The Bellingcat Online Investigation Toolkit: What's In It and How to Use It
A breakdown of the Bellingcat Online Investigation Toolkit — the tools serious investigators actually use, with reviews of the paid options worth your budget.
Bellingcat's Online Investigation Toolkit
The Bellingcat Online Investigation Toolkit reflects the tools that Bellingcat's team and network have found indispensable in their investigations. From tracking MH17 to geolocating war crimes footage, their work sets a high standard for open-source investigations. The toolkit is a living document that's been crowdsourced and refined over time.
Toolkit Overview
The toolkit's strength lies in its functional categorization of over 100 tools. Each tool is vetted by investigators who have used them in real-world cases. The toolkit provides a straightforward rundown of what works, covering areas such as identity and people search, imagery and geolocation.
Identity and People Search
Epieos is a useful tool for finding associated accounts, profile photos, and names. It queries Google and other services using an email address. The free version returns basic results, while the paid plan adds phone lookup and deeper data. OSINT Industries offers a service that runs an email or phone against 200+ platforms simultaneously, returning confirmed registrations with confidence levels. Breach databases like DeHashed index billions of breach records, allowing searches by email, username, name, IP, or password hash. A subscription to DeHashed is reasonably priced. It can be paired with manual checks against HaveIBeenPwned for broader coverage. Epieos, OSINT Industries, and DeHashed are valuable tools.
Imagery and Geolocation
PimEyes offers reverse image search for faces. Upload a photo, and PimEyes returns web pages where that face appears. A paid plan is needed to see URLs. Yandex Reverse Image Search consistently outperforms Google Images for matching faces and locating original sources. Google Earth Pro and Sentinel Hub provide free satellite imagery access. Sentinel Hub offers Copernicus satellite imagery with temporal filtering, useful for confirming when something appeared or changed. PimEyes, Yandex Reverse Image Search, Google Earth Pro, and Sentinel Hub are useful tools.
Flight and Maritime Tracking
Flightradar24 and FlightAware track aircraft and vessels in real-time. Flightradar24's free tier shows live positions with a delay. Paid plans add history and playback. MarineTraffic tracks commercial shipping, private yachts, and naval vessels. This is essential for maritime investigations. Flightradar24, FlightAware, and MarineTraffic are valuable resources.
Domains and Infrastructure
DomainTools offers WHOIS history and reverse IP lookup. Shodan indexes internet-facing devices and services, returning open ports and software versions. A membership is necessary for real investigative use. DomainTools and Shodan are useful tools.
Archiving and Evidence Capture
Hunchly is a Chrome extension that captures every page you visit, creating a verifiable evidence trail. The Wayback Machine checks whether a page was archived before it was deleted. This is essential for investigations. Hunchly and the Wayback Machine are essential tools.
For social media analysis, tools like Maltego and Skopenow help surface deleted content, map networks, and search social data. Maltego's graph-based mapping shines in complex cases. The free Community Edition is limited. Commercial tiers are pricey.
The Bellingcat toolkit at toolkit.bellingcat.com is searchable by category. You start with your investigation type, check for a free tier, and verify paid levels.
The toolkit is invaluable but doesn't rank or compare tools. Updates can be rare. Osintbench adds value with tier breakdowns, user assessments, and comparisons to cheaper alternatives. Bellingcat serves as a starting point. Osintbench helps build a toolkit that's right for your needs and budget.
You find the right tools, you save money. That's it.
Further reading:
Related Guides
Best OSINT Newsletters: Staying Current in Open Source Intelligence
The newsletters worth subscribing to if you want to stay current on OSINT techniques, tools, and investigations — from practitioner-focused weeklies to threat intelligence briefings.
Business and Corporate OSINT: Corporate Structures, Shell Companies, and Directors
Business and corporate OSINT is the process of moving from a company name to a defensible picture of directors, ownership, subsidiaries, and related entities using registry records and filings. Its value is not just finding a company entry, but linking official records across jurisdictions so control patterns, shell-company indicators, and real-world activity can be assessed without drifting into speculation.
Corporate and Financial OSINT: Investigating Companies, Ownership, and Money Flows
How to investigate corporations, beneficial ownership, financial relationships, and asset structures using open source tools — from SEC filings to corporate registry searches.
Last updated 2026-04-02. Techniques and tools change — verify current capabilities with vendors directly.