A practical security surface for visitors: breach-provider lookup when the backend is configured, real password range checking, DNS email-domain posture, URL triage, phone-number hygiene, and live incident briefings. No fake dark-web results.
Runs through the Forneus backend OSINT pipeline: HIBP, EmailRep, Gravatar, domain OSINT, and optional h8mail/Holehe CLI adapters when installed on the server. If an exact breach provider is not configured, the page still returns useful OSINT signals instead of inventing a dark-web result.
Server OSINT is ready. Exact breach hits improve when HIBP, h8mail, Holehe, or a licensed provider is configured.
Enter an email or domain. This uses public DNS-over-HTTPS to check whether the domain is prepared to resist spoofing and mailbox abuse.
Checks MX, SPF, DMARC policy and basic mailbox risk signals.
The password is hashed in the browser. Only the first 5 SHA-1 hash characters are queried against the public range API.
No password leaves this page in plain text.
Paste a link. The page parses it locally and flags common phishing indicators: lookalike structure, IP hosts, unsafe schemes, encoded payloads, and credential keywords.
No URL has been analyzed yet.
Enter a phone number. This does not claim breach access; it validates format and returns practical account-protection steps for that number.
Useful for deciding whether to harden recovery channels.
Auto-refreshing public sources plus local decision tools. The visitor can learn something, test something, and leave with an action plan.
Choose a scenario and the page builds a concrete first-response checklist.
Tick what you already use. The score updates instantly and gives the next best move.
Start with password manager and MFA on your main email.