Search
Open source lookups by name, username, email, phone or domain, run on your server from public sources. Results are leads, not facts.
- Home key: o
- Needs: Needs your server
- Runs on: Your server
- Offline: History under a week old
The query box. Tab cycles the kind of lookup; History sits underneath.
Use it lawfully
Search reads public sources. It does not make a lawful purpose for you. Do not use it to locate, track or harass anyone, or to make decisions about employment, housing, credit or insurance. See the terms and disclaimers.
What it does
Pick a kind with Tab, type, press Enter. Your server runs the lookup and sends back findings, each with its source and a confidence. A name, email or domain takes two to four minutes.
| Kind | Looks at |
|---|---|
| name | Wikipedia and GitHub, plus pre-filled links to people search sites. The sites are linked, never scraped. |
| username | About 35 sites, checked for a profile in the manner of Sherlock and WhatsMyName. |
| Gravatar and GitHub, and MailAccess on your server, which checks where an address is registered across many platforms. No mailbox is ever probed or logged in to. | |
| phone | Public sources for the number. |
| domain | Certificates from crt.sh, RDAP registration, DNS and the Wayback Machine; addresses and subdomains found by MailAccess; and for each IP, where it is and who owns it from ipwho.is and what Shodan InternetDB has seen. A bare IPv4 address works too. |
Keys
| Where | Key | Does |
|---|---|---|
| Box | Tab | Cycle the kind. |
| Box | Down | Walk History. |
| Box | x twice | Clear History and every stored result. |
| Results | Enter | Open a finding. |
| Results | s | Every source and what it said, including ones skipped for lack of a key. |
| Results | r | Ask the server again. |
| Finding | o | Save into notes, which sync. |
History
A lookup with a stored result younger than seven days opens from that result without asking the server, and the footer says how old it is. Older, or never run, asks the server. If the server cannot answer, a stored result is shown with the error. Thirty entries are kept.
Keys for paid sources
Some sources need an API key: Have I Been Pwned, Hunter, Shodan, BuiltWith and OpenCorporates. Put each in ~/.config/pennyos/<name>.key on the server. Without one, the source is listed as "skipped: needs key", never silently left out. Keys never reach the device.
Needs on the server
pennyos-osint installed from tools/osint_search.py, and MailAccess in its own Python environment for the email and domain kinds. See Server setup.