Orb44 public tools

Pick a check. Enter a domain you own or are authorized to test. We never modify your server.

Links

• Blocklist — Storefront, server IP, and role-mailbox breach exposure.
• Shield — CDN in DNS and whether traffic bypasses Cloudflare / Qrator.
• CDN catalog — Homepage scripts vs known compromised CDN hosts.
• Webhook URLs — Callback URLs and secrets in public JS (same-host probes only).
• AI keys — OpenAI / Anthropic / Google Generative AI patterns in public JS.
• n8n / Flowise editor — Does the automation editor answer without a password? GET only, never execute.
• MCP tools/list — Does tools/list answer without auth? Names only — not a prompt-injection scanner.
• PHP2Shell — Is your PHP still unpatched for PHP2Shell (CVE-2026-109618 / CVE-2026-109619)? Homepage headers only. No exploit.