What it is
SpiderFoot runs automated intelligence-gathering scans against a target such as a domain, IP address, email, username, or phone number, using over 200 modules that query threat feeds, DNS, breach databases, social sites, cloud buckets, and the dark web via Tor. Results land in a SQLite database, can be explored in a built-in web interface or from the command line, and exported as CSV, JSON, or GEXF. A YAML-based correlation engine flags notable findings. Penetration testers use it for target reconnaissance, while security teams run it to see what their own organisation exposes on the internet.