Lookups

The core lookup toolkit. Eight tools, one input box, one rule: you name a thing, it tells you what is publicly on record about it.

Every tool here is included on every plan, Free as well. Each run costs one OSINT lookup from the monthly allowance — except Ask AI, which is a conversation and costs an AI assistant query instead (plus the normal lookup cost of each step it runs; see the AI page).

#How it works

Pick a tool from the rail, type the subject, run it. Results render as structured panels, not raw JSON — though the raw response is one click away.

Two things happen alongside the answer:

Anything with a location lands on the map. After a lookup on a domain or address, the subject is geolocated in the background and dropped as a marker, so the lookup and the globe stay one workspace.
Everything is saved. The lookup goes into your history and into that subject's profile, where the next lookup on the same subject will join it.

Lookups also has an AI mode that plans a whole investigation rather than running one tool — see The AI assistant.

#The tools

Tool	The question it answers	Give it
DNS	Which servers answer for this domain, and what does it publish about itself?	`example.com`
WHOIS	Who registered this domain, when, and through whom?	`example.com`
Certs	What TLS certificates have been issued for this name — including for subdomains nobody mentioned?	`example.com`
Threats	Has this been reported as malicious?	IP, domain, URL or file hash
Shodan IoT	What services does this one address expose to the internet?	`8.8.8.8`
BGP Route	How is this address routed, and through whose network?	IP, ASN or prefix
MAC Addr	Which manufacturer made this hardware?	a MAC address or OUI
Ask AI	What am I even looking at?	any text, URL or indicator

#Where each answer comes from

DNS — public resolvers (A, AAAA, MX, TXT, NS, CNAME, SOA).
WHOIS — RDAP, the structured successor to WHOIS.
Certs — Certificate Transparency logs via crt.sh. Certificates are published by design, which is why this is the cheapest honest way to find hosts nobody documented.
Threats — AlienVault OTX, plus the Tor exit-node list.
Shodan IoT and Exposure — Shodan's InternetDB, a published dataset of past scan results. Reading it sends nothing to the address.
BGP Route — BGPView.
MAC Addr — the public OUI vendor registry.
Ask AI — a language model classifying whatever you paste and pulling indicators out of it.

#The sanctions cross-check

WHOIS and IP results are checked against sanctions lists automatically, so a sanctioned registrant or an address routed through a sanctioned operator surfaces beside the ordinary result. You do not have to remember to ask.

#Sanctions and CVE

Two more lookups exist without a tool tab of their own, reachable by asking Lookups' AI:

Sanctions search — persons, organisations, companies, vessels and aircraft, matched by substring and alias.

CVE lookup — a published vulnerability record with its CVSS score, affected vendors and description, from MITRE and CIRCL.

#What "not found" means on a sanctions search

The search covers two lists: the US Treasury's OFAC SDN list and the UN Security Council consolidated list, as their publishers issue them.

It does not cover EU, UK or Swiss designations, and it holds no politically-exposed-person data.

So a clean result means not on those two lists. It is not a clearance, and it says nothing about any other jurisdiction. Read it that way, and say so if you pass it on.

#What Lookups will not do

It will not scan, probe or connect to a subject on your behalf. Every tool here reads a published record or a published dataset.
It will not identify a person. There is no name-to-profile lookup in this product.
It will not tell you whether something is safe. A clean threat-intel result means nobody has reported it, which is a different claim.

#Next

Exposure — the same idea, applied to a whole network block
Recall — searching what you have already collected
Profiles and reports — where the findings accumulate