shouldiuse.io

Categories

VERDICT

Lookyloo Review

Worth it

Should I use Lookyloo?

Web page capture and forensic investigation tool - lookyloo.eu

· 2 days ago

SOC and threat intel teams get a free, well-regarded URL forensics tool worth running. Everyone else gets nothing here; use urlscan.io or a link checker instead.

Confidence

Medium. Based on 20 usable public sources. Unrelated Looky-Loo books, films, and apps were excluded.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support quality
  • Security posture

Pricing

Free

Open source and public instance

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes

Best for

  • SOC and phishing triage teams
  • Threat intel and OSINT analysts
  • MISP-connected CERTs
  • Self-hosters wanting private URL capture

Not for

  • Non-technical staff checking one suspicious link
  • Buyers who need vendor support and SLAs
  • Web scraping and data extraction teams
  • Teams that skip patching; old installs carry known CVEs

Gotchas - check before you buy

high

Only the latest release gets security fixes; old self-hosted installs stay exposed.

high

A researcher found SSRF and local file read in the PlaywrightCapture component; update fast.

medium

A denial-of-service flaw existed because capture limits were not enforced.

medium

Free means no vendor SLA; CIRCL runs it as a side project.

Pros and cons

Pros

  • Free and open source with a public CIRCL instance.
  • Captures a webpage and maps every request in a tree.
  • API lets teams submit and query captures programmatically.
  • Listed among top free OSINT tools by practitioners.
  • Integrates with MISP and StrangeBee's TheHive ecosystem.

Cons

  • Five CVEs disclosed in 2025 and 2026, including XSS and SSRF.
  • Maintainers support only the latest version.
  • Self-hosting needs an extra capture proxy bundle.
  • Built for investigators, not casual link checking.

Sources & method

- 12 sources - Five CVEs disclosed between 2025 and 2026 (two XSS, one denial of service, one SSRF, one input validation). No security page on lookyloo.eu.

official x6review x1security x4news x1
  • CVE-2025-66458: XSS vulnerability, Cross-site scripting flaw in Lookyloo.
  • CVE-2025-66459: XSS vulnerability, Cross-site scripting flaw disclosed December 2, 2025.
  • CVE-2025-66460, CVE record flags improper input handling in Lookyloo.
  • CVE-2026-66913: Denial of service, Lookyloo did not enforce limits on captures.
  • CVE-2026-85242: SSRF in PlaywrightCapture, Server-side request forgery in the capture component.

Key stats

  • Value for money: 5/5

    Rating

  • Free

    Starting price

  • 12

    Sources

  • Analyzed

  • Value for money: 5/5. Free, open source, usable public instance.
  • Ease of use: 4/5. SANS demos quick investigations on the public site.
  • Feature depth: 4/5. Full capture trees, API, MISP and TheHive integrations.
  • Support quality: 2/5. Community project, latest release supported only.
  • Security posture: 2/5. Five recent CVEs, including XSS and SSRF.
  • Free Price Open source, public CIRCL instance
  • Yes Free tier Public instance plus self-hosting
  • 2018 Public since SANS ISC diary coverage
  • 5 Known CVEs Disclosed 2025 to 2026

Pricing

Open source and public instance

Free

  • Public captures at lookyloo.circl.lu
  • Self-host from GitHub source
  • API access included

Security

Five CVEs disclosed between 2025 and 2026 (two XSS, one denial of service, one SSRF, one input validation).

  • CVE-2025-66458: XSS vulnerabilityCross-site scripting flaw in Lookyloo.
  • CVE-2025-66459: XSS vulnerabilityCross-site scripting flaw disclosed December 2, 2025.

No security page on lookyloo.eu.

  • CVE-2025-66460CVE record flags improper input handling in Lookyloo.
  • CVE-2026-66913: Denial of serviceLookyloo did not enforce limits on captures.⁵
  • CVE-2026-85242: SSRF in PlaywrightCaptureServer-side request forgery in the capture component.⁷

What users say

Practitioners rank Lookyloo among top free OSINT tools and note steady development.

“CIRCL's Lookyloo – https://lookyloo.circl.lu/”
Reddit, r/cybersecurity
“Lookyloo continues to evolve”
LinkedIn, Jimmy C.

Companies that use it

  • CIRCL
  • StrangeBee⁹
Full analysis

Based on 20 usable public sources. Unrelated Looky-Loo books, films, and apps were excluded.

Free open source URL forensics for security analysts. Five recent CVEs demand patching. Non-analysts: use urlscan.io.

Methodology

Based on 20 usable public sources. Unrelated Looky-Loo books, films, and apps were excluded.

Read how a report is made.

Sources

  1. Top 15 web based OSINT tools (free) : r/cybersecurityreddit.com
    review
  2. PyLookyloo documentationpylookyloo.readthedocs.io
    official
  3. Lookyloo APIlookyloo.circl.lu
    official
  4. Quickly Investigating Websites with Lookyloo (SANS ISC)isc.sans.edu
    news
  5. CVE-2026-66913 Detail (NVD)nvd.nist.gov
    security
  6. CVE-2025-66459 XSS (SentinelOne)sentinelone.com
    security
  7. CVE-2026-85242 SSRF (Rapid7)rapid7.com
    security
  8. Lookyloo GitHub security policygithub.com
    official
  9. Lookyloo integration at StrangeBeestrangebee.com
    official
  10. Alternatives to Lookyloo (official docs)lookyloo.eu
    official
  11. CIRCL urlabuse service pagecircl.lu
    official
  12. File read and SSRF in PlaywrightCapture (jeroengui.be)jeroengui.be
    security

Add this review to your site

Lookyloo earned a Worth it check.

Put the badge on your site, pricing page, or docs.

Visitors see an independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Worth it Lookyloo Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.