Search the OSINT tools directory.

Public crypto scam and suspicious-address reporting database

Best for: Checking whether wallets, domains, scam narratives, or crypto abuse indicators have public reports or related community warnings.

Attack-surface discovery and domain intelligence platform

Best for: Expanding a scoped domain or organization into public assets, technologies, services, and exposure clues before validation.

Community threat-intelligence search and indicator enrichment

Best for: Enriching domains, IPs, URLs, and indicators with reputation, community threat-intelligence context, and linked observables during triage.

Ethereum blockchain explorer for public wallet and transaction research

Best for: Checking Ethereum addresses, transactions, token contracts, wallet activity, labels, and public on-chain evidence before deeper crypto investigation.

Malware-analysis report community

Best for: Use it when a suspicious hash, file, or URL needs malware-analysis context while respecting evidence-sharing limits.

Interactive threat-analysis sandbox

Best for: Use it when an authorized suspicious sample or URL needs behavioral analysis and visual triage.

Automated threat-analysis sandbox

Best for: Use it when a security team needs deeper sandbox reporting for an authorized suspicious sample.

IP, domain, and email reputation intelligence

Best for: Use it when an indicator needs reputation or sender context from a major threat-intelligence provider.

Open threat-intelligence community pulses

Best for: Use it when an indicator needs community threat-intelligence context and related indicators.

Open-source threat-intelligence sharing platform

Best for: Use it when a team needs controlled threat-intelligence sharing, correlation, and internal/private community workflows.

Browser-based data decoding and transformation

Best for: Use it when an analyst needs safe, repeatable transformations of indicators, logs, URLs, encodings, or extracted text.

Malware-URL intelligence reference

Best for: Use it when a URL or domain needs malware-distribution context and conservative threat corroboration.

Internet asset search and exposure intelligence

Best for: Use it when a scoped host, service, product, or organization needs additional exposure context beyond Shodan or Censys.

Cyber defense search engine and attack-surface data

Best for: Use it when a technical artifact needs passive cyber-intelligence enrichment and historical context.

Cyberspace asset mapping and search

Best for: Use it when a scoped technical clue needs another asset-search dataset, especially for product or service fingerprinting.

Internet scanning and risk intelligence

Best for: Use it when a security workflow needs another passive dataset for exposed-service and infrastructure context.

Enterprise intelligence platform for multilingual risk and threat workflows

Best for: Enterprise teams evaluating commercial intelligence coverage for threat, identity, vendor-risk, or multilingual monitoring workflows.