Recon providers
Connect threat-intelligence and attack-surface data sources so Nebula can enrich reconnaissance with your own provider accounts.
On this page
Recon providers give Nebula external intelligence: exposed services, DNS history, reputation, breach exposure and technology fingerprints. Each uses your own account with the provider, so usage counts against your plan with them.
| Provider | What Nebula uses it for | Authentication |
|---|---|---|
| Shodan | Internet-exposed hosts and services | API key |
| Censys | Hosts and certificates | Basic (API ID and secret) |
| VirusTotal | File, URL and domain reputation | API key |
| SecurityTrails | DNS history and subdomains | API key |
| Hunter.io | Email addresses for a domain | API key |
| AbuseIPDB | IP abuse reports | API key |
| GreyNoise | Internet background noise and scanners | API key |
| urlscan.io | Page scans and screenshots | API key |
| IPinfo | IP geolocation and ownership | API key |
| BinaryEdge | Exposed services and data | API key |
| Have I Been Pwned | Breach exposure | API key |
| AlienVault OTX | Threat indicators | API key |
| WhoisXML API | WHOIS and domain data | API key |
| BuiltWith | Technology profiles | API key |
Connect a provider
- Create an API key in the provider’s dashboard. Prefer a read-only key if the provider offers one.
- In Settings, Integrations, choose the provider and paste the key. It is stored encrypted and never shown again.
If your organization keeps credentials in the vault, you can connect a provider from a vault entry instead (needs vault:use).
How requests are made
Nebula reaches each provider only through the integration proxy, at that provider’s fixed API host. The proxy allows a short list of request headers, never follows redirects, caps responses at 2 MiB and times out after 30 seconds.