Domain / DNS
Domain, host, certificate, IP, and website footprint checks.
OSINT4ALL tool directory
Search OSINT tools by investigation task.
Search the OSINT tools directory by evidence type, access model, pricing, and verification needs so you can choose faster and document the limits.
Filter tools Search, category, pricing, and verification
Editorial standards
Use the data. Keep the judgment.
- Fit and limits stay visible.
- Commercial context cannot buy placement.
- Corrections are reviewed.
Directory workflow
Start broad. Leave with a shortlist.
Search by job
Start with the task, source type, signal, or tool name.
Narrow fit
Use category, pricing, access, and verification filters.
Pin candidates
Build a browser-only shortlist while browsing profiles.
Check context
Read caveats and disclosure before visiting the tool.
Start by job
Common investigation lanes
Pick a lane when the evidence type is clear and you need a faster shortlist.
Threat triage
Suspicious URLs, files, IPs, breach signals, and reputation checks.
Company research
Registries, filings, public records, and corporate footprint checks.
People & social
Handles, people, public topics, mentions, and media narratives.
Maps / geolocation
Place names, imagery, satellite, map, and sunlight checks.
Archives
Preserve pages, recover deleted sources, and document timelines.
Editorial proof card
Validin
Explore historical domain and internet infrastructure observations
Verification: Pending Verification
Workflow: Discovery, Pivoting, Verification
Pricing: Freemium
Best for: Comparing DNS, certificates and host-related context across an investigation timeline.
Editorial
Validin
Explore historical domain and internet infrastructure observations
Editorial
Official-page screenshot
Osintly SAS
Multi-module OSINT search and investigation workspace
Verification: Pending Verification
Workflow: Discovery, Enrichment, Pivoting
Pricing: Freemium
Best for: Broad first-pass research across usernames, emails, phone numbers, domains, IP addresses, companies, and cryptocurrency identifiers in one workspace.
Submitted
Osintly
Multi-module OSINT search and investigation workspace
Submitted
Official-page screenshot
Pulsedive
Community threat-intelligence search and indicator enrichment
Verification: Pending Verification
Workflow: Triage, Verification
Pricing: Freemium
Best for: Enriching domains, IPs, URLs, and indicators with reputation, community threat-intelligence context, and linked observables during triage.
Editorial
Pulsedive
Community threat-intelligence search and indicator enrichment
Editorial
Official-page screenshot
ANY.RUN
Interactive threat-analysis sandbox
Verification: Verification status not listed
Workflow: Verification
Pricing: Freemium
Best for: Use it when an authorized suspicious sample or URL needs behavioral analysis and visual triage.
Editorial
ANY.RUN
Interactive threat-analysis sandbox
Editorial
Official-page screenshot
CrowdStrike
Malware-analysis report community
Verification: Verification status not listed
Workflow: Verification
Pricing: Freemium
Best for: Use it when a suspicious hash, file, or URL needs malware-analysis context while respecting evidence-sharing limits.
Editorial
Hybrid Analysis
Malware-analysis report community
Editorial
Official-page screenshot
LevelBlue / AlienVault
Open threat-intelligence community pulses
Verification: Verification status not listed
Workflow: Enrichment
Pricing: Free
Best for: Use it when an indicator needs community threat-intelligence context and related indicators.
Editorial
AlienVault OTX
Open threat-intelligence community pulses
Editorial
Official-page screenshot
Cisco Talos
IP, domain, and email reputation intelligence
Verification: Verification status not listed
Workflow: Enrichment
Pricing: Free
Best for: Use it when an indicator needs reputation or sender context from a major threat-intelligence provider.
Editorial
Cisco Talos Intelligence
IP, domain, and email reputation intelligence
Editorial
Editorial proof card
OpenDNS / Cisco
Community phishing URL verification
Verification: Verification status not listed
Workflow: Verification
Pricing: Free
Best for: Use it when a suspicious URL needs phishing-report context before broader URL or infrastructure triage.
Editorial
PhishTank
Community phishing URL verification
Editorial
Official-page screenshot
BinaryEdge
Internet scanning and risk intelligence
Verification: Verification status not listed
Workflow: Enrichment
Pricing: Paid
Best for: Use it when a security workflow needs another passive dataset for exposed-service and infrastructure context.
Editorial
BinaryEdge
Internet scanning and risk intelligence
Editorial
Official-page screenshot
DNSlytics
Reverse analytics, DNS, and domain intelligence
Verification: Verification status not listed
Workflow: Enrichment, Pivoting
Pricing: Freemium
Best for: Use it when a website or domain needs passive pivots through analytics IDs, ad IDs, DNS clues, or…
Editorial
DNSlytics
Reverse analytics, DNS, and domain intelligence
Editorial
Continue the investigation