# In Umbra

> Dark web meta-search engine for OSINT research. Indexes .onion hidden services on the Tor network.

In Umbra is a metadata-only search engine that indexes Tor hidden services (.onion sites). It stores titles, server technology fingerprints, uptime status, content hashes, threat intelligence classifications, and page language — but never caches or proxies actual page content. Designed for security researchers, journalists, and threat intelligence analysts.

## Core Features

- **Search**: Full-text search with advanced filters (status, CTI type, technology stack, language, date range)
- **Change Detection**: Real-time feed of status changes, title changes, and content modifications across indexed sites
- **Mirror Detection**: Groups sites with identical content using normalized SHA-256 hashing
- **Warrant Canary Tracker**: Detects and monitors PGP-signed warrant canaries, alerts on changes
- **Technology Fingerprinting**: Browse sites by server software (nginx, Apache, etc.) and tech stack
- **Language Browser**: Filter sites by detected page language (30+ languages)
- **Wayback Snapshots**: Timeline of metadata snapshots showing how sites evolve over time
- **Uptime Monitoring**: 30-day sparkline uptime history for every indexed site
- **User Submissions**: Self-service .onion submission with HMAC-signed captcha

## Search Syntax

- `status:online` or `status:offline` — filter by availability
- `cti:ransomware` or `cti:marketplace` — threat intelligence classification
- `tech:nginx` or `tech:apache` — server technology
- `lang:ru` or `lang:de` — page language
- `after:2025-01` or `before:2024-06` — date range
- Combine with free-text keywords: `ransomware status:online tech:nginx`

## Content Safety

- Ahmia CSAM blocklist enforced on all indexed data
- User abuse reporting system with admin review
- Blocklist applied at crawl time and ingestion time
- No actual content stored or proxied

## API

- Public search API at /api/search.php
- Atom/RSS feeds at /api/feed.php
- Change detection feed at /api/changes.php
- Site detail API at /api/detail.php

## Links

- Homepage: https://inumbra.com
- RSS Feed (Sites): https://inumbra.com/api/feed.php?type=sites
- RSS Feed (Pages): https://inumbra.com/api/feed.php?type=pages
