# OBSCURIQ

> Organize public-source research: cases, a research log, pivots and indicators. OBSCURIQ is a local-first desk for open-source research. Keep separate cases with a timestamped research log of sources, indicators, notes, opened pivots and inspected files; review and date every entry, filter the log and follow the case on a timeline. Open web searches, Internet Archive, ICANN Lookup and blockchain explorer pivots only when you choose, run usefulweb.site lookups on domains, URLs and transactions, extract and defang indicators, inspect files locally and export a case report. Nothing is collected automatically.

OBSCURIQ (OSINT case desk) is a premium app of usefulweb.site (https://usefulweb.site/): a full program that runs in the browser. Its engine is deterministic and the same functions are exposed as tools, so an agent can compute exactly what the app shows.

## Use it
- Landing page: https://obscuriq.usefulweb.site/
- Workspace (browser app): https://obscuriq.usefulweb.site/app - open a project with https://obscuriq.usefulweb.site/app#project=<base64url-encoded project JSON> or a template with https://obscuriq.usefulweb.site/app#template=<id>
- Project file format (JSON Schema): https://obscuriq.usefulweb.site/project.schema.json
- Tutorials: https://obscuriq.usefulweb.site/tutorials
- JSON API: POST https://obscuriq.usefulweb.site/api/v1/tools/<toolId>/calculate (catalog: https://obscuriq.usefulweb.site/api/v1/tools)
- OpenAPI: https://obscuriq.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://obscuriq.usefulweb.site/mcp

## Engine tools
- [OSINT Indicator Extractor](https://obscuriqindicatorextractor.usefulweb.site/): Find URLs, domains, IPs, e-mails, hashes and crypto identifiers in pasted text. API: POST https://obscuriq.usefulweb.site/api/v1/tools/obscuriq-indicator-extractor/calculate · MCP tool `obscuriq_indicator_extractor`
- [IOC Defang and Refang](https://obscuriqiocconverter.usefulweb.site/): Make common indicators less clickable or restore them for analysis. API: POST https://obscuriq.usefulweb.site/api/v1/tools/obscuriq-ioc-converter/calculate · MCP tool `obscuriq_ioc_converter`
- [OSINT URL Tracking Cleaner](https://obscuriqurlcleaner.usefulweb.site/): Remove common campaign tracking parameters while retaining the original link. API: POST https://obscuriq.usefulweb.site/api/v1/tools/obscuriq-url-cleaner/calculate · MCP tool `obscuriq_url_cleaner`
- [OSINT Search Query Builder](https://obscuriqsearchquerybuilder.usefulweb.site/): Prepare focused public-web searches without submitting them. API: POST https://obscuriq.usefulweb.site/api/v1/tools/obscuriq-search-query-builder/calculate · MCP tool `obscuriq_search_query_builder`
- [Domain History Graph](https://domainhistorygraph.usefulweb.site/): Registration, DNS, hosting networks, certificates and Wayback captures of a domain as a timeline. API: POST https://obscuriq.usefulweb.site/api/v1/tools/domain-history-graph/calculate · MCP tool `domain_history_graph`
- [DNS + Certificate Explorer](https://dnscertificateexplorer.usefulweb.site/): DNS records, e-mail security, CAA, live TLS certificate and CT history for a domain. API: POST https://obscuriq.usefulweb.site/api/v1/tools/dns-certificate-explorer/calculate · MCP tool `dns_certificate_explorer`
- [Certificate Transparency Explorer](https://certificatetransparencyexplorer.usefulweb.site/): Every logged certificate for a domain: history, issuers, subdomains, wildcards and expiry. API: POST https://obscuriq.usefulweb.site/api/v1/tools/certificate-transparency-explorer/calculate · MCP tool `certificate_transparency_explorer`
- [Internet Archive Change Explorer](https://internetarchivechangeexplorer.usefulweb.site/): See how a web page changed in the Wayback Machine: capture timeline plus the changes that matter. API: POST https://obscuriq.usefulweb.site/api/v1/tools/internet-archive-change-explorer/calculate · MCP tool `internet_archive_change_explorer`
- [Transaction Decoder](https://transactiondecoder.usefulweb.site/): See what an EVM transaction actually did: call, events, token transfers, fee, finality. API: POST https://obscuriq.usefulweb.site/api/v1/tools/transaction-decoder/calculate · MCP tool `transaction_decoder`
- [Scam Signal Checker](https://scamsignalchecker.usefulweb.site/): Check a message or link for common scam and phishing warning signs — without clicking. API: POST https://obscuriq.usefulweb.site/api/v1/tools/scam-signal-checker/calculate · MCP tool `scam_signal_checker`
- [Unicode Inspector](https://unicodeinspector.usefulweb.site/): Every code point with name, script and bytes, plus hidden characters and look-alikes. API: POST https://obscuriq.usefulweb.site/api/v1/tools/unicode-inspector/calculate · MCP tool `unicode_inspector`
- [EXIF Inspector & Cleaner](https://exifinspectorcleaner.usefulweb.site/): See all photo metadata (EXIF, GPS, XMP, IPTC, MakerNotes) and download a cleaned copy. API: POST https://obscuriq.usefulweb.site/api/v1/tools/exif-inspector-cleaner/calculate · MCP tool `exif_inspector_cleaner`
- [Hash & HMAC Calculator](https://hashhmaccalculator.usefulweb.site/): MD5, SHA-2, SHA-3, BLAKE2, CRC32 and HMAC of text or files, with checksum compare. API: POST https://obscuriq.usefulweb.site/api/v1/tools/hash-hmac-calculator/calculate · MCP tool `hash_hmac_calculator`

## Formats
- Import: OBSCURIQ workspace (.obscuriq.json, versions 1 and 2), Workspace link (#project=…), Text and CSV with indicators (paste, file or App Bridge), Any local file for hashing; PNG, GIF and JPEG headers, Images from other apps (App Bridge)
- Export: OBSCURIQ workspace (.obscuriq.json), Case report (print/PDF, plain text, Markdown), Research log (CSV), Defanged indicator list (text)

## Limits
- No automated collection: OBSCURIQ does not crawl sites, monitor accounts, scrape social networks or retrieve records in the background.
- Lookups depend on public sources (RDAP, DNS, certificate transparency, Wayback Machine, public Ethereum nodes) that can be slow, rate-limited or incomplete; only Ethereum mainnet transactions can be decoded.
- Bitcoin addresses are checksum-checked; Ethereum addresses and all transaction hashes are format checks only. No check proves that an identifier exists or who controls it.
- Indicator extraction covers ASCII URLs, domains, e-mail addresses, IPv4, MD5/SHA-1/SHA-256 hashes and Bitcoin/Ethereum identifiers; IPv6, Unicode domains and unusual e-mail forms are not recognized.
- The local file inspector reads PNG, GIF and JPEG headers and selected JPEG EXIF fields and only reports whether a GPS tag exists; other formats are hashed only. Full metadata (including GPS coordinates) and MD5 need the optional server checks, which upload the file.
- Browser storage can be cleared, and workspace files and share links are not encrypted. Keep backups and handle sensitive research appropriately.