OSINT tools directory

Retired standalone internet-exposure service

Best for: Interpreting historical BinaryEdge observations and replacing retired account or API workflows with a currently available source.

Internet asset and attack-surface search

Best for: Use it when infrastructure research needs another structured lens on internet-exposed assets and certificates.

Internet asset search and exposure intelligence

Best for: Use it when a scoped host, service, product, or organization needs additional exposure context beyond Shodan or Censys.

Browser extension for quick IOC and threat-intelligence pivots

Best for: Pivoting from domains, IPs, URLs, hashes, and CVEs into reputation and threat-intelligence sources during triage.

Open-source passive reconnaissance for domains, subdomains, hosts, and emails

Best for: Collecting first-pass public leads around an organization's domains, hosts, and exposed contact patterns.

Open-source document metadata analysis for OSINT and exposure review

Best for: Inspecting public document metadata for usernames, software clues, paths, and organization context during authorized research.

Open-source modular reconnaissance framework for technical OSINT

Best for: Technical analysts who need repeatable passive reconnaissance and enrichment around domains, organizations, contacts, or infrastructure leads.

Passive website technology fingerprinting

Best for: Passive website technology fingerprinting, technographic enrichment, and first-pass context around public domains before deeper web or infrastructure research.

URL render, screenshot, and network trace capture

Best for: Capturing a URL render, screenshot, DOM/network trace, redirects, loaded resources, and visible page behavior during phishing, web-evidence, or…

Censys Platform search for hosts, web properties, and certificates

Best for: Certificate-led, host-led, and web-property infrastructure mapping from a scoped technical clue.

Public-internet exposure search for hosts and services

Best for: Fast first-pass checks on scoped IPs, hosts, ASNs, organizations, exposed services, ports, banners, screenshots, and technology fingerprints.