Legal
Attributions
Pandora Search is built on open data, open-source software and public services. This page credits them and states the licence or terms under which each one is used. Names and trademarks belong to their owners; mentioning them does not imply any relationship or endorsement.
Open data
| Source | What it provides | Licence or terms |
|---|---|---|
| OpenStreetMap (Nominatim, Overpass API, OSM API) | Geocoding, what surrounds a point, OpenStreetMap accounts | Open Database License (ODbL) 1.0. © OpenStreetMap contributors |
| CARTO basemaps | The dark basemap of the Map view | © CARTO; map data © OpenStreetMap contributors |
| Mapillary | Street-level imagery around a point | CC BY-SA 4.0. © Mapillary contributors |
| Stack Exchange | Public profiles across the Stack Exchange network | User contributions under CC BY-SA (version according to the date of each post) |
| Wikidata | Organisations and public figures | CC0 1.0 |
| Wikimedia (Wikipedia and sister projects) | Contribution records of a username | Text under CC BY-SA 4.0; Wikimedia terms of use |
| GLEIF | LEI records of legal entities | CC0 1.0 |
| BORME · Agencia Estatal Boletín Oficial del Estado | Spain's companies register announcements (Section I) | Reuse of public sector information (Spanish Law 37/2007). Source: Agencia Estatal BOE |
| Companies House | UK companies, officers and persons with significant control | Contains public sector information licensed under the Open Government Licence v3.0 |
| The GDELT Project | Press mentions worldwide | Open use with attribution to the GDELT Project |
| DB-IP | IP geolocation (City Lite) | CC BY 4.0. IP Geolocation by DB-IP |
| iptoasn | IP to network (ASN) | PDDL 1.0 |
| Tor Project | Tor exit nodes | CC0, as declared for this list |
| abuse.ch (URLhaus, ThreatFox) | Malware URLs and indicators of compromise | CC0 1.0, under the abuse.ch terms of use |
| Have I Been Pwned | Breach exposure (names, dates, data types) | CC BY 4.0, with attribution to Have I Been Pwned |
| WhatsMyName | The list of sites for username sweeps | CC BY-SA 4.0 |
| disposable-email-domains | Disposable email providers | CC0 1.0 |
| FireHOL level 1 · X4BNet lists_vpn | IP reputation, VPN and data-centre ranges | FireHOL: terms of each source list; X4BNet: MIT |
| blocklist.de · CINS Army · GreenSnow · Emerging Threats | IP reputation lists | Terms of each list |
Public APIs and services
They are queried under each provider's terms. Some only run with the customer's own key, because their terms do not allow resale.
- Identity and accounts: Gravatar, GitHub and other code forges (public SSH and PGP keys), keyserver.ubuntu.com, npm, PyPI, crates.io, RubyGems.org, Packagist, Maven Central, NuGet, MetaCPAN, Hex.pm, Docker Hub, AUR, WordPress.org, Bluesky PLC directory, Discourse forums, Roblox, Mojang (Minecraft), Duolingo, Twitch, YouTube Data API, Last.fm, osu!, OpenXBL (Xbox), OpenStreetMap, Telegram (public preview and official API), TelegramDB, Telemetr.io, Arctic Shift (Reddit archive), Hacker News Search (Algolia), DuckDuckGo Instant Answer API, oEmbed of X and TikTok.
- Emails and breaches: XposedOrNot, LeakCheck (public API), Have I Been Pwned, EmailRep, Hunter.io, Behind the Email, IntelBase, revealer.us.
- Domains and infrastructure: DNS over HTTPS (Cloudflare, Google), RDAP (rdap.org), crt.sh, Certspotter (SSLMate), mnemonic PassiveDNS, Robtex, Shodan and Shodan InternetDB, GreyNoise Community, RIPEstat, SANS Internet Storm Center, VirusTotal, AlienVault OTX, AbuseIPDB, OpenPhish, urlscan.io, SecurityTrails, ViewDNS.info, HackerTarget, Common Crawl, Wayback Machine (Internet Archive), Ahmia, Brave Search API.
- Images, places, companies and press: Google Cloud Vision, ip-api.com, Nominatim, Overpass API, Mapillary, Companies House, OpenCorporates, GLEIF, Wikidata, GDELT, BORME.
Open-source software
Server
| Component | Licence |
|---|---|
| FastAPI | MIT |
| Uvicorn | BSD-3-Clause |
| HTTPX | BSD-3-Clause |
| Pydantic | MIT |
| python-multipart | Apache-2.0 |
| Beautiful Soup | MIT |
| lxml | BSD-3-Clause |
| phonenumbers (libphonenumber) | Apache-2.0 |
| ExifRead | BSD-3-Clause |
| Pillow | MIT-CMU |
| pypdf | BSD-3-Clause |
| ImageHash | BSD-2-Clause |
| maxminddb | Apache-2.0 |
| Holehe | GPL-3.0 |
| Ignorant | GPL-3.0 |
| Telethon | MIT |
Tools integrated or whose method is reproduced
| Component | Licence |
|---|---|
| Sherlock | MIT |
| Maigret | MIT |
| Blackbird | GPL-3.0 |
| SpiderFoot (ported modules) | MIT |
| SearXNG | AGPL-3.0 |
| GHunt | AGPL-3.0 |
| PhoneInfoga (method) | GPL-3.0 |
| Metagoofil (method) | GPL-2.0 |
| theHarvester (method) | GPL-2.0 |
| dnstwist (method) | Apache-2.0 |
Web app and site
| Component | Licence |
|---|---|
| React | MIT |
| force-graph | MIT |
| d3-force-3d | MIT |
| MapLibre GL JS | BSD-3-Clause |
| Zustand | MIT |
| Lucide | ISC |
| Inter (typeface) | SIL Open Font License 1.1 |
| JetBrains Mono (typeface) | SIL Open Font License 1.1 |
Methods
Some transforms reproduce, with public sources, the procedure described by OSINT tools and services (Google Dorks, deanonymizer, PeekVault, Behind the Email, IntelBase, fingerprint.to, SeekNow, revealer.us). Unless the tables above say so, no code from those services is used, and their APIs, when used, are queried under their terms.
If you believe an attribution is missing or wrong, write to info@pandorasearch.com.