• slidebg1
    The Internet is a big place CyberTOOLBELT® makes sense of it.
    The complete set of Internet tools trusted by corporate investigators, law enforcement, and legal professionals.
  • slidebg1
    You make critical decisions.
    Find the information and connections that matter most — in half the time
  • slide3
    Complete tools and data, all in one place.
    Awareness, analysis, and resolution are just a few clicks away

Terabytes of Data

We provide intelligence from open and closed sources, including threat and cybercrime indicators


Our easy-to-use web interface allows you to research, assemble dossiers, and compile reports


Save time by automating fraud analysis and threat detection with the help of our API


Make better decisions and reap big savings. Change your plan and its users at any time

Features & Benefits

Our patented technology helps you find the information you need, so that you can act quickly and confidently. Use CyberTOOLBELT for cybercrime and digital investigations, fraud prevention, legal research and due diligence, brand protection, and more.

CyberTOOLBELT puts billions of data points at your fingertips. Our web-based interface provides 40+ tools that make the data easy to search and understand. Customers can use our API to perform automated analysis and feed big data applications for their own backends.

Internet Infrastructure

Uncover what’s where on the Internet and who’s responsible for it.

  • DNS and Hosting: Discover what domains are assigned to which IP addresses and vice-versa. Search IP owner records, find mail servers, discover subdomains and more.

  • Geolocate Internet assets

  • Perform bulk lookups

"CyberTOOLBELT is a practical, economical resource that saves me valuable time when conducting cyber investigations. This one-stop platform eliminates the need for stand-alone site searches and has become my go-to tool to identify fraudulent IP addresses and to handle online tracing and Internet investigations. The Tell Me When tool is a great instrument for monitoring parked content pages with the added bonus of receiving an alert whenever new content hits the domain. Another noteworthy offering is the Verify Email Address tool, which verifies an email address to determine if the user exists at that email provider. The CyberTOOLBELT platform has given cyber intelligence investigators an opportunity to work quickly through sensitive case matters and, when necessary, customer service comes through every time."

"CyberTOOLBELT is a cost-effective tool and reduces the time I spend searching for OSINT compared to stand-alone sites that compile the information separately. It's a one-stop platform for handling aspects of investigations. CyberTOOLBELT has removed the tedious searching, and I'm confident in the results. With these tools there is less 'shifting sand' and more 'Yes, I can do this for you!"

Kim Miller, PHD, CFE Director of Investigative Intelligence and Analysis at a New Jersey law firm and is a New Jersey Licensed Private Detective

Items Related To Domains


RDS Record Updates





About Us

CyberTOOLBELT provides critical information to protect people, operations, intellectual and physical property. Our extensive experience investigating and unmasking technology-based threats enables us to provide our clients with tools, actionable intelligence and effective threat mitigation strategies. Our clients include Fortune 500 companies and law enforcement agencies.

Our team consists of professionals with deep backgrounds in internet investigations, threat response, information security, and investigative forensics.

Our Prices

The following details our current pricing. We also offer enterprise licensing starting at a minimum of 5 seats. The enterprise subscription level has all the Platinum Level features and the following: ICG Hacking Alerts, Internal messaging (you can share results), Collaboration tools, Cross Memory Indicators, Creation of sub-groups of users, Pooling of quota limits (think friends and family mobile plans). In addition, your enterprise gets 5 additional domain monitors.

Silver Level

Gold Level

Platinum Level

Pay Monthly3 $ 49.95 $ 99.95 $ 149.95
Monthly Query Limit1 2,500 6,000 20,000
Keyword Monitors 7 18 30
Domain Monitors2 0 1 2
Dossiers 2 10 Unlimited
Web Page Change Trackers2 3 10 20
Social Media Handle Monitors 10 20 30
Domain Transmogrify Monitors2 0 1 2

1 Additional blocks of query credits are available for purchase.
2 Additional monitors are available for purchase.
3 Buy yearly subscription — 12 months for the price of 10! (two months free)

Interested in a RESTful API subscription?

Contact Us

Please answer the question below so that we can be reasonably sure you're not a mechanical device.


Interested in API access or purchasing an enterprise-level subscription? You can schedule a meeting/demonstration with CyberTOOLBELT sales by supplying us with a date and time for the meeting in your message.


CyberTOOLBELT makes much of its data available through a RESTful API. Access to the API is through subscription and is fee based. Data access is from 1000 queries a day to having an on-premise copy of the data set updated in near-real time. There are a number of toolsets (listed in the left-hand column in the table below). Each toolset requires an individual subscription (bundles are available).

Toolset Description
Domain Record Data Provides information about the RDS for domains. We store time and date stamped changes. We have access to abuse data about the domains involved.
IP Owner Records Provides access to the CTB Historic IP Owner Dataset. This includes all changes to the records in our database as well as the most recent record we have.
RDS Domain Records Data Mining Provides ability to mine the RDS Dataset using powerful full-text queries. Example query: "state=md since last august and email contains mlewis"
IP Operations Tools that return IP address related information. This includes information such as geolocation, domains related to the IP address, etc.
Domain Operations Tools that return domain-related information. You can search for substrings within domain names, related DNS records, related email addresses, etc. There are a number of subdomain oriented calls in this toolset.
Domain Issues Returns "badness" issues related to a domain (ie: involved in phishing, root compromised, etc.) or to a particular IP address.
IP Issues Returns "badness" issues related to an IP adddress (ie: involved in phishing, root compromised, etc.)
IP Record Data Mining Provides the ability to mine our IP owner data set using powerful full-text search queries
New Domain Notification NEW! This toolset can either notify you on a minute by minute basis of new domains that CTB has discovered or allow you to pull the new domains within a certain trailing time period. We discover on average 150,000 domains per day.

Complete documentation for the API is available at https://www.cybertoolbelt.com/documentation/ctb-restful-api-version4.pdf. The migration guide for updating from version 3.x to version 4.0 API is available at https://www.cybertoolbelt.com/ctb-migration-guide-v3-v4.pdf. Pricing is available from CyberTOOLBELT sales or one of our resellers.