Skip to content
Deepak Gupta markRecon Atlas

Internet exposure search

Metabigor

OSINT CLI that maps IP ranges, certificate subdomains, related domains, archived URLs and CDN use from free sources, no API key needed.

PassiveScope a pentestAudit your own exposureResearch a competitor

1.9k stars · last push August 8, 2026 · v2.2.0 · MIT

GitHub repository

What it finds

Metabigor maps an organisation's infrastructure from free third-party sources. It resolves ASNs to CIDRs from a bundled offline database, pulls subdomains from crt.sh, and enriches IPs with Shodan InternetDB. It pivots to related domains via certificate logs, reverse WHOIS and shared analytics IDs. It also collects historical URLs from Wayback, Common Crawl, OTX, urlscan and GhostArchive.

  • IP ranges (CIDRs)
  • ASN ownership
  • subdomains
  • related domains
  • open ports (from InternetDB)
  • CVEs (from InternetDB)
  • CDN/WAF vendors
  • candidate origin IPs
  • archived URLs
  • code-search matches

Does it touch the target?

Reads third-party sources only. Sends no traffic to the target's systems.

Every command queries a bundled offline database or third-party services (crt.sh, Shodan InternetDB, grep.app, bgp.he.net, viewdns.info, builtwith.com, Wayback, Common Crawl, OTX, urlscan, GhostArchive). The README lists no command that connects to the target's own hosts; `net` uses "the bundled offline database" unless `--live` is passed, and `cluster` "Works offline."

API keys: The README tagline is "OSINT power without API key hassle"; VirusTotal and Intelligence X join the `url` command only when `VT_API_KEY` / `INTELX_API_KEY` are set, and `URLSCAN_API_KEY` raises urlscan's page size.

Install

Install with package
npm install -g @j3ssie/metabigor      # macOS, Linux, Windows

From the project's documentation

Install with package
brew install j3ssie/tap/metabigor     # macOS, Linux

From the project's documentation

Install with source
git clone https://github.com/j3ssie/metabigor.git
cd metabigor
make build          # binary at ./bin/metabigor

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Subdomains from certificate transparency logs, wildcards stripped
metabigor cert example.com --clean

From the project's documentation

Related domains from certificate logs and reverse WHOIS
metabigor related example.com --sources crt,whois

From the project's documentation

Archived URLs from Wayback and urlscan
metabigor url example.com --sources wayback,urlscan

From the project's documentation

Keep only IPs that are not behind a CDN/WAF
cat ips.txt | metabigor cdn --exclude

From the project's documentation

Output formats: text, flat, json, csv

Limits the project documents

  • The `github` command "Requires Chrome or Chromium - grep.app answers plain HTTP clients with a bot challenge."
  • GitHub searches "run one at a time regardless of `-c`, to respect grep.app's rate limit."
  • v3 renamed flags and commands with "no aliases - update your scripts" (for example `ipc` became `cluster`, `--json` became `-f json`).
  • Naming a credentialed URL source without its key "is an error rather than a silent skip."
  • The local IP-to-ASN and IP-to-country databases need `metabigor update` to pick up newer routing data.
  • README disclaimer: "This tool is for educational purposes only. You are responsible for your own actions."

Deepak's take

Analysis, not documentation

Use it when
Reach for it at the start of an engagement to turn an organisation name, ASN or domain into IP ranges, subdomains and related domains. No account signups are needed.
Skip it when
Skip it when you need confirmed live ports or services right now. InternetDB data is a third-party snapshot, so verify with naabu or nmap where you have permission.
What it will miss
It only sees what public sources have already recorded, so new or never-certified hosts and internal assets stay invisible.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: MIT. Metabigor is a trademark or project name of its owners; this library is not affiliated with it.