Lookyloo — The Cyber Toolchain

Lookyloo v1.43.0

Tue, 03 Nov 2026 15:33:00 GMT

Lookyloo adds Cloudflare NS-pair pivoting to find captures sharing the same suspected domain owner⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Pivot on the indexed tuple of Cloudflare NS record pairs to find other captures containing domains with the same suspected owner.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Breaking changes: • Python 3.11 or later is now required; deployments running Python 3.10 or older will not be supported. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.42.0

Mon, 05 Oct 2026 17:39:59 GMT

Lookyloo v1.42.0 adds optional video recording of web captures, viewable at Capture > Video after completion.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds optional video recording of captures (requires Lacus 1.27.0+), accessible after capture via Capture > Video; triggering video capture is admin-only on the public instance, but all users can watch recorded videos based on capture visibility.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Most tables now have a copy-to-clipboard button. • Changes the default mobile device (replacing Blackberry) used in captures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.41.1

Sat, 26 Sep 2026 20:19:42 GMT

Lookyloo v1.41.1 adds console message capture, WebAuthn/OPFS exposure, and onion-site tagging via Onion Lookup.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a kvrocks config sample at `full_index/kvrocks.conf-big_instance` for tuning large deployments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Gathers and renders browser console messages during captures. • Exposes WebAuthn entries discovered during page captures. • Exposes Origin Private File System (OPFS) entries discovered during page captures. • Integrates with Onion Lookup to automatically tag `.onion` captures and optionally push full captures to AIL. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.40.1

Tue, 28 Jul 2026 12:55:32 GMT

Lookyloo v1.40.1 adds WebSocket stream visibility, private captures with token access, and background tree-building scripts. • Adds private captures mode — captures visible only to admins or holders of a temporary token. • Adds a UI form to change the visibility of an existing capture (e.g. public → private). • Adds background scripts to build trees and index archived captures without blocking the main process. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.40.0

Fri, 19 Jun 2026 15:14:54 GMT

Lookyloo v1.40.0 adds support for Locus groups and Ollama capture summaries • Adds `lacuses` configuration section to define multiple instances in a group for load balancing • [Admin only] Adds capability to submit captures to a local Ollama instance for summary generation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.39.3

Sat, 30 May 2026 18:19:19 GMT

New AI export format for capture details and flexible date filtering in recent captures • `/api/v1/captures/recent` now accepts relative time strings like `"2 days ago"` instead of only absolute dates • Adds a new export method returning capture details formatted for AI model classification (unstable API, high token cost) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.39.0

Fri, 08 May 2026 18:02:02 GMT

Lookyloo v1.39.0 adds remote headful captures and a new API to expose Lacus instance configuration. • Adds support for `remote` mode in headless browsers by enabling 'Remote headfull captures' when the underlying Lacus instance supports it, allowing complex JavaScript-heavy sites to be rendered and captured correctly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.38.0

Fri, 27 Mar 2026 15:05:10 GMT

Lookyloo v1.38.0 adds MISP category configuration, HTML-to-MD export, and auto-monitoring • Adds `misp.categories` config key to filter capture exports when auto-push is enabled • New 'Rendered HTML page' as Markdown option in Actions > Get Forensic Acquisition > Download modal Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.37.0

Thu, 26 Feb 2026 14:19:15 GMT

Lookyloo v1.37.0 adds domain/TLD indexing, a smarter search interface, optional wait time for instrumentation, GTM identifier indexing, ION/protobuf support, and web extension cookie passing. • Adds optional wait time after the instrumentation ran (for time-based javascript code) • Index domains, suffix, and TLDs (even the weird ones) • Search interface figures out what the user is looking for (hostname, domain, suffix, or TLD), and returns the captures accordingly • Index `GTM-` identifiers • Support more types in POST requests: Amazon ION, protobuf (best effort), broken atom. • Support [web extension](https://addons.mozilla.org/en-US/firefox/addon/lookyloo/), and passing cookies. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.36.1

Thu, 22 Jan 2026 15:44:47 GMT

Adds optional auto-categorization of captures, user-configurable default Playwright browser, and category support for capture import/export • `skip.authors` and `include.labels` are not present; this release adds automatic categorization that detects non-JS content in the init script (typically form spam bots) and assigns a category. • Adds `default_browser` config setting to override the Playwright browser used for captures, defaulting to `Firefox Desktop` to better bypass bot detection. • Adds categories support for capture import and export operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.36.0

Mon, 15 Dec 2025 11:31:54 GMT

Lookyloo v1.36.0 adds public index support for kvrocks and pagination for indexes pages • Add support for kvrocks as the backend for public indexes to prevent ever-growing valkey databases on large public instances. • Add pagination for public and hidden indexes pages to enable near-instant rendering and massively speed up web server initialization. Breaking changes: • This release requires kvrocks >= 2.14; upgrading without updating your kvrocks instance will break the service. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.35.0

Mon, 17 Nov 2025 19:51:01 GMT

Lookyloo v1.35.0 adds iFrame capture with timestamping, Google Docs/Dropbox download guessing, and free-form subsequent capture URLs. • Supports iFrames captured via Lacus v1.20.0: URLs on iframes now correctly anchor nodes in the capture tree, rendered iframe content is downloadable from its tree node, and all frame contents are submitted for a Trusted Timestamp. • Guesses download/export links for Google Docs and Dropbox landing pages, enabling a one-click subsequent capture of the file and direct submission to Pandora. • Allows any arbitrary URL to be entered in the subsequent-capture modal so it is captured in the current browser context, including the session's local storage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.34.0

Fri, 17 Oct 2025 19:31:34 GMT

Lookyloo v1.34.0 adds dark mode, TSR to MISP exports, and proxy alerts • Adds dark mode support when the user requests it • Adds a new navbar to expose previously hidden endpoints • Adds TSR (Threat Reporting System) to MISP exports • Adds setting to automatically filter contacts based on a blocklist Breaking changes: • Python 3.9 is no longer supported Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.33.0

Fri, 19 Sep 2025 15:38:37 GMT

Adds RFC3161 trusted timestamps, .i2p domain capture, and custom theme files • Adds support for RFC3161 Trusted Timestamps to validate HAR, HTML, screenshot, URL, and download content hashes via a Time Stamping Authority (TSA) • Enables capturing `.i2p` domains through the Lacus instance • Adds `website/web/templates/custom_header.html`, `website/web/templates/custom_footer.html`, `website/web/static/css/overrides.css`, `website/web/static/js/overrides.js`, and `website/web/custom_csp.py` for custom theming Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.31.0

Fri, 13 Jun 2025 10:37:52 GMT

Lookyloo v1.31.0 adds several new JSON API endpoints for searching captures by various indicators and normalizes pagination support. • Adds the `GET /json/advanced_search` endpoint to return captures matching multiple parameters (IP, Hostname, URL, Hash) • Adds the `GET /json/ip_info` endpoint to return captures containing a specific IP address • Adds the `GET /json//ips` endpoint to return all IPs contained in a capture • Adds the `GET /json/favicon_info` endpoint to return captures containing a specific favicon • Adds the `GET /json//favicons` endpoint to return all favicons in a capture • Adds the `GET /json/hash_info` endpoint to return captures containing a resource with a specific hash (sha512) • Normalizes JSON API endpoints to support pagination, accept consistent parameters, and return uniform data formats Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.30.0

Thu, 22 May 2025 11:53:05 GMT

Lookyloo v1.30.0 adds `/json/remote_lacus` endpoint and Lacus v1.15.0 support • Supports Lacus v1.15.0 protocol for remote capture interactions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.29.0

Wed, 23 Apr 2025 21:17:46 GMT

Lookyloo v1.29.0 adds pre-configured proxy support in the Lacus module. • Adds a proxy selector UI in the Lacus module to use pre-configured proxies (e.g., SOCKS5, Tor, Wireguard) for request routing. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.28.1

Wed, 09 Apr 2025 15:23:54 GMT

Lookyloo v1.28.1 adds storage state handling, multi-Lacus support, file modal, Mastodon bot and remote capture sync. • Adds the ability to get, store, display and submit storage state for captures • Introduces a modal to display downloaded files and submit them to Pandora if possible • Adds support for multiple remote Lacus instances to offer multiple uplinks and captures from different countries • Adds the ability to search for redirects directly on the index page • Adds 'Pull capture from another instance' capability via the UI • Adds 'Push capture to a remote instance' capability via the UI • Renders a cookie name index from storage state and shows cookie name frequency in the storage modal • Introduces a Mastodon bot (@lookyloo@social.circl.lu) for automated updates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.28.0

Tue, 18 Feb 2025 15:44:47 GMT

Lookyloo v1.28.0 adds headed browser capture, CIRCL Passive DNS triggering, indexing of IPs/TLDs, and capture push to other instances • Adds `allow_headed` setting in `config/generic.json` to enable captures with a full (headed) browser instead of headless • Trigger CIRCL Passive DNS on IPs and hostnames automatically during analysis • Index IPs and TLDs with searchable indexes exposed in the UI • Link hostname and IP indexes together, visible on the UI for cross-referencing • Share direct links to IP, Hostname, Favicon modals from the UI • Push captured analyses to another Lookyloo instance via the UI or API • Use MISP Taxonomy (dark-web) as the default categorization scheme • Restrict modules to admin users only to limit third-party API token exposure • Enable full-text search on indexes where applicable for faster lookups • Optionally auto-submit .onion URLs to an AIL instance via configuration Breaking changes: • The `RiskIQ` module has been removed as the upstream service was killed by Microsoft. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.26.1

Thu, 10 Oct 2024 15:32:08 GMT

Lookyloo v1.26.1 adds pagination by capture timestamp, new TLD index, and optional JS disable during capture. • Adds new index for Top Level Domains (TLDs) to improve lookup speed • Allows paginating search results based on capture timestamp using the new index backend Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.26.0

Tue, 17 Sep 2024 11:25:31 GMT

Lookyloo v1.26.0 adds capture categorization, API retrieval by UUID, per-script control, and CSP headers. • Adds `categories` feature to organize captures • Adds `GET /api/v1/captures/category/` endpoint to retrieve UUIDs by category • Adds API capability to fetch a single capture via its UUID • Adds controller buttons to Start/Stop individual scripts per capture Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.25.0

Wed, 03 Jul 2024 12:44:00 GMT

Lookyloo v1.25.0 adds capture removal endpoint, FuzzImy hashing, PNG tree export, and simplified capture interface • Adds FuzzImy hash generation based on HTML structure using CERT PL algorithm for rendered pages • Adds option to download the capture tree visualization as PNG • Adds simplified capture page UI without the standard options panel • Adds optional auto-report checkbox on the admin capture page Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.24.0

Fri, 29 Mar 2024 17:32:23 GMT

Lookyloo v1.24.0 adds captcha ID indexing, Shodan favicon correlation, admin-only capture indexing, and `send_email` API access • Index favicons and correlate them to Shodan via MM3H hash • Search and index captcha IDs (reCaptcha, hCaptcha, Cloudflare) • [Admin Only] Index all captures in kvrocks instead of only public ones • Make `send_email` available from the API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.23.0

Mon, 05 Feb 2024 16:01:33 GMT

Lookyloo v1.23.0 adds S3 archiving, CIRCL Passive DNS integration, and API-driven auto-reporting. • `Archiving old captures to a S3 bucket` enables offloading long-term storage for captured data (noted as handling well over 2M on production). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.22.0

Tue, 17 Oct 2023 07:24:26 GMT

Lookyloo v1.22.0 adds S3FS archival, gzip HARs, MISP export on file download, favicon fetching, and multiple MISP instance support. • `S3FS` integration for archiving captures • HAR dumps stored in `gzip` archives instead of uncompressed format • New capability to export to MISP when a capture downloads a file (MISP Export on Download) • Ability to fetch downloaded files via the API • Fetch favicons using default URL and HTML content • Support for multiple MISP instances for submission and lookup Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.21.0

Fri, 30 Jun 2023 20:46:08 GMT

Lookyloo v1.21.0 adds configurable capture parameters and global proxy support. • Allows passing timezone, geolocation coordinates, locale, and color scheme to a capture • Adds a `proxy` option in the settings to configure a global proxy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.20.0

Thu, 01 Jun 2023 14:21:18 GMT

Lookyloo v1.20.0 adds API-driven capture comparison, Pandora submission, and auto-reporting capabilities • Adds the ability to compare captures via the API • Enables submission of any URL format to Pandora (if available) through the tool • Allows automatic reporting to be triggered via the API • Adds a field in the monitoring form to set an email address for notifications Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.19.0

Thu, 30 Mar 2023 10:25:46 GMT

Lookyloo v1.19.0 adds email attachment for contacts and admin modal for capture tasks • Email notifications now attach contact details to facilitate takedown requests. • Admin-only modal added to trigger hide or rebuild tasks on specific captures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.18.0

Wed, 01 Mar 2023 11:33:31 GMT

Adds recurring capture monitoring, takedown API, and AAAA DNS support in Lookyloo v1.18.0 • `monitoring` subsystem (beta) triggers recurring captures for temporal comparison • New Takedown endpoint (`/takedowns`) gathering WHOIS/security.txt contacts for malicious URLs • `AAAA` DNS queries are now triggered during capture (previously `A` only) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.17.0

Thu, 29 Dec 2022 13:48:48 GMT

Lookyloo v1.17.0 adds HAR file submission, offline capture storage, bulk status views, and download modals. • Supports submitting and viewing a HAR file captured externally via the UI • Implements temporary local storage of captures when the Lacus web-service is unreachable • Displays status updates for captures submitted in bulk • Adds a modal to list all downloadable contents for a capture from the tree view Breaking changes: • Poetry v1.3.0 or more recent is now required; upgrading will break if an older version remains installed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.16.0

Sat, 29 Oct 2022 13:19:39 GMT

Adds `remote_lacus` configuration to `.hacktron/config.yaml` for external capture orchestration via Lacus • `config/generic.json`: Adds `remote_lacus.enable` and `remote_lacus.url` config keys to route captures through an external Lacus instance Breaking changes: • Requires poetry v1.2.0 or more recent. Run the following command to upgrade it: `poetry self update` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.15.0

Thu, 25 Aug 2022 12:43:29 GMT

Lookyloo v1.15.0 adds mobile device emulation, downloadable content submission to Pandora, and browser engine auto-selection. • Use pre-configured devices from Playwright (mobile only for now) • Download files when the URLs points to a downloadable content • Submit downloadable content to Pandora (if available) • Automatically select the most appropriate browser engine based on the user-agent Breaking changes: • Lookyloo requires Redis 7.0 or more decent. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.14.0

Mon, 08 Aug 2022 13:53:34 GMT

Lookyloo v1.14.0 adds file-based capture, RiskIQ Passive DNS integration, gzip HAR archives, and DoNotTrack header support. • Support for RiskIQ Passive DNS (requires API key) • Compress (gzip) the HAR file in archived captures - saves a lot of disk space • Display SSL/TLS information available in the HAR dump from Playwright • Optional DoNotTrack HTTP header in capture • Display size of rendered page on hostnode popup Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.13.0

Sun, 26 Jun 2022 16:06:50 GMT

Lookyloo v1.13.0 revamps package generator for improved usability. • Revamped the package generator to be more usable. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.12.0

Tue, 24 May 2022 13:33:18 GMT

Lookyloo v1.12.0 adds Playwright-based captures and automatic capture de-duplication. • Adds Playwright as the capture engine instead of Splash, enabling instrumentation of reCaptcha detection. • Adds automatic de-duplication that skips identical capture requests triggered within 5 minutes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.11.0

Thu, 31 Mar 2022 11:17:11 GMT

Adds bulk capture from the web interface to trigger multiple captures at once. • Trigger multiple captures at once from web interface Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo

Lookyloo v1.10.0

Fri, 03 Dec 2021 11:00:08 GMT

Lookyloo v1.10.0 adds Hashlookup integration, arbitrary HTTP headers/UA for captures, per-capture privacy default, CORS support, and resource hash API. • Adds `Hashlookup` integration to lookup IP hashes via the CIRCL service • Allows passing arbitrary HTTP headers to captures via the new capture configuration option • Allows passing arbitrary User-Agent strings to captures via the browser configuration option • Exposes an API endpoint to get hashes of all captured resources using any Python-supported algorithm • Adds `default_public` config setting to make captures private by default • Adds CORS settings configuration to enable JavaScript-based submissions from browser extensions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/lookyloo