Quick answer: SpiderFoot integrates with 200+ modules covering DNS and passive DNS, WHOIS and public registries, certificate transparency, search engines, social media, breach and leak databases, threat-intelligence and reputation feeds, IP and geolocation services, cloud storage, crypto addresses, the dark web (via Tor) and external tools like Nmap, Nuclei and DNSTwist. Popular sources include VirusTotal, Shodan, SecurityTrails, Hunter.io, AbuseIPDB, AlienVault OTX, Censys, GreyNoise and Have I Been Pwned. Many modules need no API key; others offer free tiers.
Modules are what make SpiderFoot powerful. Each one connects to a data source or performs a check, and they all work together automatically. This guide explains the module categories, the most useful integrations, which ones need API keys, and how to choose the right modules for faster, better scans.
How SpiderFoot Modules Work
Every module has a name starting with sfp_ (for example sfp_dnsresolve). Each module watches for certain data types (such as a domain or IP) and produces new ones (such as subdomains or open ports). When one module publishes a new result, any module interested in that type picks it up. That chain reaction is how one seed turns into a complete picture.
To see every module on your install:
python3 sf.py -MAnd every data type:
python3 sf.py -TSpiderFoot Module Categories
| Category | What it covers | Example modules / sources |
|---|---|---|
| DNS | Resolution, records, zone transfers, brute-forcing | sfp_dnsresolve, sfp_dnsbrute, sfp_dnscommonsrv |
| Passive DNS | Historical DNS and subdomains | SecurityTrails, CIRCL.LU, Mnemonic and other passive DNS providers |
| Public registries | WHOIS, RIRs, company registries, certificate logs | sfp_whois, sfp_crt (crt.sh), BGPView, OpenCorporates |
| Search engines | Mentions, pages, documents | Bing, Google (API), DuckDuckGo |
| Social media | Profiles and accounts | sfp_accounts (username checks on hundreds of sites), Twitter/X, GitHub |
| Leaks, dumps and breaches | Compromised emails and credentials | Have I Been Pwned, LeakIX, paste sites |
| Reputation systems | Blacklists, malware, abuse reports | VirusTotal, AbuseIPDB, AlienVault OTX, GreyNoise, URLScan, DNSBLs |
| Crawling and scanning | Web spidering, port scans, SSL checks | sfp_spider, sfp_portscan_tcp, sfp_sslcert |
| Content analysis | Extracting emails, hashes, frameworks, metadata | sfp_email, sfp_webframework, file metadata modules |
| Secondary networks | Tor and dark-web search | Ahmia, Onion search modules (need Tor) |
| Real world | Phone numbers, addresses, geolocation | IP geolocation, phone lookup services |
| Cloud storage | Open buckets | sfp_s3bucket, Azure Blob and Google Cloud Storage modules |
| Crypto | Bitcoin/wallet lookups | Blockchain lookup modules |
Module lists change between versions, and some third-party services shut down or change their APIs. Always check sf.py -M on your own install.
Most Useful Integrations (and Whether They Need Keys)
| Source | What it adds | API key |
|---|---|---|
| crt.sh (certificate transparency) | Subdomains from TLS certificates | No |
| DNS resolution / brute-force | Hosts, IPs and records | No |
| WHOIS | Registrar, dates, contacts | No |
| VirusTotal | Malware and URL reputation, subdomains | Yes (free tier) |
| Shodan | Open ports, banners, vulnerabilities | Yes (free/paid) |
| SecurityTrails | Historical DNS and subdomains | Yes (free tier) |
| Hunter.io | Email addresses for a domain | Yes (free tier) |
| AbuseIPDB | IP abuse reports | Yes (free tier) |
| AlienVault OTX | Threat indicators and passive DNS | Yes (free) |
| GreyNoise | Internet scanner and noise classification | Yes (free community) |
| Censys | Hosts, certificates, services | Yes (free tier) |
| URLScan.io | Website scans and related domains | Optional |
| Have I Been Pwned | Breached accounts | Yes (paid) |
Free-tier limits and pricing change often, so check each provider’s site.
External Tool Integrations
SpiderFoot can also run well-known security tools installed on your system and pull their output into the scan. Modules starting with sfp_tool_ include integrations for tools such as:
- Nmap – port and OS detection
- Nuclei – template-based vulnerability checks
- DNSTwist – look-alike domain detection
- WhatWeb / Wappalyzer – web technology fingerprinting
- testssl.sh – TLS configuration checks
- CMSeeK – CMS detection
- TruffleHog – secrets in code repositories
- Retire.js – vulnerable JavaScript libraries
Install the tool, then set its path in the module’s settings. These are active checks, so only use them on authorised targets. Kali users already have many of them; see our SpiderFoot Kali Linux guide.
How to Add API Keys
- Create a free account with the provider and copy your API key.
- In SpiderFoot, open Settings.
- Select the module in the left list (for example VirusTotal).
- Paste the key and click Save Changes.
Protect those keys: they are stored in SpiderFoot’s local database. Read how to secure SpiderFoot data.
How to Choose the Right Modules
| Goal | Approach |
|---|---|
| Quick, safe overview | Use case Passive |
| Map an organisation’s assets | Use case Footprint |
| Check if an IP/domain is malicious | Use case Investigate |
| Find only emails or subdomains | By Required Data in the UI, or -t EMAILADDR -f in the CLI |
| Full control | By Module, or -m sfp_crt,sfp_dnsresolve |
More CLI examples in our SpiderFoot commands cheat sheet. Match modules to inputs with our SpiderFoot target types guide.
Starter API Key Pack for Beginners
If you only add five keys, add these (all have free tiers at the time of writing): VirusTotal, Shodan, SecurityTrails, AbuseIPDB and AlienVault OTX. Together they cover reputation, services, DNS history and threat intelligence. Then follow our SpiderFoot beginner tutorial to run your first scan.
Module Troubleshooting
- Module returns nothing: check the key, quota and the scan’s Log tab.
- HTTP 401/403 errors: invalid or expired key.
- HTTP 429 errors: rate limit reached; wait or reduce threads.
- Tool module fails: confirm the external tool is installed and its path is set.
- Source discontinued: some services shut down over time; disable that module.
More fixes: SpiderFoot errors and fixes.
Frequently Asked Questions
How many modules does SpiderFoot have?
SpiderFoot 4.0 includes more than 200 modules. Run python3 sf.py -M to list every module available on your installation.
Which SpiderFoot modules need API keys?
Modules for services such as VirusTotal, Shodan, SecurityTrails, Hunter.io, AbuseIPDB, AlienVault OTX, Censys, GreyNoise and Have I Been Pwned need keys. DNS, WHOIS and certificate transparency modules usually do not.
Can SpiderFoot use Nmap and Nuclei?
Yes. SpiderFoot includes sfp_tool_ modules that run external tools such as Nmap, Nuclei, DNSTwist, WhatWeb and testssl.sh when they are installed and their paths are configured.
Does SpiderFoot search the dark web?
Yes. With Tor installed and configured as a SOCKS proxy, SpiderFoot can use modules that search Tor hidden-service search engines.
What are the best free API keys for SpiderFoot?
A strong free starter set is VirusTotal, Shodan, SecurityTrails, AbuseIPDB and AlienVault OTX. Check each provider for current free-tier limits.
How do I run only specific SpiderFoot modules?
In the web UI choose By Module when creating a scan. In the CLI use -m with a comma-separated list, for example -m sfp_crt,sfp_dnsresolve.
Conclusion
SpiderFoot’s 200+ modules turn it into a single hub for DNS, registries, search engines, social media, breaches, threat intelligence, cloud storage, the dark web and popular security tools. Start with the no-key modules, add a handful of free API keys, and pick modules by use case or required data for faster scans. New to the tool? Start with what SpiderFoot is and how it works.
Pingback: Is SpiderFoot Data Secure? Risks + 8-Step Checklist (2026)