Domain / DNS
Domain, host, certificate, IP, and website footprint checks.
OSINT4ALL tool directory
Search OSINT tools by investigation task.
Search the OSINT tools directory by evidence type, access model, pricing, and verification needs so you can choose faster and document the limits.
Filter tools Search, category, pricing, and verification
Editorial standards
Use the data. Keep the judgment.
- Fit and limits stay visible.
- Commercial context cannot buy placement.
- Corrections are reviewed.
Directory workflow
Start broad. Leave with a shortlist.
Search by job
Start with the task, source type, signal, or tool name.
Narrow fit
Use category, pricing, access, and verification filters.
Pin candidates
Build a browser-only shortlist while browsing profiles.
Check context
Read caveats and disclosure before visiting the tool.
Start by job
Common investigation lanes
Pick a lane when the evidence type is clear and you need a faster shortlist.
Threat triage
Suspicious URLs, files, IPs, breach signals, and reputation checks.
Company research
Registries, filings, public records, and corporate footprint checks.
People & social
Handles, people, public topics, mentions, and media narratives.
Maps / geolocation
Place names, imagery, satellite, map, and sunlight checks.
Archives
Preserve pages, recover deleted sources, and document timelines.
Official-page screenshot
Knownsec
Internet asset search and exposure intelligence
Verification: Editorial review
Workflow: Discovery
Pricing: Freemium
Best for: Use it when a scoped host, service, product, or organization needs additional exposure context beyond Shodan or Censys.
Editorial
ZoomEye
Internet asset search and exposure intelligence
Editorial
Official-page screenshot
Netlas
Internet asset and attack-surface search
Verification: Editorial review
Workflow: Discovery
Pricing: Freemium
Best for: Use it when infrastructure research needs another structured lens on internet-exposed assets and certificates.
Editorial
Netlas.io
Internet asset and attack-surface search
Editorial
Official-page screenshot
BinaryEdge
Internet scanning and risk intelligence
Verification: Editorial review
Workflow: Enrichment
Pricing: Paid
Best for: Use it when a security workflow needs another passive dataset for exposed-service and infrastructure context.
Editorial
BinaryEdge
Internet scanning and risk intelligence
Editorial
Repository screenshot
ninoseki
Browser extension for quick IOC and threat-intelligence pivots
Verification: Pending Verification
Workflow: Enrichment, Pivoting
Pricing: Free
Best for: Pivoting from domains, IPs, URLs, hashes, and CVEs into reputation and threat-intelligence sources during triage.
Editorial
Mitaka
Browser extension for quick IOC and threat-intelligence pivots
Editorial
Repository screenshot
laramies
Open-source passive reconnaissance for domains, subdomains, hosts, and emails
Verification: Pending Verification
Workflow: Discovery, Enrichment
Pricing: Free
Best for: Collecting first-pass public leads around an organization's domains, hosts, and exposed contact patterns.
Editorial
theHarvester
Open-source passive reconnaissance for domains, subdomains, hosts, and emails
Editorial
Repository screenshot
ElevenPaths
Open-source document metadata analysis for OSINT and exposure review
Verification: Pending Verification
Workflow: Discovery, Enrichment
Pricing: Free
Best for: Inspecting public document metadata for usernames, software clues, paths, and organization context during authorized research.
Editorial
FOCA
Open-source document metadata analysis for OSINT and exposure review
Editorial
Repository screenshot
lanmaster53
Open-source modular reconnaissance framework for technical OSINT
Verification: Pending Verification
Workflow: Discovery, Enrichment
Pricing: Free
Best for: Technical analysts who need repeatable passive reconnaissance and enrichment around domains, organizations, contacts, or infrastructure leads.
Editorial
Recon-ng
Open-source modular reconnaissance framework for technical OSINT
Editorial
Official-page screenshot
Wappalyzer
Passive website technology fingerprinting
Verification: Editorial review
Workflow: Enrichment
Pricing: Freemium
Best for: Passive website technology fingerprinting, technographic enrichment, and first-pass context around public domains before deeper web or infrastructure research.
Editorial
Wappalyzer
Passive website technology fingerprinting
Editorial
Official-page screenshot
urlscan GmbH
URL render, screenshot, and network trace capture
Verification: Editorial review
Workflow: Verification
Pricing: Freemium
Best for: Capturing a URL render, screenshot, DOM/network trace, redirects, loaded resources, and visible page behavior during phishing, web-evidence, or…
Editorial
urlscan.io
URL render, screenshot, and network trace capture
Editorial
Official-page screenshot
Shodan
Public-internet exposure search for hosts and services
Verification: Editorial review
Workflow: Discovery
Pricing: Freemium
Best for: Fast first-pass checks on scoped IPs, hosts, ASNs, organizations, exposed services, ports, banners, screenshots, and technology fingerprints.
Tested
Shodan
Public-internet exposure search for hosts and services
Tested
Official-page screenshot
Censys
Censys Platform search for hosts, web properties, and certificates
Verification: Editorial review
Workflow: Pivoting
Pricing: Freemium
Best for: Certificate-led, host-led, and web-property infrastructure mapping from a scoped technical clue.
Editorial
Censys
Censys Platform search for hosts, web properties, and certificates
Editorial
Continue the investigation