OSINT Practitioners

Open-source email registration checker for public account-signal triage

Best for: Checking whether an email address may have public account-registration or account-recovery signals during authorized people or exposure research.

Open-source modular reconnaissance framework for technical OSINT

Best for: Technical analysts who need repeatable passive reconnaissance and enrichment around domains, organizations, contacts, or infrastructure leads.

Passive website technology fingerprinting

Best for: Passive website technology fingerprinting, technographic enrichment, and first-pass context around public domains before deeper web or infrastructure research.

Open-source username discovery

Best for: Finding public account leads from a known username, handle, or alias during people research, source vetting, or identity-corroboration…

Automatic web-capture and case-notes tool for online investigations

Best for: Preserving visited web pages, notes, and case context while an online investigation is still active.

Local metadata extraction for files and media

Best for: Reading, comparing, exporting, and cleaning metadata from local image, video, audio, PDF, and document files during verification workflows.

Censys Platform search for hosts, web properties, and certificates

Best for: Certificate-led, host-led, and web-property infrastructure mapping from a scoped technical clue.

DNS history and domain intelligence for scoped investigations

Best for: Historical DNS, subdomain, IP, nameserver, and registration-adjacent context around domains already in scope.