From c026143c71f0fa70cec5dce091378a2662b87340 Mon Sep 17 00:00:00 2001 From: Slava Olesik Date: Sun, 25 Oct 2026 10:33:03 +0200 Subject: [PATCH] =?UTF-8?q?docs(arsenal):=20add=20newly=20registered=20loo?= =?UTF-8?q?kalike=20search=20to=20=C2=A728.2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 4 ++++ skills/offensive-osint/SKILL.md | 1 + 2 files changed, 5 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5588101..f93d746 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,10 @@ and the project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html). ## [Unreleased] +### `offensive-osint` — docs: newly registered lookalikes in §28.2 + +- §28.2 Certificates & CT Monitoring: added a keyword search over newly registered domains (NetAPI, keyless), which catches lookalike domains before they get a certificate. + ### `offensive-osint` — docs: TGScope in §38 - §38 Telegram & Messaging Intelligence: added TGScope — dates a Telegram channel from its numeric ID (creation-date / age estimate), plus a free search over public channels that matches by meaning in any language. diff --git a/skills/offensive-osint/SKILL.md b/skills/offensive-osint/SKILL.md index 41268ea..e38f2d6 100644 --- a/skills/offensive-osint/SKILL.md +++ b/skills/offensive-osint/SKILL.md @@ -3195,6 +3195,7 @@ curl -sk "https://ipinfo.io/8.8.8.8?token=" | jq . - [crt.sh](https://crt.sh/), [Censys Certificates](https://search.censys.io/certificates), [CertStream](https://certstream.calidog.io/) (real-time CT WebSocket), [Rapid7 Open Data](https://opendata.rapid7.com/), [Cert Spotter](https://sslmate.com/certspotter) (freemium). - **Favicon mmh3 hash:** cluster infrastructure across hosts; pair with Shodan/Censys favicon search for shared-infra discovery. +- **Newly registered lookalikes:** CT logs only show domains that already have a certificate. [NetAPI](https://netapi.com/) searches the domains registered in the last 1 to 7 days across 1,100+ TLDs by keyword, no key needed: `curl -s "https://netapi.com/api-json/?method=search-new&q=&days=7" | jq -r '.results[].domain'`. Add `match=starts` for prefix matches. ### 28.3 Web tech / TLS / fingerprinting