I Pointed My Domain Search Engine at Cybercrime — Here's What It Found

I build cl0q, a domain search engine (38.5M domains scanned, free API, no tracking). Last night I got curious: what happens when you run threat-intel queries through a general domain index instead of a specialized feed?

Turns out: quite a lot. Here's what three searches returned.

1. "crypto drainer" → 13 results, including live drainer kits

Top hits included infernodrainer.xyz ("Inferno Drainer — best crypto drainer since 2022," advertising "0-day exploits, 120+ wallet support"), exogator.com ("Liquidate all cryptocurrencies and NFTs from any wallet"), purpledrainer.club, and cryptodrainerscript.net selling "multichain crypto drainer scripts."

Each result came with resolved IPs and MX records — immediate pivot points. exogator.com sits on 5.182.209.88; infernodrainer.xyz on 216.198.79.65. That's infrastructure you can feed straight into a blocklist.

2. "stealer log" → a notorious carding market, indexed

russianmarket.work showed up: "The most trusted underground marketplace. Buy CVV, Stealer Logs, RDP, dumps..." — sitting in a general web index, with its IPs (172.67.149.100) and metadata attached. Alongside it: breach-intel platforms, stealer-log search services, and a Turkish hacking forum (spyhackerz.org) dealing in RATs and fresh leaks.

3. "phishing kit" → an active scampage shop

lurez.online — "Spamming Tools, Office 365 Scampages, Bybit & Binance Scampages For Sale," complete with SMTP servers, cracking utilities, and a "complete spamming course." Plus spams.tools ("Spam Tools | Scampages | Checkers | Letters | Email Senders | SMTPs | cPanels") with its MX records exposed.

Why this matters

Threat intel usually means expensive feeds and APIs. But a huge amount of attacker infrastructure lives on the clear web, on cheap domains, behind Cloudflare — indexed like anything else. A domain-level search engine with DNS enrichment (IPs, MX, CNAMEs) turns a hunch into pivotable infrastructure in one query.

The searches are free, the API is free (30 req/min, 1,000/day), and nothing is logged. Try it: cl0q.com

---

All domains above were live in the index at time of writing. If you're a defender, the IPs and MX records are yours to use.

AI assistance was used in drafting this article.