CyberTOOLBELT (CTB) is a comprehensive set of tools designed to make investigations regarding domains, IP addresses and other related information as cost effective, user-friendly and efficient as possible. CyberTOOLBELT has many features that are not available anywhere else at any price. Example: Can your existing tool search all domain names where the domain name contains pixel and any of the contacts are located in New York and was registered in the last week? CyberTOOLBELT can! Typically in less than a few seconds.

Something New is Here!

CyberINTEL Reports is a new "analyst-in-a-box" platform powered by CyberTOOLBELT® — Check it out.

CyberTOOLBELT is exceedingly cost effective and eliminates hours of searching the web using stand-alone tools. The results are comprehensive. CTB is more than a set of tools, it is an investigative platform supporting dossiers and data sharing.

CyberTOOLBELT is available with a ten-day free trial Bronze plan. If you like it and/or find that it saves you money and time you can easily convert to a paid subscription — which at a entry level of $11.95 per month is the best ROI on the planet. Just think, if it saves you 20 minutes a month (or 1 minute a day) it more than pays for itself!

You can also access CyberTOOLBELT data using a RESTful API at significantly higher data usage limits at a very reasonable cost (including on-premises Whois data for unlimited access). Contact sales for details.

Socialize with us

Simple Example

Sometimes, stats just speak for themselves. We figured we'd show you what $11.95 a month buys you and you can tell us if it is worth the price. We performed a domain lookup in CyberTOOLBELT for and then tried to gather the same information through Googling and visiting free tools. The search was performed by a senior in-house analyst. Here are the results:

  Using Using the Web
Task Completion Time 7 seconds 9 minutes, 25 seconds
Number of related IPs found 5 2
Number of subdomains found 20 1
Number of Whois records found 1 (plus 86 change records) 1
Number of unique email addresses found 2 2
Number of name servers found 2 2
Number of mail servers found 1 1
Number of sites used 1 8
Ability to explore connections, perform related lookups with two mouse clicks; perform full-text searches of Whois data Yes No

Could we have kept going and found more information using the web? Sure. Are there paid tools out there that can get you what we provided? Maybe some of it, but not all of it. That's because our data features subdomain information — information that others don't have and Google only sometimes catches. So why spend time using several different resources what you can get done on one screen? Give CyberTOOLBELT a try for free today and see how we can start saving you time in your investigations.

What Our Tools Do

This is a brief overview of what some of our tools do with some short video demonstrations/tutorials.

The Domain Toolbelt

CyberTOOLBELT's Domain Toolbelt section is core of what we have to offer. It contains a multitude of features that allow an investigator to quickly find and understand the information sought. Each tool has a unique lookup capability that allows for deeper investigation and drill-down capabilities. Remember that the tools described are just a fraction of what we have to offer.

Tool: Lookup Domain

Often times, an investigation starts only with a domain name and nothing more. CyberTOOLBELT makes it easy to learn a lot about the domain in a very short period of time, with current and historic information available in a single view. Enter a domain, and CyberTOOLBELT will return related email addresses, name servers, DNS records, related IP information, subdomains for the domain, registrar information, and available whois records. Consider this example screenshot:

Each menu item expands to show all the information CyberTOOLBELT has on the domain. For example, expanding the Related IP Details section shows that CyberTOOLBELT has a number of IP addresses related to it. You can also see what other domains are related to that same IP by clicking on the "xxx Domains Hosted". We also present any geo-location information that we know about as shown here:

Find something of interest? CyberTOOLBELT lets you drill down into the information even further. Text in blue has an interaction option, allowing users to take additional action. For example, if you wanted to drill down on additional information about a domain you would click/tap on the domain name and an action menu would pop up as shown here:

This is just a sample of the data and capabilities of CyberTOOLBELT. For additional information, watch the short videos below. More information and tutorials are available after you've logged in. Sign up for a free trial to get started today.

Domain Toolbelt Overview
Search for Domains
Whois Data Mining


More Than Just Cyber Data

Author: CyberTOOLBELT
Published: 09/18/2015 04:52pm
Last edited: 09/18/2015 05:48pm

We get it. We sound super techie. Our name has Cyber in it, our website is littered with technical data, and the majority of our features cater to investigating domains and IPs. It can be pretty intimidating and quick to dismiss if you're looking for investigative tools to assist your work. But don't rush to judgment about a tool by it's name. CyberTOOLBELT features a handful of tools that can assist everyone, such as reverse phone number lookup, email address verification, address lookup, and more.

Reverse Phone Number Lookup

Getting calls from unknown numbers can be annoying. Sometimes Googling the number can provide an answer, but often it does not. CyberTOOLBELT can help with this issue through the use of our CallerID tool. Simply enter the phone number and CyberTOOLBELT will attempt to tell you the name of the phone's owner along with an address and any other interesting data such as if it is a landline or mobile phone and who the carrier is.

Similarly, CyberTOOLBELT features WhitePages information. Want to know the people at an address? Simply enter the address and press enter and CyberTOOLBELT will show you all the information connected to the address from WhitePages. Want to find a phone number for a person? Put in their name and location and CyberTOOLBELT will return all the possible matches. The features don't stop there. Check out the video below for a preview of how the tools work.

Save A Webpage

Need to archive a web page and make sure that all the content is saved? CyberTOOLBELT can help. CyberTOOLBELT features the ability to take a snapshot of a webpage, saving the HTML code and the layout of the page and allowing the user to save it for download and future reference. The capture is instant. There's no need to wait in a queue, download awkward files, or save PDFs that render incorrectly. CyberTOOLBELT bundles it all for you in a single package.

URL Expander

Shortened URLs are scary because you never know where you're going to end up. It can be even hard to trust a friend or colleague to send you a safe shortened URL because  of the possibility of their account being compromised. CyberTOOLBELT can give you back a little peace of mind by examining the URL for you. Enter the URL, and we'll return the destination, a screenshot of the page, the page's title, metadata, and so much more.

Silent Twitter Profile Follower

Need to keep an eye on a Twitter profile without actually following them? Our Silent Twitter Profile Follower does exactly that. Simply put in the handles you want to monitor and CTB will record the tweets of that user for you. It will also provide an overview of the number of tweets, total followers, and total following. No need to keep a tab open and constantly update it.

Find A Profile

You're investigating a username and are trying to find all of their profiles. You have have four options:
  1. Google Searching
  2. Manually visiting each site to search
  3. URL hacking each site (or writing a script)
  4. Using CyberTOOLBELT

Simply give us the username and we'll check the largest social media sites to see if the profile exists. If it does, we'll provide you with a link to the profile. If it doesn't, we'll let you know, saving you the time and the hassle. Here's an example:

CyberTOOLBELT® Resources


Version 1.8 Released!

We released version 1.8 of CTB on January 8th, 2016. This release contains a number of speed-ups and enhancements as well as a new Person Search tool. You can find out information about a person's social media presence by their email address, telephone number, Facebook username or ID, or their Twitter handle. 2 new tools and our first cut of our dossier subsystem.

Version 1.7 Released!

We released version 1.7 of CTB on December 9th, 2015. This release contains 2 new tools and our first cut of our dossier subsystem. One of the new tools allows you to compare up to five domains at a time for common data points such as infrastructure, ownership, etc. Many enterprise level features such as intel tagging were added. As usual, a number of optimizations, speedups and new information reporting was added (IE: Proxy IPs are now flagged).

Version 1.6.2 Released!

We released version 1.6.2 of CyberTOOLBELT on November 13th, 2015. This is a maintenance release. A couple of bugs and display issues were fixed.

Version 1.6 Released!

We released version 1.6 of CTB on October 9th, 2015. This release contains 4 new tools and our first cut of reporting domain issues. One of the new tools is a Twitter conversation capture. Another maps a web site and shorws you all the links. In addition a number of optimizations, speedups and new information reporting was added (IE: Tor nodes are now flagged).

Version 1.1 of CyberINTEL Reports Released!

On October 29, 2015 we released version 1.1 of CyberINTEL Reports. This release added our new Reverse Whois report which allows you to use full-text searching as well as a search wizard to find Whois records.

A number of tweaks were made to further refine some of the existing reports.

Version 1.0 of CyberINTEL Reports Platform Released!

The new CyberINTEL platform was released (powered by CyberTOOLBELT®) on October 14th, 2015.

CyberINTEL Reports is a new "analyst-in-a-box" platform designed to allow users to get comprehensive reports at a very reasonable price. Reports can be customized with your logo and company name.

Reports Available at Launch

Email Investigator

Find all the domains registered to an email address, if the name exists at common free email providers, if the address is valid or invalid, if it matches handles on social media sites, and more.

Email Analysis

Upload an .EML or .MSG file or copy and paste an email and we will perform a complete analysis of the email: breaking down all domains, IP address and email information, checking for malicious domains and much more.

Domain Report

Need to investigate a website? This report will return an in-depth examination of the domain, its IP address, Whois information, common infrastructure, and much more. We also report issues with the domain. This report will give you a complete a picture of the domain as possible in plain English.

IP Address Report

This report will return everything we know about the IP address in question including domains hosted on it, ASN information, geo location, cross check with various blacklists, and more.

Batch Whois Lookup

Get fresh Whois on a list of as many domains as you want, fully parsed and ready for further analysis by you. Returned as a spreadsheet.

Version 1.5.1 Released!

We released version 1.5.1 on October 9th, 2015. This is a maintenance release. There were certain conditions when looking up a domain where an alert box would be displayed by the browser saying that a script had stopped responding. This would generally be caused by the coming together of a reasonably large number of subdomains with references to IP addresses with both a large number of ASN information and a large number of domains hosted on IPs. This would result in heavy browser memory usage and jQuery would choke. jQuery is a Javascript library that we use to handle cross-browser display among other things.

A number of other tweaks were made to clean up data presentation. A full list of changes will appear in the next newsletter.

Version 1.5 Released!

We released version 1.5 on September 15th, 2015 with a number of new tools, new data presentations, fixes, changes, etc. This release includes 4 new social media monitoring tools. Issue #17 of our newsletter has complete details.

Version 1.4 Released!

We released version 1.4 on August 3rd, 2015 with 2 new tools. One tool is used to examine shortened URLs and the other provides a batch HTTP lookup capability. Issue #16 of our newsletter has complete details.

Version 1.3 Released!

We released version 1.3 on July 6, 2015 with 2 new tools. The tools return either all the domains related to an MX server or all the domains that we know are hosted on a particular name server. We've added over a dozen informative/instructional videos and are adding 2-3 a week. Many changes were made to make the RESTful API easier to use and more powerful. In addition, we are now exposing IP Whois data through the API. Issue #15 of our newsletter has complete details.

Farsight Security uses CyberTOOLBELT®

Farsight security is using our Whois engine to power a number of features of their products. See their data sheet for details.

Version 1.2 Released!

We released version 1.2 May 13, 2015 with 2 new tools. The new CallerID tool allows you to lookup more in-depth information about a telephone number than the WhitePages tool introduced in the previous release. There was also a tool added to perform subdomain name searches. Issue #14 of our newsletter has complete details.

CyberTOOLBELT® Granted Trademark Status

We were granted US trademark status for the CyberTOOLBELT name.

Version 1.1 Released!

We released version 1.1 at the end of April, 2015 with 6 new tools. You can do people, business, address and telephone number searches for entities in the United States or Canada, perform IP address Whois lookups, monitor web pages for keywords, search passive DNS for searches using the Farsight Securities DNSDBtm database, and taking web page snapshots. Issue #13 of our newsletter has complete details.

Security must include domain name protection

Experts say that detecting fake websites needs to be a part of all companies' security protection. CyberTOOLBELT provides a great tool that allows you to monitor across all TLDs (new and old) for new domains related to your company. Read the full article by Warwick Ashford of here.

Customer Testimonials

CTB is a cost effective tool and reduces time spent searching the web for standalone sites that compile the information separately. It is a one-stop platform for handling certain areas of investigation. One great tool is the "Tell Me When" tool is used to monitor parked content pages and alerts when the domain has real content on the site. You can elect to take a snapshot of the page when the content is detected. This is also an option for monitoring domain keywords. CTB can automatically perform this operation when a domain has matched one of your keywords and starts hosting content. This is powerful for brand protection. Tracking web pages is easy with the "Track Web Pages Tool" which is used to monitor Web site changes, log the changes and then sends a notification email. Another interesting tool is the "Verify Email Address" tool which verifies an email address to determine if the user exists at that email provider. CTB has removed the tedious searching and created an environment where I am confident in the results. With these tools there is less "shifting sand" and more "Yes, I can do this for you!"

Kim Miller, ABD, MSCJ, CFE
Investigations Director
Subject Matter Expert
Hetherington Group

I love the tools and really appreciate the quick support when I ran into a problem.

Chris K.
Project Manager
(name and company withheld by request)


The following are up and coming webinars. Please sign up to attend.

2015 CyberTOOLBELT Product Review. January 28th, 2015 at 2pm EST. Presenters: Tom Brennan, CyberTOOLBELT. Register now!

This webinar will demonstrate the product and teach you how to use the tool. After registering, you will receive a confirmation email containing information about joining the webinar.

Click on one of the following webinars produced and recorded by CyberTOOLBELT to replay the webinar.

What you don't know can hurt you. November 12th, 2014 (44 minutes). Presenters: Dave Piscitello, VP ICANN and Tom Brennan, CTB product development.


CyberTOOLBELT maintains a "news of the day" newsletter/feed that aggregates information related to the domains, dns, security and all related items. Click here to view the Newsfeed

CTB Data Sheets

Click on one of the following links to display the corresponding CyberTOOLBELT datasheet.

Reviews of CyberTOOLBELT

Reviewed 1/8/2015

Reviewed by:
Bob Brasich

Links to the review:

Current Database Statistics

Count Data Category
353,398,472 Domains
4,108,305,949 Items related to Domains
431,860,237 Subdomains (not counting www)
113,490,363 Name Servers
80,884,828 IP addresses
234,605,447 Domains with Whois Information
41,894 Registrars and Resellers
84,405,219 Email Addresses
457,345,937 Whois Record Updates

Note that counts for all items (ie, domains, ip addresses, etc) are for unique items


2 Months FREE with Yearly Subscription!

CyberTOOLBELT's pricing is simple and you can change your plan at any time.

  • Bronze Toolbelt
  • $11.95 / month
  • 50 Daily Limit
  • 750 Monthly Limit
  • 2 Keyword Monitors
  • 2 Domain Monitors
  • 0 Web Page Keyword Monitors
  • 0 Twitter User Follows
  • 0 Social Media GeoFences
  • Sign Up!
  • Silver Toolbelt
  • $19.95 / month
  • 100 Daily Limit
  • 1500 Monthly Limit
  • 5 Keyword Monitors
  • 3 Domain Monitors
  • 1 Web Page Keyword Monitor
  • 1 Twitter User Follow
  • 1 Social Media GeoFence
  • Sign Up!
  • Gold Toolbelt
  • $49.95 / month
  • 250 Daily Limit
  • 4000 Monthly Limit
  • 10 Keyword Monitors
  • 5 Domain Monitors
  • 5 Web Page Keyword Monitors
  • 3 Twitter User Follows
  • 3 Social Media GeoFences
  • Sign Up!
  • Platinum Toolbelt
  • $99.95 / month
  • 1000 Daily Limit
  • 10000 Monthly Limit
  • 20 Keyword Monitors
  • 20 Domain Monitors
  • 20 Web Page Keyword Monitors
  • 10 Twitter User Follows
  • 10 Social Media GeoFences
  • Sign Up!

Each plan varies by the quantity of "limits" and "monitors." A "limit" is a query made using one of our tools. Each time a user does a phone number lookup, domain keyword search, email verification, whois query, etc., each count as one query. So, a bronze plan gives you 50 queries per day, or 750 over a one month period. Monitoring has a cap per plan. Keyword monitors are for watching when domains with a certain keyword are registered. Domain monitors watches for changes to a website. Web page Keyword Monitors look for changes to specific pages.

CyberTOOLBELT also features an Enterprise level, sold in groups of 5 users. Enterprise level subscriptions come with even higher limits and priority support. We also feature API access to our data which provides an even better value. Please contact us for additional information.

Interested in the features or the data but not in doing the work yourself? Please contact us and see how we can help. We have 15+ analysts on staff all skilled in internet investigations.

Free Trial

Free 10-Day Trial Bronze Plan!

CyberTOOLBELT offers you a no-risk, no-cost way to click the tires by offering a free ten-day Bronze plan. If you like using CTB during the trial period or you find it saves you time and gives you features other systems/tools don't then you can easily sign-up for a paid subscription. As you can see above, our subscription rates are almost criminally inexpensive.

Click here to signup for a free trial. Simply select Free Trial as your plan option on the signup form and you'll be good to go!

(p.s: You don't need a credit card for the trial)

Contact Us


PO Box 384
Stroudsburg, PA 18360

Interested in API access or purchasing an enterprise-level subscription? You can schedule a meeting/demonstration with CyberTOOLBELT sales by supplying us with a date and time for the meeting in your message.