OTInstaller
Sign in

pulsedive

v0.1.0Verified publisher
Report a problem

Looks up an IP, domain or URL in Pulsedive: risk level and factors, linked threats and feeds, ports, technologies

Run

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/pulsedive"}

Or just say: "Run osintverse-community/pulsedive on … with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/pulsedive --format table
ot install osintverse-community/pulsedive

Docker image in a read-only container · talks to pulsedive.com · no key · up to 1 min. The first ot run installs the tool after asking once. Drop --format table for JSON.

Don't have ot? Install it in one line
curl -fsSL https://get.otinstaller.com/ot | sh
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.
irm https://get.otinstaller.com/ot.ps1 | iex
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →
  • Pinnedimage sha256:2a762606…c420f3. The same bytes on every install; ot pulls by digest, never by tag.
  • Signedby https://github.com/osintverse-community/pulsedive/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 24 Oct 2026. ot checks the same identity before every install and refuses another signer.
  • Scanned24 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 89 packages.
  • Workssmoke test passed on 24 Oct 2026 (exit 0 in 5.4 s, offline sandbox); the nightly health check has not run yet.
  • Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
  • Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

From the community

Issues →

Not health-checked yet; 0.1.0 came out today; nobody has said yet whether it works.

0.1.0 is in its first week. Nobody has said whether it works yet.

Used 0.1.0?It's broken for me

What you get back

Result envelope →
{
  "envelope": 1,
  "tool": "osintverse-community/pulsedive@0.1.0",
  "runtime": "docker",
  "input": {
    "ip": "8.8.8.8"
  },
  "started_at": "2026-10-24T19:28:36Z",
  "exit_code": 0,
  "entities": [
    {
      "type": "ip",
      "value": "8.8.8.8"
    },
    {
      "type": "other",
      "value": "CryptoMining",
      "source": "pulsedive",
      "confidence": "medium",
      "attrs": {
        "kind": "Pulsedive threat",
        "category": "general",
        "risk": "low",
        "linked": "2020-10-15 13:23:37",
        "link": "https://pulsedive.com/threat/?tid=431"
      }
    },
    {
      "type": "other",
      "value": "JS Crypto Miner",
      "source": "pulsedive",
      "confidence": "medium",
      "attrs": {
        "kind": "Pulsedive threat",
        "category": "general",
        "risk": "unknown",
        "linked": "2018-07-16 07:16:42",
        "link": "https://pulsedive.com/threat/?tid=108"
      }
    },
    {
      "type": "other",
      "value": "Monero",
      "source": "pulsedive",
      "confidence": "medium",
      "attrs": {
        "kind": "Pulsedive threat",
        "category": "abuse",
        "risk": "unknown",
        "linked": "2018-05-02 06:48:24",
        "link": "https://pulsedive.com/threat/?tid=109"
      }
    },
    {
      "type": "other",
      "value": "Phishing",
      "source": "pulsedive",
      "confidence": "medium",
      "attrs": {
        "kind": "Pulsedive threat",
        "category": "general",
        "risk": "high",
        "linked": "2018-02-20 03:51:59",
        "link": "https://pulsedive.com/threat/?tid=67"
      }
    }
    … 7 more
  ],
  "warnings": []
}

Recorded from the registry's own run of version 0.1.0 on its test input, 24 Oct 2026. --format table to read it; ot extract and ot auto to continue.

pulsedive

Looks up an IP address, domain or URL in Pulsedive, a community threat intelligence platform that gathers indicators from public threat feeds and its own scans. It gives Pulsedive's risk level (none to critical) and the risk factors behind it, the threats (malware families, campaigns, adversaries) and feeds that list the indicator, and what Pulsedive's past scans saw: open ports, protocols, technologies, page title, DNS records, redirects, network owner and location. Only Pulsedive's existing record is read: nothing is submitted for a new scan, so the target is not contacted.

ot run osintverse-community/pulsedive --domain example.com

Inputs

Give exactly one.

Input Required
ip one of these IP address
domain one of these Domain
url one of these URL

Keys

None needed: lookups without a key work at a low limit (about 10 a day from one address). PULSEDIVE_API_KEY (ot keys set PULSEDIVE_API_KEY), from a free Pulsedive account, raises it, and paid plans raise it further: https://pulsedive.com/account. When the limit is reached the tool exits with code 1 and says so.

Notes

An indicator Pulsedive has never seen gives no entities and a note on stderr; the tool doesn't submit it, since a new scan would contact the target. The scan data can be old: last_scanned says when Pulsedive last probed the indicator. Comments people left on Pulsedive and its WHOIS contact details are left out.

Next steps

Read the threat's other indicators on its Pulsedive page (the link of each threat), or check the indicator in osintverse-community/otx-indicators and osintverse-community/urlhaus.

Development

python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

What next

pulsedive finds ip, domain, url, other, organization, location. Tools that take those:

ip → 10 toolsdomain → 10 toolsurl → 10 toolsorganization → 6 toolsot auto, with a saved result

Other ip address tools

All ip address tools →

Alternatives to pulsedive that also take an ip address; ot auto runs every installed one on the same value.

osintverse-community/ipwhois

Looks up who holds an IP address through RDAP: network, ASN, organisation and contacts

Takes ip address → finds organization, other
No key · Docker
Worked todayVerified publisher

osintverse-community/naabu

Lists an IP's open ports passively from Shodan InternetDB, without scanning it

Takes ip address → finds other
No key · Docker
Worked todayVerified publisher

osintverse-community/shodan-host

Shows what Shodan has seen on an IP: open ports, services, banners, vulnerabilities, location

Takes ip address → finds location, organization, other
Key required · Docker
Worked todayVerified publisher

osintverse-community/greynoise

Looks up an IP address in GreyNoise to see whether it is internet background noise or a known benign service

Takes ip address → finds ip, organization, other
Key required · Python wheel
Worked todayVerified publisher

osintverse-community/dnsanity

Checks whether DNS resolvers answer correctly by comparing them with trusted resolvers on a test template

Takes ip address → finds ip
No key · Docker
Worked todayVerified publisher
Esc

Try

↑ ↓ to move↵ to open