of the President of Russia
fsb.ru – Federal Security Service
government.ru – Russian Government
supcourt.ru – Supreme Court of Russia
cikrf.ru – Central Election Commission of Russia
ombudsmanrf.org – High Commissioner for Human Rights in the Russian Federation

The historical data goes back until December 2017. That means you can go back in time and get the content of Russian governmental websites up to that point using Intelligence X.

DDoS Attack against intelx.io

Thu, 03 Oct 2019 00:00:00 +0000

On September 19, 2019, intelx.io was under DDoS attack. 62 unique IPv4s issued 1.259.671 HTTP requests in 20 minutes.

The attack was not successful, the service continued to perform normally.

Source IPs

As per our Terms of Service, we reserve the right to share information about attacks with the public. This is the list of IPv4s that participated in the attack:

104.238.99.130
108.61.175.7
109.201.133.100
109.254.38.76
118.31.229.46
140.82.59.139
148.72.22.255
157.230.117.97
163.53.209.8
166.62.116.91
166.62.43.235
166.62.81.144
166.62.84.121
173.245.239.223
176.36.115.16
178.197.248.213
184.185.2.146
190.214.20.10
192.169.152.231
192.169.188.100
192.169.216.124
192.241.187.83
193.112.253.73
198.12.154.22
198.199.116.206
199.249.230.106
199.249.230.73
201.231.214.242
213.154.21.183
216.144.228.130
216.144.230.233
23.129.64.150
23.129.64.209
35.230.63.36
35.233.133.18
35.245.105.65
35.245.111.217
35.245.152.246
35.245.160.51
35.246.212.153
45.63.41.113
47.154.22.220
47.254.178.255
5.164.206.2
50.63.26.13
51.144.228.148
54.38.55.72
64.118.84.6
66.110.216.105
69.247.158.68
72.11.148.222
80.240.31.214
80.76.110.26
83.149.37.56
89.149.69.178
95.110.230.142
96.44.133.110
96.44.183.149
96.69.4.54
98.143.145.29
98.143.145.30
98.174.90.36

The attacker rotated the User Agent:

New Feature: Grouping of Similar Results

Thu, 03 Oct 2019 00:00:00 +0000

A new features was just added: Grouping of similar results. This new feature is optional and can be in the Advanced menu -> Settings -> “Group Similar Results” checkbox.

Try it out by clicking on this link and scroll down: intelx.io/?s=test.com&b=darknet.tor&g=1

If there are many search results, this feature can help to declutter the result list. Note that you have to enable it in the Advanced menu each visit to intelx.io, as it is not enabled permanently by default.

Newsletter 2019-09-30

Mon, 30 Sep 2019 00:00:00 +0000

September 2019: Leaks & Whois Data

Two new massive data categories have been added: Public Leaks and Whois. They can be selected in the “Advanced” menu on intelx.io.

Our dataset is growing rapidly – we are adding up to 10,000 records per second:

Public Leaks

The category “Public Leaks” contains public data leaks such as Collection #1, which was published in January 2019. Troy Hunt wrote a blog post about it here. This leak alone contains 773 million unique email addresses, according to Hunt.

Newsletter 2019-09-13

Fri, 13 Sep 2019 00:00:00 +0000

September 2019: Latest Updates

We have two new major features to share: the Tree View and the History tabs.

📂 Tree View

The Tree View tab shows related items to a search result. It simplifies the process of discovery and adds context to the search results.

As for website results, it will show all other sub-pages and files (like office documents, pictures, etc.) available on the same domain. For data leaks, the Tree View shows results from the same leak.

New Feature: Virtual Folders

Thu, 29 Aug 2019 00:00:00 +0000

We just released a major update – virtual folders. For some results, there is a new “Tree View” tab. It shows items that are related either because they are part of one container file, or because the original file was too big and was automatically split into multiple files.

To put it simple, the Tree View allows the user to view other items that are part of the original data.

Apple’s .DS_Store files may leak filenames

Mon, 26 Aug 2019 00:00:00 +0000

One of the file formats that does not get much attention are “.DS_Store” files, even though they might be of interest in forensic cases when analyzing hard disks or other folders (including ZIP files) from Mac machines.

“.DS_Store” is an abbreviation for “Desktop Services Store”. These files are created automatically by Apples “Finder” software (which is part of their OS). They store information about the files within a folder, including display options of folders, such as icon positions and view settings. It is a proprietary format, even though by now it is well-documented by 3rd parties. Wikipedia provides a good overview.

Newsletter 2019-08-20

Mon, 19 Aug 2019 00:00:00 +0000

August 2019: Latest Updates 👋

The last newsletter was sent out early July 2019. Since then, we have new features and blog posts to share! Our free OSINT tool suite has been substantially upgraded.

🕵🏻 OSINT Tools: More tabs, more functionality

Check out our free OSINT tools at intelx.io/tools.

The third-party search allows you to quickly look for the following:

General
Email
Domain
IP
Bitcoin
Image (reverse search)
Username
Person
Phone Number
Location
File

Our social media tabs include Facebook, Twitter, LinkedIn, and Telegram. Other tabs available include Validate Emails, GeoIP Lookup, Encoding, and URLs.

Viruses on the Darknet

Tue, 13 Aug 2019 00:00:00 +0000

When talking about viruses on the darknet, the focus is usually on malware that can be purchased or rented (which gets increasingly popular with ransomware). There are also viruses that use the darknet for C&C (command & control) purposes. However, this blog post investigates viruses on the darknet websites themselves – which are usually based on HTML, JavaScript or other scripting languages.

Our search index contains 13,158,345 items for Tor (since 2017) and 1,954,070 items for I2P (since 2018). We have extracted 410,647,035 selectors out of all those items.

WikiLeaks data in numbers

Thu, 01 Aug 2019 00:00:00 +0000

We have uploaded all the WikiLeaks data to Intelligence X and created a new category. You do not need an account or license to search through the WikiLeaks data using our site.

Try it out here! intelx.io/?s=cnn.com&b=leaks.public.wikileaks

Source & Challenges

Most of the raw data is available via file.wikileaks.org/file/ as well as torrents. There are a couple of organizational and technical challenges that come with the data:

The files are mostly unstructured and there is no clear index.
The published raw files do not always exactly match up in count with what’s published on wikileaks.org.
The chaotic way of how and what is published in raw form likely represents the chaos within the WikiLeaks organization (see Conway’s Law).
The file types vary. Some document are in PDF form, Word files (DOC, DOCX), some in picture form (JPG), and some in picture form embedded in PDFs. This makes it tricky to extract reliable meta-data (such as the title, creation date) and the data itself (the text).
Spam: Sometimes the data contains pure spam. A human is required to go through each folder and decide whether the data may be of interest or not.
Some data is compressed (7Z, RAR, ZIP) with many sub-files and folders.
Fake news: Some data contains fake information (for example: Fake medical report about Steve Jobs having a HIV+ diagnosis).
Pornographic content: Some attachments of emails contain pornographic content.
Duplicates: Some files are duplicated.
Extreme violence.

Counting the Input

Count of files: 43,374
Count of folders: 4,423
Total size: 28.3 GB

Intelligence X Statistics

The Intelligence X statistics list more files than the input, because the compressed files (ZIP and other) contain many files that are extracted and stored separately.

Newsletter 2019-07-08

Mon, 08 Jul 2019 00:00:00 +0000

Intelligence X is excited to bring you periodic updates about our search engine and related tools.

🕵🏻 New OSINT Tools

Recently, we developed free OSINT (Open Source Intelligence) tools! Use them here at: intelx.io/tools

Intelligence X wants to support the OSINT community by providing these OSINT tools to the public. We will continuously update them.

Current Features

Third-party search: search on many 3rd-party search engines with a single click
Validate Email addresses
Facebook Graph Search
Encoding/Decoding, Hashing
Multiple URL Opener

💭 New Forum

~~We opened a new forum for discussions about Open Source Intelligence at intelx.io/forum.~~

Redesigned user interface and added statistics

Mon, 03 Jun 2019 00:00:00 +0000

Update 6/7/2019: We added a full-screen view (click on the new button next to “Back to result”) as well as a new search bar when clicking on a search result. If you don’t see it, make sure to refresh the website (CTRL + F5) as your browser may have cached the old version.

Original 6/3/2019: We just updated the user interface! The list of results was redesigned to focus more on the content of search results:

Social Security Numbers

Wed, 22 May 2019 00:00:00 +0000

We added support for US Social Security Numbers (SSNs)! You can immediately search for them here: intelx.io/?s=086-38-5955

Whis this is important

Searching at Intelligence X works based on selectors (strong search terms). When you search for something, the system automatically detects suitable selectors and performs a search. Below is the list of supported selectors:

Email address
Domain
URL
IP
CIDR
Phone Number
Bitcoin address
MAC address
IPFS Hash
Credit Card Number
Social Security Number
IBAN (International Bank Account Number)

Detecting SSNs is challenging

Detecting SSNs in texts can be challenging: they are essentially just 9-digit numbers, thus prone to false-positives. The basic format of SSNs is “AAA-GG-SSSS” (sometimes without dashes), comprising of an Area, Group and Serial Number. These parts formerly had meaning, but since 2011, and the dawn of the “randomization act”, they are essentially random.

A comparison of darknet search engines

Sat, 11 May 2019 00:00:00 +0000

A few days ago a new search engine DarkSearch for Tor launched, adding to the mix of other existing search engines out there like Ahmia, Torch, Not Evil, and Haystack – it’s time for a feature comparison!

No search engine can cover 100% of the pages due to the nature of Tor. There is no central .onion repository so the first challenge is to find the .onion links. Other challenges when running a search engine include data size (and associated storage and processing power), data formats, and many smaller challenges like depth of crawling (i.e. how many sub-pages, how to behave when there are infinite sup-pages).

Email verification for intelx.io users

Mon, 06 May 2019 00:00:00 +0000

We have just turned on email verification for all accounts on intelx.io.

Existing accounts receive a verification link via email upon login.

Native Support for Excel Sheets and PowerPoint Presentations 🗃️

Wed, 01 May 2019 00:00:00 +0000

We just added native support to Intelligence X for the following data formats:

Excel Sheets (.XLS, .XLSX, .ODT)
PowerPoint Presentations (.PPTX)

Native support means end-to-end support. This ranges from indexing and crawling files of various data sources, to processing them internally and presenting them to the end-user on the frontend intelx.io. Indexing is the process of taking a file, reading it, and extracting any text thus making it searchable.

intelx.io shows text preview in the results and supports inline view. This means that it immediately shows the text of a document in a detailed view (when you click on a result) without forcing the user to leave the website or download the file locally.

“Virut” once infected a North Korean website, its injected iframe is still live

Mon, 29 Apr 2019 00:00:00 +0000

The North Korean website of the Korea Chonsong Trading Company (at http://www.naenara.com.kp/ko/order/kgf/EN/Index.htm) was infected by the virus, “Virut”. Symantec [1] writes about this malware:

W32.Virut is a virus that infects executable files. Some variants also infect ASP, HTML and PHP files. The virus has worm-like behavior and spreads by copying itself to fixed, removable and network drives. It also opens a back door on the compromised computer.

Looking at the evidence, it appears that the infection happened around March 2010. [2] [3]

A new type of HTTP client attacks is around the corner, and it’s really sneaky

Mon, 15 Apr 2019 00:00:00 +0000

Google is working on a new feature called “Signed HTTP Exchanges (SGX)” (note: Google also abbreviates it as “SXG”). According to their website:

Signed HTTP Exchanges (SGX), part of an emerging technology called Web Packages is now available in Chrome 73. A Signed HTTP Exchange makes it possible to create “portable” content that can be delivered by other parties, and this is the key aspect, it retains the integrity and attribution of the original site.

North Korea just got a 3rd internet connection (and no one noticed)

Thu, 11 Apr 2019 00:00:00 +0000

Say hello to North Korea’s 3rd internet uplink! The North Korean autonomous system AS131279 just got a new uplink to AS133073 Teleglobal Communication Services Limited – which is assigned to Hong Kong, according to APNIC. According to our information, it went live a few days ago on April 3, 2019 at 16:00 UTC.

North Korea currently has 2 existing uplinks, one via China (AS4837 China Unicom Backbone) and another via Russia (AS20485 Closed Joint Stock Company TransTeleCom). This third new uplink gives them more flexibility, redundancy, and resistance against attacks such as DDoS.

🐍 Python code to use Intelligence X

Thu, 04 Apr 2019 00:00:00 +0000

We just added Python code to use the Intelligence X API! You can find the code in the SDK at github.com/IntelligenceX/SDK.

The code comes with a default API key so you can get started right away. For details on usage please look at the readme file in the SDK.

The SDK already has code implementations in HTML, PHP, and Go. It also features a command-line program written in Go, and can be compiled on Windows/Linux/Mac. The Python reference implementation is the latest addition to help developers integrate our search engine and our special Phonebook feature.

How many WiFi networks does North Korea have? At least 1.

Wed, 03 Apr 2019 00:00:00 +0000

North Korea has at least 1 WiFi network! The above screenshot was taken from the app, WiFi Map, which shows WiFis added by users (crowd-sourced). In this case, user “Trevan Baxter” added a WiFi network on December 23, 2018. The app first connects to the WiFi before adding it to the database to make sure it really exists.

The screenshot shows that the WiFi with the access point name, “LDSAccess”, and password, “Pioneer47”, exists at the “Ideals of Korean Workers Party Monument” in Pyongyang, North Korea. The connection is acceptable with 8.2 MB/s down and 4.8 MB/s up, thus it allows you to watch Netflix in HD in Pyonyang (Netflix recommends 5 MB/s down). Multiple independent reports claim that the internet in North Korea is not filtered; indeed, you can watch Netflix on your next trip to Pyongyang.

NSA program FAIRVIEW: Collecting trash. 🗑️

Wed, 20 Mar 2019 00:00:00 +0000

Fairview is a NSA program designed to collect “phone, internet, and e-mail data mainly of foreign countries’ citizens at major cable landing stations and switching stations inside the United States”. It dates back to 1985 [1]. There are various good articles on the subject [2].

As with every mass surveillance program, the basic law of collection (and search queries) is:

Garbage in, garbage out.

List of North Korean domains captured by FAIRVIEW. Picture Source

Transparency Report #1

Thu, 14 Mar 2019 00:00:00 +0000

We want to be transparent from the start about how we handle content removal requests and government orders.

The service is governed by the Terms of Service and the Privacy Policy. Content removal requests can be filed here. These are the categories under which we remove content from the search results when reported via content removal requests:

Patent, Trademark, Trade Secret, Copyright infringement
Personal data
Spam / Malware / Phishing / Hacking
Child pornography
Expressions of racial, ethnic, religious or gender hatred

Statistics

Since the launch on October 10, 2018, we received 7 content removal requests. We complied with all of them. This is the breakdown of the reasons (one removal request can cite multiple reasons):

New Developer Tab

Fri, 25 Jan 2019 00:00:00 +0000

You can access the new developer tab after logging in. Go to: intelx.io/account?tab=developer.

The new tab shows useful information for using the Intelligence X API:

Your API key
API URL
The buckets (= data categories) you can access
List of all API functions (endpoints) you can access as well as the amount of credits (= number of calls) per endpoint, if used

The SDK with the API documentation is published here: github.com/IntelligenceX/SDK. We want to be transparent and clear of any restrictions and limitations and thus decided to create a new developers tab to assist developers understand limitations and of the API access that we provide.

Integrate Intelligence X into your project: Use the Software Development Kit

Thu, 20 Dec 2018 00:00:00 +0000

We are excited to announce our new Software Development Kit. It is free and can be used by anyone to integrate Intelligence X into their project. Whether it’s a website, service, or local program, you can use our versatile API to enrich your data and provide additional context.

The SDK is published here: github.com/IntelligenceX/SDK.

It contains the following components:

When to use the API

There are many use cases for using the API of Intelligence X:

I2P added to the index 👀

Sun, 02 Dec 2018 00:00:00 +0000

We have now added another darknet to our index: I2P. It is substantially smaller in terms of hosted sites than its bigger fellow, Tor. To connect via I2P, you’d normally have to download the I2P router which provides an HTTP proxy in order to visit “.i2p” domains (called “eepsites”) from the browser. The I2P software is unfortunately written in Java – a big no-no when it comes to security (and also performance).

Free Alerts for Everyone

Wed, 28 Nov 2018 00:00:00 +0000

We just released an important feature: alerts via email. Now, you can automatically receive notifications daily, weekly, or monthly if there are new search results.

The alert feature is free for everyone. Sign up at intelx.io/signup and then go to the “Alert” tab under “Account”.

You can preview the alert and see how it looks like once an alert is generated. Click on the preview icon in the “Action” column:

Analyzing the recent Dark Web hosting provider hack

Sun, 18 Nov 2018 00:00:00 +0000

Catalin Cimpanu @zdnet published yesterday an article “Popular Dark Web hosting provider got hacked, 6,500 sites down”. The hosting provider “dhosting4okcs22v.onion” was hacked on November 15, 2018 and all data was apparently deleted. The creator Daniel Winzen was cited: “Unfortunately, all data is lost and per design, there are no backups”, and that 6.500+ dark web services are affected.

This is a perfect use case for Intelligence X, as we index the entire darknet and store historical copies. To access the historical copies of the hosting providers website itself, type in their domain (dhosting4okcs22v.onion) and select “Historical Website Copy” under Advanced -> Miscellaneous -> Media Filter. Or, click this link: intelx.io/?s=dhosting4okcs22v.onion&m=14

We just launched! Intelligence X goes live 🥂

Wed, 10 Oct 2018 00:00:00 +0000

Press release / Vienna / October 10, 2018

Global launch of Intelligence X: First search engine for the darknet goes online

Programmer and IT security analyst Peter Kleissner launches Intelligence X – the first search engine that can be used to investigate whether personal or sensitive data have been leaked on the internet. Website available now at intelx.io

Vienna, October 10, 2018: Want a simple way to check at any time whether personal data are circulating on the internet or involved in a leak? What has so far only been possible for IT specialists and companies can now be done by anybody in a matter of seconds with Intelligence X. While conventional search engines are normally used to look for a wide range of everyday information, Intelligence X helps you find the needle in the digital haystack. Rather than searching for names or images, Intelligence X instead targets email addresses, domains, credit card numbers, IP addresses or phone numbers.