000090180270
> SYSTEM OVERVIEWOBSERVED ≠ INFERRED ≠ CONTEXTUAL
fixed sources38FIXED · READ-ONLY
schemaV2PROVENANCE-RICH
egressFIXEDFAIL CLOSED
analyst utilities3USER SCANNER · SHODAN · GREYNOISE SWARM
> CAPABILITIESBOUNDARY-AWARE
CORRELATE
Keep reputation, context, claims and risk axes semantically separate.
ANALYZE
Convert provider-native observations into provenance-rich evidence.
IDENTITY OSINT
Run bounded email and username User Scanner enumeration as active OSINT, separate from Evidence v2.
SHODAN OPS
Run bounded host, search, count, stats, domain and account-info lookups with explicit query-credit impact.
GREYNOISE SWARM
Run bounded session search/read, unique and timeseries pivots, Workspace Diff, and explicit single-session export; operator context remains separate from Evidence v2.
EXPORT
JSON, batch and STIX 2.1 without changing the meaning of upstream evidence.
VERIFY
Make provenance, uncertainty, coverage failure and contradiction visible.
> LIVE TERMINALSAME ANALYST SHELL
analyst@para11ax:~$ enrich 199.86.194.7
> upstream Evidence v2 · fixed provider workflow
analyst@para11ax:~$ shodan host 199.86.194.7
> fixed upstream: api.shodan.io · credit: none
analyst@para11ax:~$ user-scanner username vgqg0o2dv8
> isolated identity OSINT · User Scanner
> static landing example · no request executed
analyst@para11ax:~$
> FIXED SOURCE WORKFLOWCURATED PROVIDER SET
IDENTITY / ROUTINGIPinfo · RDAP · RIPEstat · Cloudflare Radar
EXPOSUREShodan · Censys · Modat · Tor Exit
THREAT / IOCGreyNoise · AbuseIPDB · VirusTotal · OTX
VULNERABILITYCISA KEV · FIRST EPSS · NVD · OSV
MALWAREMalwareBazaar · Malpedia · Hybrid Analysis
RANSOMWARERansomLook · Ransomware.live
KNOWLEDGEMITRE ATT&CK TAXII · CIRCL Vulnerability-Lookup
+ MORE FIXED SOURCES
> SHODAN ANALYST OPSAUTHENTICATED · BOUNDED · FIXED EGRESS
COMMANDSshodan host · shodan search · shodan count · shodan stats · shodan domain · shodan info
BOUNDARYSame-origin /api/para11ax/shodan → fixed https://api.shodan.io only.
CREDITSHost/count/stats/info: no query credit · domain: consumes · search: may consume.
SEMANTICSExposure context ≠ maliciousness · operator result ≠ Evidence v2 mutation.
> USER SCANNERACTIVE OSINT · ISOLATED
EMAILAccount-registration OSINT with platform-specific status semantics.
USERNAMEuser-scanner username kaifcodec · Cross-platform handle discovery without treating same handles as identity proof.
BOUNDARYSame analyst shell → authenticated PARA11AX route → server-configured worker only.
SEMANTICSFound ≠ ownership · Error ≠ not found · OSINT remains separate from Evidence v2.