lookyloo

v1.43.0Verified publisher

Lists captures on CIRCL's public Lookyloo instance that loaded anything from a host name, with titles and dates

Community-packaged from github.com/Lookyloo/PyLookyloo: the registry's community pins the upstream release; the tool is its authors' work. Maintain that project? Claim this package.

Run

TerminalAgent

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/lookyloo","target":"example.com","input_type":"domain"}

Or just say: "Run osintverse-community/lookyloo on example.com with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/lookyloo d:example.com --format table

ot install osintverse-community/lookyloo

Python wheel, run in a read-only container (Docker optional with --native) · network allowed · no key · up to 2 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line

macOS / LinuxWindows

curl -fsSL https://get.otinstaller.com/ot | sh

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.

irm https://get.otinstaller.com/ot.ps1 | iex

What this script does

Downloads the latest ot release for your machine from GitHub Releases.
Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →

Pinnedwheel sha256:732973d2…9d372f from PyPI. ot re-hashes the file after download and refuses a mismatch.
Signedby pypi:GitHub:lookyloo/pylookyloo/release.yml via pypi.org, verified by the registry on 24 Oct 2026. ot checks the same identity before every install and refuses another signer.
Scanned24 Oct 2026: 0 critical, 0 high, 5 medium, 1 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 27 packages.
Workssmoke test passed on 24 Oct 2026 (exit 0 in 8.5 s, offline sandbox); the nightly health check has not run yet.
Backed upa copy of this wheel is kept by the registry. If PyPI removes it, ot downloads the copy and checks the same hash.
Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

From the community

Issues →

Not health-checked yet; 1.43.0 came out today; nobody has said yet whether it works.

1.43.0 is in its first week. Nobody has said whether it works yet.

Used 1.43.0?It's broken for me

What you get back

Result envelope →

{"meta": {"limit": 20, "offset": 0, "total": 307, "warning": "Some capture are missing, they are probably not cached. You can re-run the query with the `cached_captures_only` parameter set to `False`, but it can take a while."}, "response": [{"capture_uuid": "54915555-b6a5-4501-b16c-d05114de0acc", "hostnodes": ["2cd1316c-d0d2-47b1-87c5-895df2779664", "04422189-c0eb-4df8-ab53-1e9081495ee4"], "start_timestamp": "2026-10-22T08:27:49.252000+00:00", "title": "Example Domain"}, {"capture_uuid": "54915555-b6a5-4501-b16c-d05114de0acc", "hostnodes": ["2cd1316c-d0d2-47b1-87c5-895df2779664", "04422189-c0eb-4df8-ab53-1e9081495ee4"], "start_timestamp": "2026-10-22T08:27:49.252000+00:00", "title": "Example Domain"}, {"capture_uuid": "87bbb5ba-b9f7-4ee8-83c9-284e265f8f4a", "hostnodes": ["7c5c5ee2-2eed-4b0a-95c6-582af9a5b2b1", "1e486a73-d506-4e13-9a09-be458e6c8bf6"], "start_timestamp": "2026-10-07T09:21:28.498000+00:00", "title": "Example Domain"}, {"capture_uuid": "87bbb5ba-b9f7-4ee8-83c9-284e265f8f4a", "hostnodes": ["7c5c5ee2-2eed-4b0a-95c6-582af9a5b2b1", "1e486a73-d506-4e13-9a09-be458e6c8bf6"], "start_timestamp": "2026-10-07T09:21:28.498000+00:00", "title": "Example Domain"}, {"capture_uuid": "5fa4741d-4371-41c7-8be1-cdee8d004cd8", "hostnodes": ["9ad3af3e-8e59-4738-8296-4aa7ed829ec4", "e2b78097-b5e3-4e5c-a2ea-c97ebc4911ee"], "start_timestamp": "2026-10-05T22:13:46.921000+00:00", "title": "Example Domain"}, {"capture_uuid": "5fa4741d-4371-41c7-8be1-cdee8d004cd8", "hostnodes": ["9ad3af3e-8e59-4738-8296-4aa7ed829ec4", "e2b78097-b5e3-4e5c-a2ea-c97ebc4911ee"], "start_timestamp": "2026-10-05T22:13:46.921000+00:00", "title": "Example Domain"}, {"capture_uuid": "763b7a0c-a602-4c51-98de-20441e35e297", "hostnodes": ["e3038a59-2cbe-4234-8b69-0eac8b3128e6", "b5d61025-b777-46db-8534-78053d46cad7"], "start_timestamp": "2026-10-01T08:42:23.116000+00:00", "title": "Example Domain"}, {"capture_uuid": "763b7a0c-a602-4c51-98de-20441e35e297", "hostnodes": ["e3038a59-2cbe-4234-8b69-0eac8b3128e6", "b

The start of what version 1.43.0 printed on its test input (json), recorded by the registry on 24 Oct 2026. ot run wraps it in the result envelope.

lookyloo (community package)

This repository packages github.com/Lookyloo/PyLookyloo for the OTInstaller Registry as osintverse-community/lookyloo. The tool is the work of its authors, under the BSD-3-Clause license; this repository only holds the manifest and release workflow.

Report problems with the tool upstream, and problems with the packaging here. If you maintain the upstream project and want to publish it yourself, open an issue or run ot claim osintverse-community/lookyloo: the package is transferred to you.

It installs the upstream project's own release from PyPI, pinned by version and hash; nothing here is rebuilt.

Searches the public instance at lookyloo.circl.lu, which needs no key, for captures that loaded anything from the host name; it never asks for a new capture. Open a capture at https://lookyloo.circl.lu/tree/<capture_uuid>. When the instance is down the CLI prints a message instead of JSON and still exits 0.

ot run osintverse-community/lookyloo --domain …

Packaged version: 1.43.0.

Other domain tools

All domain tools →

Alternatives to lookyloo that also take a domain; ot auto runs every installed one on the same value.