Client Work, Security Tools and Labs

Scan your own IP from the terminal in one command

qsa.sh runs an external security and port scan of the public IP you connect from. A single "curl qsa.sh" starts naabu for port discovery, nmap for service and version detection and nuclei for known-vulnerability checks, then streams the results to your terminal in about 25 seconds. It scans only the caller's own address, from outside the caller's network. The live scan is free, and paid Full and Deep scans cover every port.

Multi-egress URL threat scanning that exposes cloaking

whack.sh is a multi-egress URL threat scanner. It loads a suspicious link through datacenter, residential, and mobile IP networks at the same time, then diffs how the page behaves across them to expose the cloaking and traffic-distribution systems that serve a clean decoy to datacenter-based scanners but a live payload to real victims. Every scan captures the full HAR (request and response headers), a screenshot timeline, and the redirect chain, and hash-checks any forced-download samples against malware databases. It is API-first, with every tier driven by a single "whack <url>" call and a credit model that charges only for the heavier residential and mobile egress.

Map and inspect the entire IPv4 internet

WorldIP.io is a free IP-address intelligence platform that maps the complete IPv4 space: 3.9+ billion addresses across 7.1+ million CIDR ranges, 79,000+ ASNs, and 250 countries. It resolves ownership, geolocation, ASN, and reverse DNS (PTR) for any IP or range, and pairs that with deeper tooling: real-time BGP anomaly detection (MOAS conflicts, RPKI validation, route withdrawals), live RIR ownership-change tracking, WHOIS/RDAP lookups, a subnet calculator with CIDR reference, an IPv4-exhaustion tracker, and a 3D globe that visualizes allocation worldwide. Every lookup and tool works without signup or an API key, and a REST API is available.

Real-time SSL certificate & new-domain intelligence

issued.live is a real-time feed of newly issued SSL/TLS certificates and newly registered domains, read from Certificate Transparency logs and domain registrations as they happen. Active scanners keep resolving and re-checking each name so its DNS, hosting and status stay current. The pipeline runs in memory and holds data only as long as the feed uses it. It is built for brand-protection and threat-hunting work: catching look-alike domains and unauthorized certificates that target a brand.

14 curl-native dev tools in one bash script

curlhub.sh is a single-file bash script that packs 14 developer tools into one curl-native command. Each tool is a self-contained function: time (request timing breakdown), headers (inspect response headers), status (HTTP status code check), json (pretty-print JSON responses), post/put/delete (RESTful payloads), follow (trace redirect chains), size (response size analysis), cookie (cookie inspection), ssl (TLS certificate details), digest (Digest Auth test), watch (poll a URL at an interval and diff consecutive responses), and diff (compare two URL responses side-by-side). Output is color-coded, and the only dependencies are bash, curl, python3/jq and openssl.

Single-use dead-man's-switch: code red when a check-in is missed

cde.red is a single-use dead-man's switch for systems that should check in on a schedule. One curl call from the command line registers a monitor and returns a QR code and URL for onboarding, configuration and launch. The monitored system then checks in before its TTL expires. When a check-in is missed, cde.red fires a "code red": an escalating alert by email, SMS and custom webhooks that flags a dead cron job, a crashed service or a device that has gone dark.

Live ingestion feed from a rotating fleet of honeypots

infil.io is a real-time ingestion feed from a rotating fleet of honeypots. Sensors vary by cloud location, IP address, hostname, service profile and configuration: some stay up for months to record slow reconnaissance, and others run for days or hours to sample a burst of activity. Cloud-provider APIs provision and cycle the fleet, so its fingerprint keeps changing. Every probe, credential-stuffing attempt, exploit and scan streams back as it happens, as first-hand threat data for the Tuxxin security stack.

A browser remake of the classic 1984 drug-trading game

Drug Wars Online is a browser-based trading simulation that revives the classic 1984 buy-low/sell-high game in a retro ASCII art interface. Players start with $2,000 cash and $5,500 of loan-shark debt, then spend 30 in-game days trading six commodities across ten real-world cities to maximize a final score of cash plus bank minus debt. Debt compounds at 10% daily while banked money earns 2%, and random police busts, muggings and market swings force constant risk management. It is free to play without an account; optional accounts save scores, and the game has a global leaderboard, a Discord community and full localization into eight languages.

A browser business tycoon game with player-vs-player takeovers

Empire War is a free, browser-based business tycoon game where players grow a company from a startup to a global conglomerate. Core loops include spending Action Points on 25+ deal types across 5 tiers for cash, XP, and loot drops; building out 90 business divisions across 6 industries that generate passive income while offline; recruiting and assigning employees to deals, divisions, or attack teams; and launching hostile takeovers against rival players to siphon their income. An IPO and prestige system lets players take the company public to cash out and restart with permanent bonuses, while the Power 500 leaderboard ranks empires by net worth and industry dominance, with mechanics like SEC heat to manage along the way.

Full-page website screenshots in the browser or through a keyless API

Webshot captures full-page screenshots of any public URL through headless Chrome, rendering JavaScript-heavy and lazy-loaded content before it shoots. It emulates desktop (1920x1080), tablet (iPad Pro), and mobile (iPhone 15 Pro, 3x pixel ratio) viewports plus custom resolutions, with full-page or above-the-fold modes and JPG, PNG, WebP, or PDF output. A keyless POST API at /api/capture returns raw image bytes, backed by official MIT-licensed SDKs for JavaScript/TypeScript, Python, and PHP, with cURL, Node, Go, and PHP examples. The free tier needs no signup or API key and allows 5 credits per 15 minutes per IP; paid plans raise the limits. Screenshots carry no watermark, and every one is deleted within an hour.

A ScrapingBee-compatible web scraping API with free monthly credits

Webfetch is a web scraping API. It loads a public URL through headless browsers and rotating datacenter and ISP exits, then returns the page as rendered HTML, plain text or markdown, or as JSON extracted with CSS or XPath selectors. It matches the parameters, defaults and credit costs of ScrapingBee's HTML API, so most existing code moves over with a new base URL and key, and plans with the same credit allowance cost 38 to 40% less. Blocked attempts, timeouts and anti-bot challenge pages are never charged. Official SDKs for JavaScript, Python and PHP and an MCP server for AI agents are available, robots.txt is honored by default, and a free account gets 1,000 credits to start and 250 more each month, with no card.

Free image conversion across thirteen input formats

An ImageMagick-backed online image converter that handles thirteen input formats (JPG, PNG, GIF, WebP, SVG, AVIF, HEIC, BMP, TIFF, ICO, PDF, EPS, PSD) and outputs to nine (WebP, JPG, PNG, AVIF, GIF, BMP, TIFF, PDF, ICO). It batches up to 20 files at 25 MB each, offers optional extra compression per format, and deletes every upload the moment the download completes. A token meter (50 tokens to start, 1 per conversion, 2 with optimization) refills continuously and takes the place of accounts and daily quotas.

Web hosting control panel behind a Cloudflare tunnel, with zero open ports

iNetPanel is a free, GPL-3.0 web hosting control panel for Debian servers that routes all traffic through a Cloudflare Zero Trust tunnel, so hosted sites stay reachable with zero open ports. It installs with one command plus a six-step browser wizard, then manages Apache/lighttpd, MariaDB, and per-domain PHP from 5.6 through 8.5, with automatic Let's Encrypt SSL via Cloudflare DNS-01. Operators get a client portal (databases, file manager, SSH keys), a real-time CPU/RAM/network dashboard, daily backups, phpMyAdmin SSO, Cloudflare email routing, a built-in WireGuard VPN with peer QR codes, fail2ban hardening, and 11 CLI tools for health checks, security audits, and malware scans.

Self-hosted dynamic QR codes with scan analytics

A self-hosted system for generating dynamic QR codes that redirect through your own server, so the destination can be changed after the code is printed without reprinting. It supports eight code types (URL, WiFi, vCard, Maps, Phone, SMS, Email, and Social), embeds uploaded PNG/JPG logos in the center, and logs every scan with IP, geolocation (city, region, country), ISP, and device type, caching geo lookups per IP. It ships with a soft-delete trash/restore that preserves scan history and a full JSON REST API, all hardened with CSRF protection, constant-time API-key comparison, MIME-validated uploads, and per-IP rate limiting.

Tag a rubber duck, track its global journey

DuckyTrack is a platform for tracking physical rubber ducks across the world. Users generate unlimited QR tags for free, print them at home and stick them on ducks, then release the ducks into the wild; whoever finds one scans the code to log a location, photo, and message, building a live map and travel history for that duck. It includes a Cruise Mode that scans offline (for cruise ships and dead zones) and syncs on reconnect, plus a live sightings feed, a leaderboard for the most releases and finds, an installable home-screen app, and a Duck Store selling weatherproof tags and supplies. It is built for two real ducking communities at once: Jeep ducking (leaving ducks on other people's Jeeps) and cruise ducking (hiding ducks around ships and ports).

A drop-in REST API for HESK Help Desk

HeskAPI is a drop-in REST API module for HESK 3.7, the open-source help desk. It adds a secure, rate-limited REST API that lets you create and manage tickets, post replies, and handle attachments programmatically, plus a built-in admin panel to issue and revoke API keys, watch usage, and configure limits from one screen. It installs into an existing HESK instance without patching core files and ships as a one-time purchase, so a help desk you already run gains full API access for integrations, automations, and custom front-ends.

The security-first PHP micro-framework behind Tuxxin's products

TiCore is a lightweight, closed-source PHP framework (v1.25, PHP 8.4+) built around a public/private directory split so sensitive files stay outside the web root. Its four-tier smart router falls through from manual routes to auto-discovered controllers to a PageController fallback that turns a bare view file into a fully rendered page with zero config, then a 404. It ships a security layer with CSRF token generation/verification and XSS-safe output escaping via an e() helper, a built-in SEO suite that auto-generates canonical URLs, Open Graph and Twitter/X cards, Schema.org JSON-LD and GA4 tags, an optional PDO database layer with prepared statements and utf8mb4, and six-level structured logging (CRITICAL through DEBUG) with daily rotation.

Tuxxin's real-time 3D globe of live data feeds

overwatch.earth is Tuxxin's real-time 3D globe, streaming flights, ships, wildfires, earthquakes, satellites and 30+ more live feeds onto one map. Spin and zoom, then click any plane, ship, earthquake or satellite to open an inspector with the details behind it. Layers stream from public feeds: aircraft via ADS-B (adsb.fi), ships via AIS, trains via Amtraker, transit via Transitland, earthquakes from USGS and EMSC, wildfires from NASA FIRMS, lightning from Blitzortung, aurora from NOAA OVATION, plus submarine cables, internet outages, BGP events, data centers, satellites, the ISS and the Starlink constellation propagated from CelesTrak TLEs. A layer drops off automatically when its source goes quiet. It is free to use without an account.