Search OSINT tools by investigation task.

Attack-surface discovery and domain intelligence platform

Best for: Expanding a scoped domain or organization into public assets, technologies, services, and exposure clues before validation.

Internet asset search and exposure intelligence

Best for: Use it when a scoped host, service, product, or organization needs additional exposure context beyond Shodan or Censys.

Internet asset and attack-surface search

Best for: Use it when infrastructure research needs another structured lens on internet-exposed assets and certificates.

Cyberspace asset mapping and search

Best for: Use it when a scoped technical clue needs another asset-search dataset, especially for product or service fingerprinting.

Internet scanning and risk intelligence

Best for: Use it when a security workflow needs another passive dataset for exposed-service and infrastructure context.

Browser extension for quick IOC and threat-intelligence pivots

Best for: Pivoting from domains, IPs, URLs, hashes, and CVEs into reputation and threat-intelligence sources during triage.

Open-source passive reconnaissance for domains, subdomains, hosts, and emails

Best for: Collecting first-pass public leads around an organization's domains, hosts, and exposed contact patterns.

Open-source network mapper for authorized exposure and service discovery

Best for: Authorized network inventory, service discovery, exposure validation, and defensive technical assessment.

Open-source document metadata analysis for OSINT and exposure review

Best for: Inspecting public document metadata for usernames, software clues, paths, and organization context during authorized research.

Open-source modular reconnaissance framework for technical OSINT

Best for: Technical analysts who need repeatable passive reconnaissance and enrichment around domains, organizations, contacts, or infrastructure leads.

Passive website technology fingerprinting

Best for: Passive website technology fingerprinting, technographic enrichment, and first-pass context around public domains before deeper web or infrastructure research.

URL render, screenshot, and network trace capture

Best for: Capturing a URL render, screenshot, DOM/network trace, redirects, loaded resources, and visible page behavior during phishing, web-evidence, or…

Public-internet exposure search for hosts and services

Best for: Fast first-pass checks on scoped IPs, hosts, ASNs, organizations, exposed services, ports, banners, and technology fingerprints.

Structured search for hosts, services, and certificates

Best for: Certificate-led and host-led infrastructure mapping from a scoped technical clue.