Everything DECINT does, stated in full — what each tool takes, what it gives back, and where it stops. The price beside each one is what it is worth on its own; they are sold together, which is the point.
All three separately$40Essentials$29/monthSave $11
Your query fans out to several public breach-data services at once. Their answers are normalised into one table, deduplicated, and tagged with the source that produced each row, so you can see which service vouches for what.
Accepts
·Email address
·Username or handle
·Domain name
Returns
·Breach or dataset name
·Date the data surfaced
·Which fields were exposed — passwords, phone numbers, addresses
·Matching credential lines, masked unless you reveal them
Sources
·XposedOrNot
·ProxyNova COMB
·LeakCheck (public)
·HIBP breach catalogue
Limits — Coverage comes from free public sources: broad, but not exhaustive. A source that rate-limits or goes offline is reported as failed rather than silently dropped from the results.
02
Discord OSINT
user / server ID · invite
$9/mo
In Essentials
A Discord ID encodes its own creation timestamp, so account age is derived arithmetically — no lookup, no rate limit, and nothing is sent to Discord. Live profile and server details use the official API.
Accepts
·User ID
·Server (guild) ID
·Invite code or full invite link
Returns
·Exact account or server creation time, to the millisecond
·Username, display name and avatar
·Profile badges decoded from account flags
·Server name, member and online counts, and who created the invite
Limits — Timestamp decoding always works offline. Live user lookups need a bot token configured on the server; invite and public-server details do not.
03
Dark-web search
keyword
$19/mo
In Essentials
Two engines. Fast mode ranks a large .onion index and re-scores it — weighting title over snippet and enforcing term coverage, so loose keyword matches drop out. Tor mode queries multiple onion search mirrors directly over a live circuit, each on its own isolated stream.
Goes further on Pro — queries run over live Tor circuits instead of the clearnet index, with corroboration scoring and an evidence SHA-256 for each result.
·A corroboration count when several indexes agree on a result
·A SHA-256 hash over the result set, so a report can be shown to be unaltered
Limits — Onion mirrors rotate constantly. Dead ones demote themselves via a circuit breaker instead of stalling the search. Tor mode is deliberately slower than fast mode — it is making real circuits.
04
Packet capture
live interface
$0/mo
In Operator only
Captures on the host's own network interface and decodes each frame as it arrives, streaming a live table into the console.
Accepts
·A network interface on the machine running DECINT
Returns
·Source and destination addresses
·Protocol — TCP, UDP, TLS, HTTP, DNS, ICMP, ARP
·TCP flags and packet length
·DNS query names as they resolve
Limits — Needs raw-socket access, and only ever sees traffic on the machine it runs on. That makes it an operator tool: it is disabled by default and switched off entirely on shared or public deployments.
Something missing?
Custom tools can be added to your account.
If your work needs a source, a lookup, or a workflow that isn't here, email the operator and describe it. Bespoke tools are built and enabled on your account directly, and come as standard on Enterprise.
Pricing for custom scripts and tools varies with scope, and is quoted per account before any work starts.