OSINT Tool Reviews

Search engine for internet-connected devices — find exposed servers, industrial systems, and network infrastructure worldwide.

The standard $40 software-defined radio dongle for ADS-B aircraft tracking, AIS ship tracking, and weather satellite imagery.

Archive any web page — including JavaScript-rendered content — into a single self-contained HTML file that opens identically offline and can be cryptographically verified.

Free website scanner that captures full-page screenshots, network requests, and DOM snapshots for any URL

One command seeds a recursive scan that automatically enumerates subdomains, port-scans live hosts, screenshots web interfaces, and detects exposed secrets — without manual pipeline steps between each phase.

Award-winning antivirus and endpoint security suite with advanced threat detection for individuals and teams

The definitive open source tool for extracting hidden metadata from images, video, and documents.

The open-source SDR transceiver covering 1 MHz to 6 GHz — the standard platform for frequency scanning, signal analysis, and RF research.

A structured false-positive filtering layer that helps analysts stop treating common benign infrastructure as malicious indicators.

Hunt usernames across 400+ social networks simultaneously with no API keys or accounts required.

Multi-engine malware scanner and threat intelligence platform for files, URLs, IPs, and domains

Automated C2 IOC feeds that give SOC teams fast, ingestion-ready visibility into exposed attacker infrastructure.

A malware triage tool that quickly tells analysts what an executable is capable of doing and where those behaviors appear.

A modular enrichment engine that lets TheHive analysts analyze observables in place instead of pivoting across dozens of external CTI tools.

An enrichment and response engine that lets TheHive analysts analyze observables and trigger actions without leaving the case workflow.

A continuously updated phishing and scam domain feed that helps defenders block fraud infrastructure through DNS, hosts files, or API lookups.

The fastest way to confirm whether an email address appears in known data breaches — free, accurate, and maintained by a single researcher who vets every dataset.

A high-speed HTTP probing tool that turns raw host lists into triaged, fingerprinted web targets ready for investigation.

A structured cluster library that gives threat intelligence events actor, malware, and technique context instead of leaving them as unlabeled IOC collections.

An open source threat intelligence platform built for structured IOC management, community sharing, and fast operational distribution.

The RTL-SDR alternative with tighter frequency accuracy and a complete antenna bundle — better value than the V4 if you don't need shortwave.

Query OpenStreetMap with precision to surface infrastructure, facilities, and location patterns for geospatial investigations.

Fast passive subdomain enumeration that gives pentesters a clean starting point for external recon.

Map sun and moon geometry against real terrain to test whether a photo's claimed place and time make sense.

Map an organization's full external attack surface — ASNs, domains, subdomains, and infrastructure relationships — through 50+ integrated data sources and a persistent graph database.

A structured open skill library that gives AI agents concrete cybersecurity workflows mapped to ATT&CK, D3FEND, ATLAS, and NIST frameworks.

A massive, investigator-friendly directory for finding the right OSINT tools before you waste time using the wrong ones.

A live C2 infrastructure feed that helps defenders hunt, block, and correlate active command-and-control servers by framework type.

Passive certificate transparency searches uncover subdomains and related infrastructure before you ever touch the target.

27 parallel intelligence feeds, push alerts to your phone, and LLM-powered briefings on demand — self-hosted, no cloud dependency.

Telegram intelligence platform searching 175M+ posts across 2M+ channels for OSINT and influence operation research

889,000+ pre-built Google dorks with an AI dork builder for instant recon

Real-time and historical flight tracking via a global ADS-B receiver network

Build faster visual geolocation instincts by training on real-world imagery under repeatable, investigator-relevant conditions.

Automatic web capture and evidence management for OSINT investigators

A blue-team-first security directory that helps SOC and CTI teams find relevant feeds, rule sources, and detection references without wading through offensive tooling.

Store, correlate, and visualize structured threat intelligence using STIX2 as the native data model — with a 150+ connector ecosystem and graph-based investigation workflows designed for serious TI programs.

Navigate from target data type to relevant tools in seconds — an interactive tree that mirrors how investigators actually work, not how tools are alphabetically organized.

Search engine for digital footprint — email, phone, username across 200+ sources

Run subfinder, amass, httpx, naabu, and nuclei as configurable YAML pipelines across multiple targets — with a persistent database, screenshot gallery, and notification integrations managed through a web UI.

Find where an image originated, when it first appeared online, and every modified version that shares its visual fingerprint — without relying on metadata or keywords.

Paste a URL and get DNS records, SSL details, security headers, tech stack, WHOIS, and 100+ more domain intelligence checks in a single browser view — in under thirty seconds.

Correlated multi-domain intelligence across conflicts, maritime, aviation, infrastructure, finance, and climate on a single open source map surface.

Technology intelligence — find what any website is built with and who else uses it

A Claude Code CTI skill that gives analysts reusable investigation playbooks, faster triage structure, and report-ready workflow scaffolding without mandatory API setup.

A pocketable hardware research platform for mapping nearby wireless and access-control systems during field reconnaissance.

Pulls hidden GitHub identity clues into one workflow so investigators can pivot faster from a developer footprint.

A Python-based OSINT and forensics toolkit that can speed up small investigative lookups if you are comfortable working from a local CLI.

An email-first OSINT tool that helps investigators turn one address into a broader profile, timeline, and set of defensible leads.

Archive a complete Instagram profile — posts, stories, reels, metadata, and follower lists — to local storage before the subject deletes it.

Orchestrate IOC enrichment across 100+ threat intelligence sources through a single API — with automated multi-hop correlation and direct output to MISP, OpenCTI, or DFIR-IRIS.

Professional-grade RF bug detector covering 10 MHz to 6 GHz with digital and analog signal detection — the standard for corporate and professional sweep work.

Automates identity pivots across a wide source set, but only pays off if you can control the noise.

An open-source ASM platform that helps defenders turn scattered internet-facing assets into a trackable external inventory.

Correlates usernames, emails, aliases, and behavioral clues into a single investigative profile instead of stopping at surface-level account enumeration.

A recon orchestration engine that helps operators run complex attack surface discovery workflows with concurrency, dependencies, and structured output.

An open source orchestration layer that helps security teams run multiple analysis tools against tracked assets from one central platform.

A command-first offensive security reference that helps testers find the exact syntax they need during active engagements.

A maritime OSINT platform that helps investigators track vessels, review AIS behavior, and add sanctions context to geospatial shipping analysis.

End-to-end encrypted email under Swiss jurisdiction, designed so that Proton itself cannot read your messages.

Swiss-based VPN with open-source client and strong jurisdiction for journalists and investigators

A compact infosec reference repository that gives pentesters fast command lookups for Active Directory, bash, and common offensive workflows.

Batch-process geotagged images locally so you can sort, map, and sequence photo evidence faster after a breaking event.

An AI-assisted dark web investigation tool that helps analysts refine queries, reduce result noise, and summarize findings in one workflow.

An all-in-one recon tool that gives bug hunters a fast first-pass view of DNS, subdomains, ports, and web paths from one binary.

Pull public bug bounty scope data from one GitHub repository instead of checking every platform by hand.

A CLI-first orchestration layer that standardizes how pentest teams run, chain, and store results from their security toolchain.

An experimental privacy-framed OSINT project for analysts willing to verify routing and anonymity claims themselves.

A fast DNS brute-force and validation tool that cleans passive subdomain results and extends coverage with wildcard-aware active discovery.

A multi-source exploit lookup tool that helps pentesters check public exploit availability and Metasploit coverage from one query.

A trusted community YARA and IOC repository that gives DFIR teams immediate detection coverage for malware, webshells, and attacker tooling.

A username OSINT tool that helps investigators find profiles on CIS-region and Russian-language platforms global username checkers often miss.

A focused OSINT utility for turning public profile pages into structured identity clues fast.

Map a target's full digital footprint automatically — domains, IPs, emails, names, and ASNs across 500+ sources.

A GUI-based OSINT toolkit that lets investigators pivot across phone, IP, username, and domain lookups without juggling multiple separate tools.

Website security platform used by investigators to analyze site integrity, malware, and CDN infrastructure

A Sysmon companion toolkit that makes configuration safer and event review more visual for hunting and forensic analysis.

A self-hosted OSINT platform that helps threat intelligence teams turn noisy source monitoring into structured, reviewable reporting.

Practical OSINT training for investigators and security professionals

A bulk TCP stream reconstruction tool that turns packet captures into searchable application-layer conversations for faster forensic analysis.

A lightweight open-source tool for turning sparse identifiers into cross-platform social account leads.

A fleet-scale DFIR platform that helps investigators hunt, collect artifacts, and run live response across endpoints without imaging them one by one.

A lightweight way to pull website infrastructure, DNS, TLS, and fingerprinting checks into one fast first-pass recon view.

On-chain intelligence platform that deanonymizes blockchain addresses and maps crypto fund flows

A categorized DFIR directory that helps responders discover forensic, malware, and case-management tools with added adoption signals from GitHub metadata.

Real-time social media monitoring and brand intelligence for OSINT investigators

Internet-wide scanner with certificate transparency coverage no other tool matches.

A paste-and-submit IOC triage tool that extracts indicators from messy text and checks their reputation across multiple CTI services.

A web-focused internet asset search engine that helps analysts pivot from one exposed fingerprint to broader infrastructure quickly.

Find exposed cloud storage faster by searching indexed public S3 buckets and blob containers tied to real targets.

Infostealer intelligence platform exposing compromised credentials from malware-infected machines worldwide

Internet-wide scanner for exposed services and data leaks, with a focus on misconfigured databases and sensitive data exposure

A fast 403 bypass automation tool that turns forbidden content discovery results into systematically tested access-control edge cases.

Encrypted tunnel and threat protection for OSINT investigators working in hostile environments

An open source monitoring tool that helps defenders catch brand lookalike domains before phishing campaigns go live.

Crawl a target website once and walk away with internal URLs, email addresses, social media links, JavaScript files, and exposed secrets — all organized into separate files ready for downstream investigation.

A group-centric ransomware reference that helps defenders translate gang attribution into concrete tools, hunt leads, and detection priorities.

A full-scope domain recon framework that chains proven CLI tools into one repeatable workflow for broad attack surface discovery.

The leading threat intelligence platform for enterprise security teams

Social media intelligence and OSINT automation for law enforcement and enterprise

Real-time satellite tracking and space intelligence platform combining orbital data with geopolitical analysis

Search a username across 1000+ social networks with confidence-scored results and structured JSON output — a material step above binary found/not-found enumeration.

Enterprise OSINT platform with 500+ data sources and 1,700+ investigative methods for social media, dark web, and blockchain investigation

VPN with built-in identity monitoring and anonymous browsing identity tools

The OSINT browser extension that runs 200+ enrichments from any web page

Crowdsourced wireless network database mapping billions of Wi-Fi, Bluetooth, and cell networks globally

Sub-1 GHz wireless transceiver for 433/868 MHz IoT, key fob, and industrial protocol analysis — the dedicated tool for the RF bands that run smart devices.

The only major flight tracker that refuses to filter opt-out aircraft

A purpose-built ADS-B receiver with integrated filter and LNA — better 1090 MHz decode performance out of the box than any generic RTL-SDR dongle.

A curated DFIR resource directory that helps investigators find relevant forensic tools quickly when unfamiliar evidence types appear.

Global multilingual intelligence platform for government, law enforcement, and enterprise

A fast Go web crawler that plugs cleanly into recon pipelines to uncover endpoints, JavaScript URLs, and exposed secrets at scale.

A focused incident response tracking app that helps teams manage systems, artifacts, tasks, and timelines without relying on spreadsheets.

A Kali-native bash automation wrapper that speeds up standard recon, scanning, and payload generation without forcing you into a heavyweight framework.

Turn your Nmap and Masscan output into a persistent, queryable network intelligence database with Shodan-style query capabilities against your own infrastructure.

Three-in-one RF bug detector, GPS tracker finder, and hidden camera lens detector — the best all-in-one counter-surveillance device for investigators and travelers.

Mac software suite for system cleanup, file management, and operational hygiene

A rule-driven OSINT hunting engine that automates recurring infrastructure queries and alerts only on what is newly discovered.

Password manager with breach monitoring built for secure credential hygiene

A practical reference directory for finding, comparing, and operationalizing free IOC feeds across MISP, SIEM, and enrichment pipelines.

Community-driven threat intelligence platform with enriched IOC data and free analyst-grade lookups

Competitive intelligence and web footprint analysis for digital investigators

A centralized exploit search engine that helps analysts check public exploit availability across multiple sources in one place.

Telegram channel analytics platform covering 50+ million channels with growth data and content search

A single-binary Active Directory graph tool that helps operators find ACL-driven escalation paths without standing up a separate graph database.

A local-first AI document analysis platform that helps investigators extract entities and map relationships without exposing sensitive files to the cloud.

A free Android forensic utility that simplifies ADB-based extraction and app analysis for investigators without a commercial mobile suite.

A multi-language security tool collection that helps researchers study how offensive and analysis utilities are built across different ecosystems.

Consolidate criminal records, address history, and associate data on US subjects in a single report — with broader court record coverage than most consumer people-search competitors.

An academic bot-detection tool that helps analysts prioritize which Twitter/X accounts deserve closer manual review.

IP and domain scanner that scores addresses by malicious activity and maps CVEs to exposed service banners.

A structured reference of dark web and deep web CTI sources — ransomware tracking sites, IOC feeds, paste monitors, and threat actor Telegram channels — organized for feed coverage auditing.

A fast passive subdomain enumerator that adds built-in monitoring, history, and alerting for newly exposed assets.

AI-powered geolocation tool that identifies the location of photos from visual content alone

A search engine and permanent data archive that indexes dark web content, full breach records, historical WHOIS, and deleted documents — content that disappeared from the public web still lives here.

Username OSINT tool that checks 2,500+ sites, extracts profile data from hits, and automatically pivots to linked identifiers found in discovered accounts.

Internet scanning platform with 8 billion+ indexed IP addresses for attack surface and infrastructure analysis

Endpoint protection and threat detection for small OSINT teams and security firms

Autonomous AI investigation agent that resolves entities across corporate registries, campaign finance, lobbying disclosures, and government contracts — surfacing non-obvious connections with evidence citations.

End-to-end encrypted password manager with built-in email aliasing for investigators who need compartmentalized identities and Swiss-jurisdiction credential storage.

CLI-based web reconnaissance framework modeled after Metasploit

Curated Mac app subscription with several tools useful for investigators and security researchers

Passively harvest emails, subdomains, and hostnames from public sources before you touch a single target system.

Operationalize OSINT-sourced threat intelligence inside a managed XDR and SOC platform built for enterprise security teams.

A breach credential database with 14+ billion records, searchable by email, username, phone, IP, domain, and hash.

Delegate the multi-day work of data broker opt-outs to a service that repeats the process quarterly — so re-populated listings get caught, not just the first pass.

US commercial flight tracking with FAA data integration and a developer-friendly API

Budget VPN with wide server coverage for basic IP separation during investigations

A nickname-to-email discovery tool that helps investigators turn known handles into likely email addresses without contacting the subject.

A zero-configuration ASN and network scope discovery tool that helps hunters map organizational IP space without API setup.

A browser extension that turns highlighted indicators into instant OSINT and threat intelligence lookups without breaking analyst flow.

Certified secure disk wiping for investigators who need to sanitize devices before disposal or reuse

Validate, format, and enumerate phone numbers from public sources before you invest time in manual investigation.

Historical DNS and domain intelligence database covering 10+ years of infrastructure changes

Fraud detection and digital identity verification using OSINT-based enrichment

Consolidate address history, phone, email, and associate data on US subjects in a single report before you start working individual sources.

A fast browser-based sun and moon position tool for validating shadow, lighting, and timing hypotheses in geolocation work.

A Tor-routed OSINT crawler that helps analysts map .onion infrastructure, collect contact details, and preserve volatile dark web content.

TikTok analytics platform for account research, trend tracking, and content investigation

Reverse face search engine that finds where a face appears across social media and the public web

Internet noise classifier that separates mass-scanning background traffic from targeted activity so you can stop chasing ghosts in your SIEM.

Email address lookup and verification tool that searches publicly indexed sources for addresses associated with a domain

Real-time ship tracking via a global AIS receiver network — the default starting point for maritime OSINT

Cyber defense search engine indexing internet-wide scan data, threat intelligence feeds, and passive DNS

Facial recognition search engine that finds where a face appears across the web

Identity theft protection and dark web monitoring from Nord Security

End-to-end encrypted cloud storage under Swiss jurisdiction for investigators who can't trust iCloud or Google Drive with case files.

Run the same dork across multiple search engines and target site collections without rebuilding every query by hand.

Takes a username and checks whether an account exists on 500+ platforms via HTTP pattern matching — no login, no scraping, no cost.

Data recovery software for investigators recovering deleted files, drive evidence, and mobile data

Submits an email or phone number and returns linked social accounts, Google profile data, and carrier information without touching the target platforms directly.

The gold standard for visual link analysis and OSINT pivoting

Counter-surveillance and tactical equipment retailer carrying RF detectors, GPS tracker detectors, hidden camera finders, TSCM gear, and related hardware from multiple manufacturers.

Phrase and vocabulary training for 140+ languages, including obscure regional languages no other app covers.

Chinese-operated internet search engine for cyberspace — maps exposed services and devices globally

Free ADS-B flight tracking API with multi-year historical archive — the right tool when Flightradar24's history tier is too expensive.

Virtual US phone numbers with real carrier attribution, usable for account registration, covert contact, and operational separation.

AIS-based ship tracking that earns its place as a cross-reference tool — and occasionally the primary one

Queries Google's internal APIs from the command line to extract account metadata from a Gmail address — name, photo, linked services, Maps reviews, and more — for free.

People search and reverse lookup platform focused on online identity verification and catfish detection