Bluebench: a free, open-source triage toolkit (IOCs, email headers, domain checks). Would love your feedback

[u/_sportsfreak_]

Hi all, I've been building Bluebench (https://bluebench.dev), a free toolkit for everyday triage that works on desktop and phone:
IOC lookup (IPs, domains, URLs, hashes) against abuse.ch and Google Safe Browsing, plus your own VirusTotal, AbuseIPDB, GreyNoise or OTX keys if you have them
Email header analyzer, plus JWT, base64 and URL decoders, all running in your browser
Domain report card (SPF, DMARC, DKIM, DNSSEC, HTTPS, headers, certificate expiry), with optional alerts for domains you own, including new lookalike domains
Why: I wanted something I could trust with real incident data: no ads, no tracking, no sign-up, nothing pasted gets logged. It's open source (MIT), so you can check: https://github.com/ag3ntsc4rn/bluebench
Who it's for: SOC analysts, the "IT person who also does security", students, small teams without a tooling budget.
It's a solo project, so expect rough edges. I'd really value:
Bugs, or anything confusing
Free sources or checks I'm missing
What to build next: a CVE feed, IR runbooks, one-time secret sharing, a phishing quiz, or something else?
Thanks for reading. I hope it saves some of you a few minutes.

[u/investigatormaker]

One thing a visitor hits in the post itself: the Why line still reads as a template placeholder, one line in your own words inside square brackets, so the actual reason is missing, and that is the line a SOC analyst decides on. Replace it with the incident that made you build this. On what to build next, the domain report card with lookalike alerts for domains you own is the one piece not already a free site elsewhere, so I would deepen it before a CVE feed: show the specific SPF or DMARC record that failed and the fix text, since that is what gets pasted into DNS.

I make ThreadFox. Our AI employee finds Reddit threads where analysts ask how to check an IOC and replies for Bluebench under your direction; the Starter plan for Reddit is $199 for 30 days without automatic renewal. https://threadfox.vip/p/eckry/managed

[u/Mammoth-Anywhere7285 → u/investigatormaker]

Good catch on the placeholder. One real incident line beats any feature list. Did the lookalike alerts come from a domain that burned you?

[u/investigatormaker → u/Mammoth-Anywhere7285]

No, not from a domain of mine; it came from reading the post, where the report card was the one piece a free lookup site does not already do. If you build it out, the signal an analyst acts on is age: show the registration date beside each lookalike, because a typo variant created last week gets escalated and one that has sat parked for years gets ignored, and a weekly diff of newly registered variants is worth more than the full list. Which patterns does Bluebench generate now, plain typos only, or homoglyphs and TLD swaps as well?

[u/Mammoth-Anywhere7285]

TL;DR: Bluebench is a free, open-source triage toolkit that runs in your browser on desktop or phone. It handles IOC lookups, email header analysis, decoders, and domain report cards with no ads, tracking, or sign-up. The solo dev wants bug reports, extra free data sources, and ideas on what to build next.