Topic
Open-source intelligence over the indexed web: exposure discovery, reconnaissance, and threat hunting.
Attackers use Google dorking to find your exposed config files, forgotten subdomains, and indexed admin panels. This guide flips it: run the same operators against your own domains, automate the sweep with an API, and alert the day a new exposure gets indexed. All own-scope, all defensive.
A defensive map of the OSINT tools that matter in 2026 (Maltego, SpiderFoot, Shodan, theHarvester), plus the search-engine and AI-answer recon layer cloro adds.
Most typosquat coverage stops at registration counts. In cloro's July 2026 study of 400 dnstwist-style permutations across 15 brands, 66% resolved to a live site, and of the resolving squats we checked, 53% were already Google-indexed. Registration isn't reach. Indexing is.
In an own-scope study of cloro.dev, Certificate Transparency surfaced 15 hostnames but only 3 were search-indexed. A defensive site: sweep found ~20 exposed URL paths host enumeration never sees. The two layers are complementary, not redundant.
Log-based threat hunting sees what touched your network. It can't see your credentials pasted to a public gist, a phishing domain registered against your brand, or a staging box Google indexed last week. This is the open-web hunting layer: four repeatable, own-scope hunts you can schedule and diff.
