HOMEIPCARD SMSPROXY STEGOTRACK MAIL-FORENSICSIMG-FORENSICS PHONEUSER-SLEUTH DOMAIN CANARYDEAD-DROPBURNER-MAIL SHOTFRAUD-SCORE INBOXPASSPORT PASSKEYSMAG-LABDMSHASH-CHAINGHOST-TEXTCHAFFLEAK-TRACERTRACEOUTTRAP-CHAINTOOLS

Intel

◈ IP INTEL geo, ASN, ISP, VPN flags — any target ◈ CARD CHECK luhn + BIN issuer intelligence ◈ MAG-LAB browser magstripe studio — ISO 7811 encode, read, batch issue (closed-loop only) ◈ MAIL FORENSICS true origin, relay delays, spoof flags, .eml import ◈ IMAGE FORENSICS EXIF, GPS, ELA, edit detection ◈ PHONE LOOKUP carrier, line type, region, timezone — any number ◈ USERNAME SLEUTH find one handle across 12+ platforms ◈ DOMAIN RECON RDAP whois, DNS, nameservers, subdomains

Operate

◈ SMS RENTAL 30-min numbers, refundable ◈ PROXY LAB residential egress, geo builder ◈ STEGO LAB hide words in pictures ◈ BURNER MAIL receive-only mailboxes, countdown

Hunt

◈ TRACK FILE opens report back: IP, city, ISP ◈ CANARY TRAPS links, pixels & honeytokens — instant alerts ◈ DEAD-DROP burn-after-read encrypted notes ◈ SCREENSHOT page capture or rendered-text fallback ◈ FRAUD-SCORE composite IP + email + BIN risk 0-100 ◈ FREE TOOLS DNS, headers, JWT, hasher ◈ PHONE LOOKUP osint: carrier + line type + region ◈ USERNAME SLEUTH osint: handle across platforms ◈ DOMAIN RECON osint: RDAP + DNS + subdomains ◈ DMS dead man switch: silence releases pre-written payload dead-drops ◈ HASH-CHAIN Tamper-evident chain-of-custody logs — edits break the chain at the exact link ◈ GHOST-TEXT hide secret messages in invisible characters inside innocent text ◈ CHAFF deterministic throwaway personas — same seed, same identity, zero storage ◈ LEAK-TRACER per-recipient invisible watermarks — leaks name the leaker ◈ TRACEOUT network traceroute with per-hop geo ◈ TRAP-CHAIN breadcrumb tripwires — each fired trap feeds them the next, maps their path

Account

◈ INBOX no-KYC messaging ◈ SIGN UP username + password, 10 seconds, no KYC ◈ API KEYS account, balance, metered keys ◈ PASS everything's free now — no pass needed ◈ AGENT PASSPORT machine-readable badge

MAIL FORENSICS

Paste raw email headers — or drop the whole .eml file — and get the true origin IP + location, the full relay chain with per-hop delays, SPF/DKIM/DMARC verdicts, and automatic spoof detection.

Analyze an email
📄 drop a .eml file here or click
API: POST /api/eh (raw=…) → JSON: origin IP + geo + source, hop chain, per-hop delays, verdicts, spoof flags. Free.
EXAMPLE FLOW — was this 'bank email' really sent by the bank?
  1. you get a scary email from [email protected] — open it, ⋮ → Show original, copy everything.
  2. you paste the headers here (or drop the .eml) and hit Analyze.
  3. site walks the Received chain bottom-up: the oldest hop is where the mail actually entered the internet.
  4. origin IP found: 185.234.72.19 — a bulletproof host in Sofia, Bulgaria · datacenter ⚠ — not your bank's infrastructure.
  5. verdicts come back: SPF fail · DKIM none · DMARC fail — three red tags.
  6. spoof flags light up: envelope-from ≠ From domain — the display name is wearing a costume.
  7. relay delays show the 4-second stall at a server that has no business handling bank mail.
  8. you verdict: phishing. Delete, report, done — and you have the origin evidence to show for it.
HOW IT WORKS
  1. An email's headers are its postal history — every server that touched it adds a Received line, and liars can't forge the chain reliably.
  2. We read the chain from the bottom (oldest) up: that first hop is the true origin, and we geolocate its IP.
  3. SPF/DKIM/DMARC are the domain's own authentication verdicts — fails here mean the mail didn't come from where it claims.
  4. Spoof markers are checked automatically: envelope sender vs display From, Reply-To hijacks, mismatched domains.
  5. Per-hop relay delays expose weird pit stops — legit bank mail doesn't detour through random countries.
  6. Everything works from pasted headers OR a dropped .eml file — the parser handles both.
JARGON — hover any chip:
Received chain SPF DKIM DMARC envelope-from .eml
FOR AGENTS ?
POST /api/eh raw=<full headers>
curl -X POST https://dark0rbits.thetempleofdoom.com/api/eh --data-urlencode [email protected]Returns origin_ip, origin_geo, hops, delays, verdicts, flags. No auth needed for 20/min. · spec: /openapi.json · catalog: /llms.txt
✦ REACH THE DEV
⚙