What investigators use TWILOX for
Six recurring patterns make up the majority of dossiers generated on the platform. Each one is just a different signal walking the same orchestrator.
Reverse phone lookup
Identify the human, carrier, and geographic origin behind any phone number. TWILOX runs PhoneInfoga, queries E.164 carrier metadata, and cross-references 16 country-specific reverse-directory indexes (US, UK, DE, FR, IT, NL, CH, AT, BE, ES, PT, CZ, SK, PL, IE, SE). Findings link back to public sources; never to scam-database false positives from the wrong country.
Email breach exposure & platform footprint
Cross-reference an email against open breach corpora (HIBP, LeakCheck, BreachDirectory) and platform registrations via Holehe. The aggregator promotes privacy-sensitive matches — dating, adult, gambling, dark-web forums — to HIGH severity automatically, and groups the rest by category (forums, hobbies, dev, social, gaming).
Username search across 400+ platforms
Sherlock and Maigret run side-by-side against the full platform catalogue. Results are de-duplicated, scored for confidence, and laid out as a single grid with one row per platform, screenshot evidence where available.
Dark-web monitoring
A TorBot container running inside Docker on the worker VPS routes through a local Tor SOCKS proxy (127.0.0.1:9050) and queries Ahmia.fi, Torch, and Haystack for the target. Each matched .onion is crawled for title, description, exposed emails, and exposed phone numbers. Dark-web monitoring is included in every dossier at no extra cost.
Face-recognition reverse search
Every dossier with an image input runs the photo against FaceCheck.ID and PimEyes via their HTTPS APIs, and against Google Lens, Bing Visual Search, and Surfface via a Playwright headless browser worker. Matched URLs and confidence scores are merged into one ranked list.
Domain, IP, and company intelligence
SpiderFoot's full graph runs in the background — WHOIS history, related domains, IP geolocation, ASN ownership, exposed S3 buckets, GitHub leaks. The output is correlated into the identity graph so a company name and a personal email surface their shared infrastructure.
Continuous monitoring (Operative tier)
Operatives can pin any investigation for continuous re-scan. TWILOX re-runs the orchestrator on a schedule, diffs the new findings against the last run, and pings via webhook or email when something changes — a new breach exposure, a new social account, a new dark-web mention.
Ready to run one? Begin an investigation · $4.99 per dossier.