Topic
Open-source intelligence over the indexed web: exposure discovery, reconnaissance, search operators, and threat hunting with public data.
Attackers use Google dorking to find your exposed config files, forgotten subdomains, and indexed admin panels. This guide flips it: run the same operators against your own domains, automate the sweep with an API, and alert the day a new exposure gets indexed. All own-scope, all defensive.
A defensive map of the OSINT tools that matter in 2026 (Maltego, SpiderFoot, Shodan, theHarvester), plus the search-engine and AI-answer recon layer cloro adds.
Most typosquat coverage stops at registration counts. In cloro's July 2026 study of 400 dnstwist-style permutations across 15 brands, 66% resolved to a live site, and of the resolving squats we checked, 53% were already Google-indexed. Registration isn't reach. Indexing is.
In an own-scope study of cloro.dev, Certificate Transparency surfaced 15 hostnames but only 3 were search-indexed. A defensive site: sweep found ~20 exposed URL paths host enumeration never sees. The two layers are complementary, not redundant.
Log-based threat hunting sees what touched your network. It can't see your credentials pasted to a public gist, a phishing domain registered against your brand, or a staging box Google indexed last week. This is the open-web hunting layer: four repeatable, own-scope hunts you can schedule and diff.
