Forensic OSINT by networkluki

Examine a suspicious web page before you trust it, and keep a record of what you saw.

Forensic OSINT analyzes the page in the current tab when you ask it to. It checks the page for common phishing and security risk indicators, collects open-source information from it, takes screenshots with SHA-256 hashes and puts everything in a local report.

Features

• Risk indicators with evidence and a heuristic risk level: lookalike or mixed-alphabet domains and punycode, well-known brand names on unrelated domains, password forms that are unencrypted or submit to another domain, mixed content, hidden frames, links to executable files, redirects to other domains, obfuscated scripts and blocked right-click.
• Collected information: domains, linked and embedded third-party domains, contact details, social media links, technologies, metadata and cookie names.
• Screenshots of the visible area and, optionally, the full page (scrolled and stitched), each with a SHA-256 hash.
• An evidence hash over all collected data, the capture time in UTC and local time, and a note for your own analysis.
• The report follows the intelligence cycle: preparation, collection, processing, analysis and dissemination.
• Export as HTML, JSON and PNG. The HTML export is locked down so it cannot run scripts.
• Pivot links for further research in open sources (web archives, certificate transparency logs, RDAP, DNS and reputation services). They open only when you click them.
• The 10 latest reports are kept in your browser. English and Swedish interface, light and dark theme.

How it works

Open the page, click the toolbar icon and choose "Analyze this page". The extension reads only what the page has already loaded. It does not click, submit or download anything, and it makes no requests of its own.

Privacy

• Nothing is sent anywhere. No analytics, no tracking, no ads, no servers.
• The extension reads a page only when you click Analyze, and only in that tab.
• Form field values, passwords and cookie values are never read.
• Reports are stored only locally in your browser and can be deleted at any time.

Good to know

• The indicators are heuristics. A low risk level does not prove that a page is safe, and legitimate pages can trigger indicators.
• Full-page capture scrolls the page and briefly hides fixed headers, then restores them. Scrolling can make the page load more content.
• Only the main page is analyzed, not the contents of embedded frames.
• The hashes show that the evidence has not changed since capture. They are not a signature or a trusted timestamp.
• Use the extension lawfully, and respect privacy and the terms of the sites you examine.