The Tuxxin Stack

Scan your own IP from the terminal in one command

qsa.sh runs a real external security and port scan of the public IP you connect from — no install, no signup, nothing to remember but the URL. A single "curl qsa.sh" spins up naabu for fast port discovery, nmap for service and version detection, and nuclei for known-vulnerability checks, then streams the results live to your terminal in about 25 seconds. It offers three scan depths, from a quick look to a deeper sweep, all driven by the same one-line command, and it only ever reports against the caller's own address, so it stays a true outside-in view of your real attack surface. Free and available worldwide.

Multi-egress URL threat scanning that exposes cloaking

whack.sh is a multi-egress URL threat scanner. It loads a suspicious link through datacenter, residential, and mobile IP networks at the same time, then diffs how the page behaves across them to expose the cloaking and traffic-distribution systems that serve a clean decoy to datacenter-based scanners but a live payload to real victims. Every scan captures the full HAR (request and response headers), a screenshot timeline, and the redirect chain, and hash-checks any forced-download samples against malware databases. It is API-first, with every tier driven by a single "whack <url>" call and a credit model that charges for the heavy residential and mobile egress, not the cheap datacenter checks.

Map and inspect the entire IPv4 internet

WorldIP.io is a free IP-address intelligence platform that maps the complete IPv4 space: 3.9+ billion addresses across 7.1+ million CIDR ranges, 79,000+ ASNs, and 250 countries. It resolves ownership, geolocation, ASN, and reverse DNS (PTR) for any IP or range, and pairs that with deeper tooling: real-time BGP anomaly detection (MOAS conflicts, RPKI validation, route withdrawals), live RIR ownership-change tracking, WHOIS/RDAP lookups, a subnet calculator with CIDR reference, an IPv4-exhaustion tracker, and a 3D globe that visualizes allocation worldwide. Every lookup and tool works without signup or an API key, and a REST API is available.

Authentic Invicta watches at 50-90% off

An e-commerce store selling authentic, brand-new Invicta watches and jewelry at 50-90% off MSRP, sourced from wholesale distributors and shipped from a Florida warehouse. Shoppers browse a weekly-rotating, limited-stock catalog filtered by gender (Shop for Her, Shop for Him, Unisex), case size (under 30mm through 50mm+), and named collections like TechnoMarine, Wildflower, Celestial, and Angel. It runs full product detail pages, a wishlist and cart, free shipping over $100, and secure Stripe checkout with Visa, Mastercard, Amex, Discover, plus Affirm and Klarna installments.

AI-powered SEO dashboard — launching soon

SEOda.ai is an AI-powered SEO dashboard that tracks your search rankings, monitors uptime, audits site health, and tells you exactly what to fix — in plain English. It pulls Google Search Console data, Core Web Vitals and PageSpeed scores, SSL and crawl health into one place, then turns it into prioritized, plain-language actions and monthly PDF reports. Currently in development, with a 50%-off launch offer for the first three months.

One interactive 3D globe, 31 live data feeds.

Overwatch is a free, interactive 3D WebGL globe that overlays around 31 live data layers onto a single Earth. Spin and zoom, then click any point — a plane, ship, earthquake, or satellite — to open an inspector with the details behind it. Layers stream from public feeds: aircraft via ADS-B (adsb.fi), ships via AIS, trains via Amtraker, transit via Transitland, earthquakes from USGS and EMSC, wildfires from NASA FIRMS, lightning from Blitzortung, aurora from NOAA OVATION, plus submarine cables, internet outages, BGP events, data centers, satellites, the ISS, and the Starlink constellation propagated from CelesTrak TLEs. Each layer updates on its own cadence — seconds for flights and lightning, minutes for quakes and air quality — and drops off automatically when its source goes quiet. No account, no login.

Full-page website screenshots, no login required

Webshot captures full-page screenshots of any public URL through headless Chrome, rendering JavaScript-heavy and lazy-loaded content before it shoots. It emulates desktop (1920x1080), tablet (iPad Pro), and mobile (iPhone 15 Pro, 3x pixel ratio) viewports plus custom resolutions, with full-page or above-the-fold modes and JPG, PNG, WebP, or PDF output. A no-auth POST API at /api/capture returns raw image bytes, backed by official MIT-licensed SDKs for JavaScript/TypeScript, Python, and PHP, with cURL, Node, Go, and PHP examples. It's free with no signup or watermarks, rate-limited to 5 captures per 15 minutes per IP, and deletes every screenshot within an hour.

A drop-in REST API for HESK Help Desk

HeskAPI is a drop-in REST API module for HESK 3.7, the popular open-source help desk. It adds a secure, rate-limited REST API that lets you create and manage tickets, post replies, and handle attachments programmatically, plus a built-in admin panel to issue and revoke API keys, watch usage, and configure limits from one screen. It installs into an existing HESK instance without patching core files and ships as a one-time purchase rather than a subscription, so a help desk you already run gains full API access for integrations, automations, and custom front-ends.

Host from home, no open ports needed

iNetPanel is a free, GPL-3.0 web hosting control panel for Debian-based home servers that routes all traffic through a Cloudflare Zero Trust tunnel, so sites stay reachable with zero open ports. It installs in one command plus a six-step browser wizard, then manages Apache/lighttpd, MariaDB, and per-domain PHP from 5.6 through 8.5, with automatic Let's Encrypt SSL via Cloudflare DNS-01. Operators get a client portal (databases, file manager, SSH keys), a real-time CPU/RAM/network dashboard, daily backups, phpMyAdmin SSO, Cloudflare email routing, a built-in WireGuard VPN with peer QR codes, fail2ban hardening, and 11 CLI tools for health checks, security audits, and malware scans.

Free image conversion across thirteen formats, no signup

An ImageMagick-backed online image converter that handles thirteen input formats (JPG, PNG, GIF, WebP, SVG, AVIF, HEIC, BMP, TIFF, ICO, PDF, EPS, PSD) and outputs to nine (WebP, JPG, PNG, AVIF, GIF, BMP, TIFF, PDF, ICO). It batches up to 20 files at 25 MB each, offers optional extra compression per format, and deletes every upload the moment the download completes. A token-based meter (50 tokens to start, 1 per conversion, 2 with optimization) governs usage transparently and refills continuously, so there is no account, email, or daily quota.

Self-hosted dynamic QR codes with scan analytics

A self-hosted system for generating dynamic QR codes that redirect through your own server, so the destination can be changed after the code is printed without reprinting. It supports eight code types (URL, WiFi, vCard, Maps, Phone, SMS, Email, and Social), embeds uploaded PNG/JPG logos in the center, and logs every scan with IP, geolocation (city, region, country), ISP, and device type, caching geo lookups per IP. It ships with a soft-delete trash/restore that preserves scan history and a full JSON REST API, all hardened with CSRF protection, constant-time API-key comparison, MIME-validated uploads, and per-IP rate limiting.

The security-first PHP micro-framework behind the suite

TiCore is a lightweight, open-source PHP framework (v1.25, PHP 8.4+) built around a public/private directory split so sensitive files stay outside the web root. Its four-tier smart router falls through from manual routes to auto-discovered controllers to a PageController fallback that turns a bare view file into a fully rendered page with zero config, then a 404. It ships a security layer with CSRF token generation/verification and XSS-safe output escaping via an e() helper, a built-in SEO suite that auto-generates canonical URLs, Open Graph and Twitter/X cards, Schema.org JSON-LD and GA4 tags, an optional PDO database layer with prepared statements and utf8mb4, and six-level structured logging (CRITICAL through DEBUG) with daily rotation.

Tag a rubber duck, track its global journey

DuckyTrack is a platform for tracking physical rubber ducks across the world. Users generate unlimited QR tags for free, print them at home and stick them on ducks, then release the ducks into the wild; whoever finds one scans the code to log a location, photo, and message, building a live map and travel history for that duck. It includes a Cruise Mode that scans offline (for cruise ships and dead zones) and syncs on reconnect, plus a live sightings feed, a leaderboard for the most releases and finds, an installable home-screen app, and a Duck Store selling weatherproof tags and supplies. It is built for two real ducking communities at once: Jeep ducking (leaving ducks on other people's Jeeps) and cruise ducking (hiding ducks around ships and ports).

The classic 1984 drug-trading game, reborn

Drug Wars Online is a browser-based trading simulation that revives the classic 1984 buy-low/sell-high game in a retro ASCII art interface. Players start with $2,000 cash and $5,500 of loan-shark debt, then spend 30 in-game days trading six commodities across ten real-world cities like NYC, Bogotá, Amsterdam, and Bangkok, racing to maximize a final score of cash plus bank minus debt. Debt compounds at 10% daily while banked money earns 2%, and random police busts, muggings, and market swings force constant risk management. It runs free with no signup needed to play, optional accounts to save scores, a global leaderboard, a Discord community, and full localization into eight languages.

Trade the charts, bet on the beat

ChartWars is a virtual stock market for music where players trade shares of songs and artists using virtual Chart Bucks, with no real money involved. Songs "IPO" when they debut on the Billboard Hot 100, and prices move every 15 minutes off a weighted blend of seven real-world signals: Billboard rank, Spotify streams, YouTube views, TikTok activity, Reddit buzz, Google Trends, and Last.fm listeners. It supports long positions, short selling (with a 3% fee), artist index stocks that track a full catalog, a global leaderboard, 60 unlockable achievements, a live news feed, and weekly market recaps spanning 7 charts across 10 genres.

Build a corporate empire, one deal at a time

Empire War is a free, browser-based business tycoon game where players grow a company from a scrappy startup to a global conglomerate. Core loops include spending Action Points on 25+ deal types across 5 tiers for cash, XP, and loot drops; building out 90 business divisions across 6 industries that generate passive income while offline; recruiting and assigning employees to deals, divisions, or attack teams; and launching hostile takeovers against rival players to siphon their income. An IPO and prestige system lets players take the company public to cash out and restart with permanent bonuses, while the Power 500 leaderboard ranks empires by net worth and industry dominance, with mechanics like SEC heat to manage along the way.