Keyless sources
Pulls from dozens of free public datasets — no paid API keys required for core coverage.
Data source · OSINT
theHarvester.
Correlated. One report.
theHarvester is a long-standing open-source OSINT tool that aggregates public intelligence about a domain from many free sources in a single pass.
About the source
What is theHarvester?
darkweb-scanner runs theHarvester across keyless sources (certificate transparency, search engines, DNS datasets, and more) to enumerate emails, employee names, subdomains, and hosts tied to a domain — the raw material attackers use for phishing and targeting. It also integrates the Hudson Rock module for breach signal.
- Maintainer
- Christian Martorella / community
- Coverage
- Emails, subdomains, hosts, employees
- License
- GPL-2.0 (run as a subprocess)
Capabilities
What theHarvester covers
The source's scope — we query it against your domain and report the exposures we find.
Email & people discovery
Surfaces the addresses and names that fuel phishing and credential-stuffing campaigns.
Breach module
Integrates Hudson Rock's infostealer feed directly into collection.
Headless & scriptable
Runs fully automated with JSON output, orchestrated by our worker.
Surface area
Where it looks
EmailsEmployee namesSubdomainsHosts
Use cases
When it earns its keep
Phishing-exposure review
See which employee emails and names are publicly harvestable.
Footprint mapping
Combine with Shodan to build a full external picture of a domain.
OSINT for engagements
Jump-start recon without wiring up a dozen tools by hand.
Other data sources
Add another source
Cavalier
Infostealer / stealer-log intelligence — which employees and users of a domain have been captured by malware, including live credential and session data.
Shodan
External attack-surface intelligence — subdomains, exposed services and open ports, and known CVEs on internet-facing hosts tied to a domain.
Maigret
Maps usernames and handles tied to a domain's people across 4,000+ sites — the public identity footprint attackers use for targeting.
One credit. One domain. One report.
Run theHarvester against a domain and get a severity-ranked exposure PDF. Credits never expire.