Version History

Changelog of all releases and improvements to the Exploratores OSINT Toolkit.

3.10.5 — 2026

  • Improved: Redactor: Clear Redaction Map is now the first button of the Redaction Map section and is repeated at the end of the Text / CSV row of the Redactor, so the session can be reset without scrolling. Both buttons turn blue only while a redaction map is active. Help page and on-page note updated.

3.10.4 — 2026

  • Fixed: Company Public Records: the CAC (Nigeria) button opened the CAC UDRP search added in 3.10.3, because the two buttons shared the identifier publiccompanyrecords-company-cac. The three CAC UDRP buttons now have their own identifiers (domains-records-udrp-cac, names-udrp-cac, publiccompanyrecords-company-udrp-cac) and CAC (Nigeria) opens the Nigerian company register again.
  • Fixed: CI: verify-meta.mjs now also fails on repeated or unknown identifiers (a key declared twice in search-library.js or janua-search-map.js, a button id or data-search-id used twice in a page, a data-search-id with no catalogue entry), through the new scripts/catalogue/check-ids.mjs and its test suite tests/check-ids.test.mjs. It would have stopped the CAC clash above before release.

3.10.3 — 2026

  • Removed: Virtual Currencies: BTC Validation (bitcoin-e.org): the domain no longer exists (eight weekly link checks, confirmed on 2026-10-31 through the Cloudflare and Google public DNS). No replacement: getAndValidateBtcAddress already checks the address format before any Bitcoin button is enabled.
  • Changed: Communities → Reddit: the Archive button (camas.unddit.com, domain gone) is replaced by Arctic Shift (arctic-shift.photon-reddit.com), the public Reddit archive: it opens the post search already filtered by the author. Checked in a browser on 2026-10-31.
  • Removed: Domains → Security and IP → Security: ThreatCrowd (ci-www.threatcrowd.org): the domain no longer exists (eight weekly link checks, confirmed on 2026-10-31 through public DNS). ThreatCrowd was absorbed into AlienVault OTX, already on the Domains page.
  • Added: IP → Security: AlienVault OTX (otx.alienvault.com/indicator/ip/{ip}): community threat pulses and passive DNS for an IP address, no login needed. Checked in a browser on 2026-10-31.
  • Removed: Domains → DNS: Columbus Subdomains (columbus.elmasy.com): the service has been down since autumn 2024 (unanswered outage reports in the project repository, last code change in 2023) and the domain no longer resolves; checked on 2026-10-31. CRT.sh, Netcraft Subdomains and DNSDumpster still cover subdomain discovery.
  • Removed: Domains → DNS: DomainApp DNS (dns.domainapp.com): the subdomain was dropped from the DNS zone (no change to the zone since June 2024) and domainapp.com now serves only a blank default web-server page; checked on 2026-10-31. DNS Records, DNS Report, Resolve.rs DNS, Robtex and DNSlytics still show a domain's DNS records.
  • Removed: Email and Usernames: psbdmp (psbdmp.ws, Pastebin dump search): the service has closed. psbdmp.ws no longer has any address, and its later domain psbdmp.cc now hosts a different service (Weakpass password lists) whose API has no dump search; checked in a browser on 2026-10-31. No replacement.
  • Removed: Domains → Archive: Mementoweb (timetravel.mementoweb.org, the Memento Time Travel aggregator): the Memento project shut the service down and kept mementoweb.org only for documentation; no public web aggregator has replaced it (the successors, such as MemGator, must be self-hosted). Checked on 2026-10-31. Archive.org, archive.ph, Archive.md, Arquivo.pt and Archive-IT remain on the page.
  • Removed: Names → United States: USA-Official (usa-official.com, people search): the site was shut down together with its twin data broker PublicDataUSA (publicdatausa.com): both domains had their DNS dropped from the same Cloudflare account on 2026-06-05 and no longer resolve; the weekly link check has failed on it since its first run (2026-08-07). Checked on 2026-10-31. No replacement: 22 people-search services remain in the section.
  • Removed: Usernames: Checkistan (usernamechecker.checkistan.com): the subdomain no longer exists (failing since the first weekly link check, 2026-08-07). The tool now lives at checkistan.com/username-checker, but it no longer takes the username from the address and is aimed at finding free handles, not existing profiles; checked on 2026-10-31. No replacement.
  • Removed: Domains → Archive: Archive Scan (CDX) (web-archive-scan.com): the service has closed and the domain registration has lapsed (the .com registry no longer knows the domain, so anyone could register it); failing since the first weekly link check, 2026-08-07. Checked on 2026-10-31. Archive.org, Archive URL Wildcard and WayBack Keyword still query the Wayback Machine directly.
  • Removed: Domains → Profile: Webscout (web-scout.io): the service has closed and the domain registration has lapsed (the .io registry no longer knows the domain, so anyone could register it); failing since the first weekly link check, 2026-08-07. The similarly named webscout.io is an unrelated commercial threat-intelligence company with no public domain search. Checked on 2026-10-31. No replacement.
  • Removed: Domains → SEO: SiteMapper (www.sitemapper.com, Visual Site Mapper by Alentum Software): the online service has closed: its DNS zone was deleted, the project site visualsitemapper.com now redirects to the source code on GitHub (unchanged since 2016), and the weekly link check has failed on it since its first run (2026-08-07). Checked on 2026-10-31. No replacement.
  • Removed: Names → United States and US Phones: Nuwber (nuwber.com): the people-search service shut down in mid-September 2026 (last working weekly check 2026-09-13, failing since 2026-09-20): its DNS zone still exists but no longer has any address, and several data-broker opt-out projects list it as defunct since October 2026. The owner has renewed the domain until 2031, so it may return: it is on the monthly watch list in Ideas & Roadmap. Checked on 2026-10-31.
  • Removed: Domains → Security: PhishCheck.me (phishcheck.me): the service has closed and the domain now points to a cloud server reassigned to someone else (a UISP network-management login with a *.uisp.com certificate; the old check URL returns 404). Broken TLS since the first weekly link check, 2026-08-07; re-checked on 2026-10-31 from a residential IP. No replacement: VirusTotal, urlscan.io, AlienVault OTX, Pulsedive and IBM X-Force remain.
  • Removed: RiskIQ, 7 buttons on community.riskiq.com (Domains → Security, AdSense and Analytics; IP → Security; Names; International Phones; Usernames): the service no longer accepts connections from any network (re-checked on 2026-10-31 from a residential IP), riskiq.com redirects to Microsoft Security, and its free successor, the Microsoft Defender Threat Intelligence portal (ti.defender.microsoft.com), no longer exists either: the data now sits only in the licensed Microsoft Defender portal. Failing since the first weekly link check, 2026-08-07. No replacement; the Names button was also mislabelled ("Address" while it searched trackers).
  • Changed: UDRPSearch (www.udrpsearch.com), 3 buttons, replaced by the official WIPO domain-dispute database: UDRPSearch was switched off on purpose (its domain now points to the private address 10.0.0.1, last change 2026-04-23) and has failed since the first weekly link check, 2026-08-07. Domains → Records and Company Public Records now run the WIPO full-text search on panel decisions; Names now runs the WIPO search by named respondent. Checked in a browser on 2026-10-31. WIPO covers only its own cases, not those of the other UDRP providers (Forum, ADNDRC, CIIDRC) that UDRPSearch aggregated.
  • Removed: Email and US Phones: SpyTox (spytox.com, www.spytox.com, people search): the server no longer answers on any port from any network (re-checked on 2026-10-31 from a residential IP), another OSINT project already dropped it as dead in March 2026, and the domain expires on 2026-12-27. Failing since the first weekly link check, 2026-08-07. No replacement.
  • Removed: Virtual Currencies → Bitcoin: OXT.me (oxt.me, block explorer): the server no longer answers from any network (ports closed on oxt.me, Cloudflare error 522 on www.oxt.me; re-checked on 2026-10-31 from a residential IP), although the domain is still renewed. Failing since the first weekly link check, 2026-08-07. No replacement: Blockchair, Blockchain.com, mempool, WalletExplorer (which also clusters addresses by wallet) and Chainabuse remain.
  • Removed: Domains → Profile: SpyOnWeb (spyonweb.com, sites sharing an Analytics/AdSense code or an IP): the server refuses every connection (re-checked on 2026-10-31 from a residential IP) and has done so since late August 2026; other OSINT link checkers report the same. The owner renewed the domain in October 2026, so it may return: it is on the monthly watch list in Ideas & Roadmap. AnalyzeID, DNSlytics and HackerTarget remain for Analytics and AdSense codes.
  • Fixed: IP → Security: IKWYD Torrents now opens over HTTPS (https://iknowwhatyoudownload.com/en/peer/?ip={ip}). The service is alive: the single weekly-check timeout of 2026-10-25 was transient (checked on 2026-10-31).
  • Added: CAC UDRP, next to WIPO UDRP: the decision database of the Czech Arbitration Court (udrp.adr.eu), the second UDRP provider reachable by URL. Domains → Records filters decisions by domain, Names by named respondent, Company Public Records by the text of the decision. Checked in a browser on 2026-11-01. The other providers (Forum, ADNDRC, CIIDRC) have no search that can be opened from a link.

3.10.2 — 2026

  • Fixed: Public Company Records: the two FOIA buttons (officers and companies) now search through search.usa.gov with affiliate=foia.gov, the engine behind the search page of FOIA.gov; the old search.foia.gov host no longer exists. Same parameters, same results.
  • Removed: Public Company Records: MoneyLine (politicalmoneyline.com, individual donor search): the domain no longer exists (checked on 2026-10-31 from an IP other than the link checker's and through the Cloudflare and Google public DNS). Open Secrets, already in the officers section, covers the same campaign-donation data.

3.10.1 — 2026

  • Fixed: Legal page: all 15 buttons now use the page input (native GET search for Giustizia amministrativa and Portale delle Vendite Pubbliche, VIES REST API lookup for EU VAT numbers via getAndValidateEuVat, and site-scoped search for Normattiva, Gazzetta Ufficiale, SentenzeWeb, Corte costituzionale and Garante privacy); getAndValidateUrn also accepts year-only URNs, article suffixes and Italian act citations (e.g. L. 241/1990, D.Lgs. 196/2003).
  • Fixed: Button activation across the toolkit: blue active styling (.text-active) now activates only when the input is valid and suited to that specific button; form-only (no_input) shortcuts stay clickable without turning blue.
  • Fixed: Janua dispatcher now passes the query value to generic search engine buttons and skips disabled/no-input entries; getAndValidateMd5Hash normalises uppercase queryOverride values.

3.10.0 — 2026

  • New: Legal page (Italy and European Union), 15 tools, in the menu after Names. Italy: Normattiva (URN resolver and simple search), Gazzetta Ufficiale, Brocardi, SentenzeWeb (Court of Cassation), Corte costituzionale, Giustizia amministrativa, CONSOB (search and listed companies), Garante privacy and Portale delle Vendite Pubbliche; European Union: EUR-Lex quick search, CURIA case lookup, TMview and VIES. Every URL was opened and checked in a browser on 2026-10-30; services that only offer a form are direct links with an explanatory tooltip.
  • New: Validators for Normattiva URNs (e.g. urn:nir:stato:legge:1990-08-07;241) and Court of Justice case numbers (e.g. C-311/18): the Normattiva (URN) and CURIA buttons are enabled only for a valid value. Tests added to the validators suite.
  • Improved: Gazzetta Ufficiale moved from Names → National Registers → Italy to the Legal page (same link).
  • Fixed: The Normattiva URN is no longer percent-encoded: the {urn} placeholder keeps its colons and semicolons, because Normattiva rejects the encoded form. Every other placeholder is still percent-encoded.
  • Fixed: Ideas & Roadmap: the Italgiure note corrected — the service is active (SentenzeWeb) and is back as a form-only link on the Legal page; the candidates checked on 2026-10-30 and discarded are listed with the reason.

3.9.0 — 2026

  • Added: Public Company Records: SanctionsKit for officers and companies, next to OpenSanctions. OpenSanctions covers more lists (it also has the EU consolidated financial sanctions list and the UN Security Council list); SanctionsKit shows the source dates of each record (notice, effective, observed), links to the publisher and can save a dated version to cite. A name match is not an identity conclusion. Suggested in issue #2.

3.8.3 — 2026

  • Fixed: Guidelines: ICD 203 wording corrected: tradecraft standard 5 is customer relevance and the Timely standard speaks of customers, not stakeholders; judgements in British spelling. The likelihood table keeps both ICD 203 rows, adds the (improbably) and (probably) variants, and now says to use the first row; ICD 203 and the UNODC Criminal Intelligence: Manual for Analysts are linked at their first mention.
  • Docs: FAQ: new entry Can I use Exploratores from an AI assistant? (Claudii Exploratores, Il Conclave); Codex Machinae cited in LLMs and Toolkit Development; the related projects add Claudii Exploratores, TGchat-analytics, the Maigret fork, Il Conclave and Codex Machinae; Argos named with its targets (Ubuntu Budgie 24.04 or 26.04 LTS). The HTML FAQ now follows the section order of the Markdown source.
  • Docs: README: the Guidelines description lists all its sections; the Heuer link labelled free PDF now points to the PDF; Related Projects extended. docs/field-notes/ updated to the Intelligence Field Notes 0.1.2.

3.8.2 — 2026

  • Docs: Guidelines aligned with the Intelligence Field Notes, the notes on analytic standards, OSINT method, source evaluation and report writing now shared by all the SOsintOps tools: new sections Source Evaluation (UNODC 4 x 4 grading), Working with Exploratores (what a search button sends, results as leads, official registers first, local tools, AI and the Redactor) and Writing the Report; the ICD 203 likelihood table now says to use one row only and never to put confidence and likelihood in one sentence; every book in Further Reading is linked, and the CIA Tradecraft Primer and ICD 203 are added.
  • Docs: FAQ: new entries How should I evaluate what I find with the toolkit?, How do I turn the results into a report? and Are there related SOsintOps projects?; the reading list is linked and adds the UNODC Criminal Intelligence: Manual for Analysts.
  • Docs: README: new Related Projects section; References updated. docs/field-notes/ carries an offline copy of the Intelligence Field Notes.
  • Fixed: Rae L. Baker's book is Deep Dive: Exploring the Real-World Value of Open Source Intelligence (it was given a wrong subtitle in the FAQ and README); Bazzell's book is now OSINT Techniques (11th edition, with Jason Edison); the ICD 203 link points to the current ODNI address; Sterile Browsing Environment.

3.8.1 — 2026

  • Removed: Names → Italy: Italgiure (Court of Cassation rulings) — the service is being discontinued at the end of September 2026. The Italy set is now 11 tools.

3.8.0 — 2026

  • New: Italy sources — first country of the country-sources programme (see Ideas & Roadmap), 12 tools: Names → National Registers → Italy: Portale Antenati (civil records held by the State Archives, searched by surname and name), FNOMCeO Albo Unico (doctors and dentists), Italgiure (Court of Cassation rulings) and Gazzetta Ufficiale (issue search); International Phones → Country-Specific Services: Pagine Bianche reverse number lookup; Company Public Records → Companies → Italy: Registro Imprese free search, Agenzia delle Entrate VAT-number check, INI-PEC certified-e-mail index, IndicePA public-administration index and dati.gov.it open-data search; Maps → new "Cadastre & National Maps" → Italy: Agenzia delle Entrate cadastral geoportal; Domains → Whois & DNS Lookup: .it Registry web WHOIS. Every URL was opened and checked in a browser on 2026-09-22; services that only offer a form or a CAPTCHA are direct links with an explanatory tooltip.
  • Docs: Ideas & Roadmap: the Italian candidates that were discarded, with the reason, and what is still to be looked at.

3.7.0 — 2026

  • New: Catalogue updates for offline copies: the new assets/js/catalogue-updater.js (loaded right after search-library.js on every tool page) can refresh the search catalogue from the project repository without a git pull. Off by default; when switched on in the Settings page the browser checks catalogue-meta.json on GitHub once a day, downloads search-library.json when a newer one is published, verifies its SHA-256 checksum and structure, and keeps it in local storage. The cached catalogue is applied at the start of every page load (effective from the next page opened); entries needing a validator missing from the local validators.js are ignored, and metadata pointing outside the repository is refused. Requests carry no cookies and no referrer. The site on GitHub Pages does not need it.
  • New: Settings page (pages/settings.html) now linked from the Help menu, with the Catalogue updates toggle, a status line (cached version, entries, last check), "Check now" and "Discard cached catalogue" buttons; toggle-switch styling added to the stylesheet. The previous, unlinked draft of the page (a typewriter toggle with no effect) was removed.
  • Improved: Tests: new tests/catalogue-updater.test.mjs (14 cases) with stubbed fetch and localStorage, run by the CI.
  • New: FAQ: "Can an offline copy of the toolkit refresh its catalogue?" entry.

3.6.0 — 2026

  • New: Link health: the weekly link checker now closes the loop. Tools on hosts confirmed dead or unreliable (two-strike policy) are marked "disabled" in search-library.js by the new scripts/linkcheck/apply-history.mjs, and the change is proposed as an automated pull request (branch auto/disable-dead-links, label dead-links) — merging stays a human decision. Disabled buttons appear greyed out and struck through, show the confirmation date in their tooltip, never open and are hidden from the Toolkit Search; hosts that recover lose the flag at the next run.
  • New: Catalogue export: assets/data/search-library.json (pure-data copy of the catalogue) and assets/data/catalogue-meta.json (version, date, entry and disabled counts, SHA-256, download URL), generated by scripts/catalogue/build-meta.mjs and guarded by verify-meta.mjs in the CI. Groundwork for the optional in-browser catalogue update planned for a later release.
  • Improved: Tests: new tests/linkcheck.test.mjs (19 cases) covering the disable/re-enable logic, line-ending preservation and the export hashing; the CI runs it next to the validators suite.
  • New: FAQ: "What happens to the tools on a dead host?" entry; Customise guide documents the optional no_input and disabled catalogue fields.

3.5.0 — 2026

  • New: Telegram Tool: dedicated page (pages/telegram.html, Social Media menu) replacing the Telegram section of the Communities tool. Adds in-channel search — t.me/s/<channel>?q=<term> reads the public web preview of a single channel and matches file names and extensions as well as message text, with no Telegram account — plus a message-ID jump for reaching a channel's earliest posts, Wayback Machine history of channel previews, a link-mention search, the Telegago and OSINT.ME Google Custom Search Engines (both restricted to public Telegram domains, different indexes) and Telegraph and invite-link searches. The six previous buttons are unchanged; ids moved from communities-tg-* to telegram-*.
  • New: Dork Builder: Telegram template category — canonical t.me/telegram.me, Telegraph, a bundle of ten mirror and directory hosts, invite links and handles in bios. Wildcard TLDs are expanded explicitly (site:tgstat.com OR site:tgstat.ru) because Google's support for them is unreliable.
  • Improved: Telegram user and channel inputs now strip a leading @, so a pasted @handle no longer produces a broken URL.
  • Improved: Tests: coverage for the Telegram validators, which were previously untested — 13 new cases, 101 in total.

3.4.4 — 2026

  • Improved: IBAN Tool: offline bank-name databases rebuilt from official registries (via the MIT-licensed schwifty bank registry) — Germany is now complete with ~3,500 Bundesbank BLZ entries (was ~80), Italy ~530 ABI entries (was ~340), Spain ~560 Banco de España entity codes (was ~35) and France ~230 CIB codes (was ~55). Superseded codes from the previous curated lists are retained so legacy IBANs still resolve; the coverage table on the page reflects the new figures.

3.4.3 — 2026

  • Improved: Redactor: the page logic (~940 lines of JavaScript) moved from an inline script in pages/redactor.html to the new assets/js/redactor.js module. No functional changes — redaction, restore, custom patterns and the redaction map behave exactly as before; the page now follows the no-inline-scripts convention and the browser can cache the script.

3.4.2 — 2026

  • Security: All search buttons now open external sites with noopener,noreferrer: the destination page no longer receives a window.opener handle on the toolkit tab (tab-nabbing prevention). Applied to the central engine (main.js) and to the page scripts of the Dorks and VK tools.
  • Security: New site-wide <meta name="referrer" content="no-referrer"> on every page: the browser no longer sends the referrer to queried services, so external tools cannot see that the visit originates from Exploratores.
  • New: FAQ: "Do the external services I search know that I am using Exploratores?" entry documenting the no-referrer policy and the noopener,noreferrer flags, with the reminder that IP address and browser fingerprint remain visible (VPN recommended).

3.4.1 — 2026

  • Fixed: FAQ: dead SWIFT BIC directory link replaced with the current swift.com BIC standard page; the Light Version selector example now matches the real config.js entry; VAT country count corrected to 30.
  • Fixed: Docs: faq.md realigned with the FAQ page (IBAN bank-database update guide, recommended reading list, Redactor and IBAN entries in the Table of Contents); Customise code snippets aligned with the real validator API (queryOverride parameter, strict IPv4 regex, isValid return convention) and lowercase page filenames.
  • Improved: Customise: custom-pattern Technical Notes now document ReDoS screening, the type-name character set and length limits, and the Flags column; auxiliary JS modules listed alongside the five core files.
  • Improved: Help pages: uniform layout — consistent 2-space indentation, intro subtitle on all four pages, FAQ Redactor entries wrapped in standard faq-item blocks; versionhistory.html wording realigned with versionhistory.md (British spellings, "Centralised architecture").

3.4.0 — 2026

  • New: Redactor: phone detection extended beyond Italy — German mobiles (015x/016x/017x, PHONE_DE_MOBILE), French mobiles (06/07 in pairs, dots, hyphens or compact, PHONE_FR_MOBILE) and UK mobiles (07xxx xxxxxx, PHONE_UK_MOBILE), each with or without its country code, plus a generic PHONE_INTL catch-all for any number with an explicit +CC prefix (6–12 digits) or 00CC followed by a separator. The compact 00CC… form is deliberately not matched: it cannot be told apart from zero-padded numeric IDs common in CSV exports. Country-specific patterns are evaluated before the generic one so prefixed numbers keep their country type; the whole block stays before PCN/SE10 in overlap resolution.
  • Improved: Redactor: the "Detects" note is now a three-column grouped list (Personal identity / Financial & payment / Contact & other) with alphabetical entries, replacing the single bullet-separated paragraph; payment-card BIN ranges live in the help page only.

3.3.0 — 2026

  • Improved: CyberChef updated to v11.2.0 (from v10.22.1); the bundled module set now includes the new File.js module.
  • New: FAQ: "What inspired the creation of the toolkit?" entry crediting Michael Bazzell's Open Source Intelligence Techniques as the inspiration for the browser-based search-tool approach; the codebase remains an original implementation.

3.2.0 — 2026

  • New: Redactor: cryptocurrency address detection — Bitcoin (legacy, P2SH and bech32/segwit-taproot), Ethereum and every EVM chain (0x…, also BSC/Polygon/Arbitrum wallets), Monero, Litecoin, Tron, Ripple. Matching is structural (prefix, alphabet, length); checksums are not verified. Solana and other plain-base58 formats without a fixed prefix are omitted by design: they would match too many random tokens.
  • New: Redactor: national identity and social security numbers for 10+ jurisdictions — US SSN (dashed form), UK National Insurance number (compact and spaced, real restricted alphabet), Spain DNI/NIE (validated against the real check-letter alphabet), France NIR (compact and INSEE-spaced, Corsica 2A/2B included), Switzerland AVS (756 prefix), Romania CNP, Finland HETU, Nordic personal numbers (SE/DK/NO separated form), Czech/Slovak rodné číslo (slash form), Belgium national number (dotted form). Digit-only IDs with no distinctive structure (NL BSN, DE Steuer-ID, PL PESEL, HR OIB, UK NHS) are deliberately excluded and documented as custom-pattern material.
  • New: Redactor: payment card coverage extended with JCB (3528–3589), Diners Club (300–305/36/38, 4-6-4 grouping) and UnionPay (62, 16–19 digits).
  • Improved: Redactor: card numbers grouped with hyphens (4111-1111-1111-1111) are now detected for Visa, Mastercard, Discover, JCB and UnionPay; IBAN matching accepts lowercase and hyphen-separated forms in addition to compact and spaced.
  • Changed: docs: the custom-pattern walkthrough example switched from SSN_US (now a built-in type) to a CASE_ID internal-reference example.

3.1.7 — 2026

  • Improved: Redactor: the Redaction Map is now grouped by data family following the pattern order — payment cards first (AMEX, VISA, MASTERCARD, DISCOVER), then Codice Fiscale, VAT codes, email, IBAN, phone numbers, PCN, SE10, and custom patterns last — instead of alphabetically, so related types sit together.
  • Fixed: Redactor: placeholder numbering now follows reading order — [TYPE_1] is always the first occurrence in the text. Previously numbers were assigned during the right-to-left substitution pass, so the last occurrence received _1.

3.1.6 — 2026

  • Security: all Google Fonts references removed; Inter and Cinzel are now self-hosted in assets/fonts/ (WOFF2, latin + latin-ext subsets). No third-party request — and therefore no Referer metadata — ever leaves a page, closing the last external dependency on pages that process PII.
  • Security: Redactor: custom patterns are now screened against catastrophic backtracking (ReDoS): nested-quantifier structures are rejected outright and every new pattern must complete a timed canary run before being accepted.
  • Security: Redactor: custom patterns loaded from localStorage are fully validated (type name, regex source, flags, colour) before use; the Redaction Map and Custom Patterns tables are built with DOM APIs instead of innerHTML, removing the structural dependency on manual HTML escaping.
  • Fixed: Redactor: both CSV FileReaders now report read failures with an alert instead of failing silently.
  • Fixed: Redactor: Restore CSV now shows the same large-file warning as Redact CSV before processing.
  • Fixed: Redactor: clipboard copy failures (permission denied, non-HTTPS context) now show "Copy failed" on the button instead of a false "Copied!".
  • Improved: Redactor: Import Map enforces hard caps (10,000 entries, 10,000 characters per value, 5 MB JSON) and first-mapping-wins conflict resolution when the same original value appears under two placeholders.
  • Improved: Redactor: "Clear Session" renamed to "Clear Redaction Map"; UI notes clarify that custom patterns — including their type names — persist in localStorage and are not touched by the button.
  • Improved: Redactor: duplicate type names are rejected inside addCustomPattern as well as in the UI; type names are restricted to A–Z 0–9 _; the CSV line-count warning also counts bare-CR (old Mac) line endings.
  • Chore: internal working files (todo/, docs/WIP/, pages/test/, local status notes) removed from the repository ahead of public release.

3.1.5 — 2026

  • New: Redactor: CSV restore mode added to the Restore section. Upload a previously redacted CSV file, apply the current session map to every cell, and download the result as restored.csv. The CSV parser follows RFC 4180 and handles quoted fields, embedded commas, and line breaks inside cells.
  • Improved: Redactor: section heading and action button renamed from "Censor" / "Censor CSV" to "Redactor" / "Redact CSV" for consistency with the tool name.
  • New: Help: dedicated guide pages added for the Redactor (help-redactor.html) and the IBAN Tool (help-iban.html), with step-by-step instructions and screenshots. Both pages are accessible from the Help menu.
  • Fixed: validators.js: four VK element IDs aligned with the vk.html DOM (getAndValidateVkUsername, getAndValidateVkUserId, getAndValidateVkTag, getAndValidateVkSmat); the affected buttons read from non-existent inputs and silently failed. (Shipped between 3.1.1 and 3.1.5 without its own changelog entry; folded into this release.)
  • Improved: Redactor: the plain 11-digit VAT_IT pattern now validates the office-code block (001–121), sharply reducing false positives on generic 11-digit numbers. (Folded into this release.)
  • Improved: Redactor: text restore rewritten to use a single combined regex, removing the risk of partial placeholder substitution; the Redaction Map table is grouped by type with per-type counts. (Folded into this release.)
  • Fixed: Redactor: Import Map now initialises counters for types never seen in the current session, preventing placeholder collisions after an import. (Folded into this release.)
  • Chore: line endings normalised across 33 files via .gitattributes and git renormalize. (Folded into this release.)

3.1.1 — 2026

  • Fixed: main.js: validator functions extracted from ExploratoresValidators were called without context, losing this. Affected buttons: GHunt (email), Tumblr username, SMAT/VK username, NetworksDB range — all silently failed on click. Fixed by calling validators with .call(ExploratoresValidators, ...).
  • Fixed: indicator-classifier.js: COORDINATES regex had a missing decimal point in the longitude group ((?:\d+)? instead of (?:\.\d+)?). Decimal coordinates such as 40.7128, -74.0060 were never classified as COORDINATES and produced no results in Janua.
  • Fixed: search-library.js (phoneint-dt-base): URL template contained {placeholder}, which is not a key returned by getAndValidateIntlPhone; the button opened a broken URL. Replaced with {e164}.
  • Fixed: janua-search-map.js: six entries introduced in 3.1.0 (YachtlyCrew, Hitta, Eniro, Mr Koll, Ratsit, Merinfo) were present in search-library.js but missing from janua-search-map.js; they never appeared in Janua dispatch results. Entries added.
  • Fixed: editorconfig renamed to .editorconfig; without the leading dot, editors and IDEs never loaded the file and the declared rules (LF line endings, UTF-8, 2-space indent) were never applied.
  • Fixed: Empty artefact files 20 and p.type introduced accidentally in a prior commit removed from the repository root.

3.1.0 — 2026

  • New: Redactor: PII removal tool for text and CSV files before submission to AI models. Detects Email addresses, Codice Fiscale (IT), VAT/fiscal codes for 30+ countries, payment card numbers (AMEX CM11/CM13/CM15, Visa 13/16-digit, Mastercard Classic 51–55/New 2221–2720, Discover 6011/644–649/65xx — all compact and spaced), IBAN bank account numbers (compact and spaced), Italian mobile phone numbers (prefixes 32x–39x, with optional +39/0039 country code, compact and grouped), PCN codes (17+ digits), and SE10 merchant codes; replaces them with numbered placeholders ([TYPE_N]). Includes Copy/Import Map for cross-session persistence, Custom Patterns (user-defined regex with localStorage), large-input warning (>20,000 lines), and a Restore function. All processing is local; no data transmitted. Added to the Tools menu.
  • New: IBAN Tool: added offline bank name resolution for 8 new countries: Albania (AL), Croatia (HR), Cyprus (CY), Greece (GR), Malta (MT), Montenegro (ME), Slovenia (SI), Turkey (TR). Coverage table updated accordingly.
  • Improved: IBAN bank databases: all 8 new country databases replaced with data sourced from official registers: Slovenia from Banka Slovenije (bsi.si); Croatia from HNB VBDI register; Montenegro from Erste Bank Montenegro IBAN calculator; Turkey from AFAD official donation IBANs; Greece from Hellenic Bank Association HEBIC index and bank websites; Cyprus from Central Bank of Cyprus IBAN register; Albania (1 entry confirmed from Raiffeisen Bank Albania). Coverage table updated with accurate entry counts and quality ratings.
  • Improved: Guidelines: "Criminal Intelligence: Manual for Analysts" (UNODC, Atkin 2011) added to Further Reading; books reordered from introductory to specific; likelihood table styled correctly.
  • Fixed: main.js: getAttribute('data-query-override') returned null (not undefined) when attribute absent, causing all single-input validators to fail at click time. Affected: Search Engines, Email, Usernames, Vehicles. Fixed with hasAttribute guard.
  • Fixed: Communities Tool: button selectors used :nth-of-type with class, which does not match by class in CSS — buttons never received text-active state. Fixed with adjacent-sibling selectors (+).
  • Fixed: X (Twitter) Tools: same :first-of-type/:last-of-type selector issue in the Web Archives section. Fixed with adjacent-sibling selectors.
  • New: Names Tool: Sweden added to National Registers with five sources: Hitta.se, Eniro, Mr Koll, Ratsit, and Merinfo. Each uses the verified search URL pattern for that service.
  • New: Names Tool: YachtlyCrew added to General & Social Presence for searching yacht crew by name.
  • Fixed: Names Tool: five buttons were incorrectly active without input due to no_input: true (Google Maps, Interpol Red Notices, OFAC Sanctions Search, Canada411, Search Systems). Flag removed; buttons now require name input.
  • Fixed: Names Tool: Google Maps URL template contained the literal string FULL_NAME_ENC instead of the {fullname} placeholder; search never worked. Corrected.
  • Improved: Names Tool: Canada411 URL updated to embed first and last name in the search query parameters instead of linking to the generic address page.

3.0 — 2026

  • New: Navigation: dedicated Help menu (Guidelines, FAQ, Customise, Version History); Tools now contains CyberChef only.
  • Improved: CyberChef updated to v10.22.1.
  • New: IBAN Checker: Bing, Yandex, and Baidu search buttons added.
  • New: Phone International: dial code normalisation: 0039 / +39 / spaces all converted to E.164 automatically.
  • Improved: IBAN page: external OSINT search merged into IBAN Checker section; auto-verify on input (no button needed); inline validation feedback on same line as input.
  • Improved: Phone International: libphonenumber-js updated to latest; Truecaller URL now uses lowercase ISO code.
  • Improved: validators.js: getAndValidateIban function added; getAndValidateIntlPhone enhanced with normalisation and conditional guards.
  • Improved: search-library.js: IBAN Bing/Yandex/Baidu entries added; Truecaller template corrected to {country_iso_lower}.
  • Fixed: IBAN search buttons never worked (validator function was missing).
  • Fixed: Phone buttons always enabled regardless of input validity.
  • Fixed: Phone intel display was always empty (validationResult.data was passed incorrectly).
  • Fixed: Truecaller generated uppercase ISO in URL (e.g. /IT/ instead of /it/).
  • Fixed: US Phone: updatePageState did not unwrap the validator result object; buttons were never disabled and phone intel always showed an error.
  • Improved: IBAN page: replaced IBAN.com with IBAN Calculator; removed broken SWIFT Search; buttons centred on page.
  • Improved: OSINT language review: standardised register across all pages: replaced "Insert" with "Enter", removed "Please" softeners, fixed informal abbreviations (FB→Facebook, IG→Instagram), corrected "For proper function" phrasing, translated Italian headings in Search Engines, updated page titles for consistency, and adopted British English throughout.
  • Improved: README: removed marketing emoji from headers; fixed numbered list; tightened credits phrasing.
  • Improved: FAQ/Guidelines/Customise: tightened informal language ("side project"→"voluntary basis", "bulwark"→"safeguard", "Mindful"→"Disciplined Online Conduct"); standardised person/voice.
  • Improved: Social media pages: clarified ambiguous labels ("Outgoing"→"Outgoing Mentions"), renamed headings for precision ("Virtual Currencies"→"Cryptocurrency Analysis", "Other Reverse Image Search"→"Video Thumbnail & Image Reverse Search").
  • Fixed: Dorks page footer showed 3.0α instead of 3.0β; "VirusTotal" brand name corrected in Domains page.
  • Fixed: VK page: moved "WORK IN PROGRESS" from h1 tag to proper NOTE banner.
  • New: Phone International: Tellows reputation lookup added.
  • Fixed: Search Engines: updatePageState did not unwrap the validator result object; buttons appeared active regardless of input.
  • Fixed: Names: same validator unwrap bug; buttons were never properly disabled.
  • Improved: IBAN page: NOTE label standardised to match the pattern used across all other pages.

3.0α — 2025

  • New: Platform-specific URL parsing (VK, X/Twitter, Instagram, Telegram, Facebook, LinkedIn).
  • New: IBAN: multi-country BBAN parser for 11 countries (IT, DE, FR, ES, GB, NL, BE, PT, AT, CH, PL).
  • New: IBAN: local bank name databases for 10 countries (assets/js/bankDatabases/), resolving bank names entirely offline.
  • New: IBAN: Local Database Coverage note with per-country bank count, coverage status, and update date.
  • New: Toolkit Search: two-column scrollable layout (Function / Page) with sticky header and live result counter.
  • New: Guidelines page added to the Tools menu and to launchme.html.
  • Improved: validators.js: full refactor with consistent return structure and broader coverage.
  • Improved: search-library.js: added IBAN search entries (Google, SWIFT, iban.com) and VK profile info.
  • Improved: Navigation menu: CyberChef moved to first position; FAQ before Customise; Version History link added to How to Start.
  • Improved: Navigation menu: fixed case-sensitive links for guidelines.html and publiccompanyrecords.html.
  • Improved: All HTML files renamed to lowercase to enforce naming convention.
  • Improved: FAQ: restructured into 7 logical sections with nested Table of Contents; new entry on updating IBAN bank databases.
  • Fixed: Broken links across all pages resolved.
  • Fixed: Missing CSS imports corrected.
  • Fixed: Corrupted character in guidelines.html ("When" section).
  • Fixed: Stale reference to gemini.md removed from customise.html.

2.6 — 2025

  • Fixed: Broken links across all pages.
  • Fixed: Missing CSS assets corrected.
  • Improved: Version string consistency enforced across all 30+ pages.
  • Improved: Documentation pages (faq.md, customise.md) updated.
  • Improved: assets/css/style.css: minor layout fixes.
  • Improved: assets/menu/navigation.js: link corrections.

2.5 — 2025

  • New: Centralised architecture introduced: main.js, validators.js, search-library.js replace all inline onclick logic.
  • New: search-library.js as centralised catalogue of all search configurations (URL templates + validators).
  • New: validators.js as shared validation library used across all pages.
  • New: config.js: Light Version support: hide/show UI elements per-user via configuration.
  • New: Pages: VK, IBAN (refactored), Search Engines (updated).
  • Improved: Navigation bar via navigation.js: single definition, path-aware links.
  • Improved: IBAN page: centralised search logic, cleaner layout.
  • Improved: launchme.html: search function added.
  • Improved: Separation of concerns enforced: no inline styles or scripts in HTML.

1.0 — Initial Release

  • New: Initial release of the Exploratores OSINT Toolkit.
  • New: Core pages: Names, Email, IP, Domains, Maps, Addresses, Images, Videos, Documents, Vehicles, Usernames, Phone (US & International), Social Media (Facebook, Instagram, X, LinkedIn, VK, Keybase), Virtual Currencies, Company Public Records, IBAN, CyberChef integration.
  • New: Navigation menu via navigation.js.
  • New: Guidelines, FAQ, License, Customise documentation pages.