Search the OSINT tools directory.

Internet asset search and exposure intelligence

Best for: Use it when a scoped host, service, product, or organization needs additional exposure context beyond Shodan or Censys.

Reverse analytics, DNS, and domain intelligence

Best for: Use it when a website or domain needs passive pivots through analytics IDs, ad IDs, DNS clues, or…

Free web-based DNS and domain lookup tools

Best for: Use it when a domain investigation needs quick manual pivots across several lightweight DNS and hosting checks.

Domain, DNS, WHOIS, and threat intelligence APIs

Best for: Use it when domain research needs structured enrichment at scale rather than one manual lookup at a time.

DNS, email, and blacklist diagnostics

Best for: Use it when a domain or mail server needs quick deliverability, DNS, or blacklist context before deeper infrastructure…

Passive DNS and subdomain reconnaissance

Best for: Use it when a domain is already in scope and the next job is quick passive mapping before…

Claim and fact-check diffusion visualization for misinformation research

Best for: Visualizing how claims, rumors, and fact-checking content spread through public social-media signals.

Enterprise intelligence platform for multilingual risk and threat workflows

Best for: Enterprise teams evaluating commercial intelligence coverage for threat, identity, vendor-risk, or multilingual monitoring workflows.

Username and domain availability checker for quick handle triage

Best for: Checking whether a username, brand string, or domain idea appears available across common social platforms and domain extensions.

Open-source network mapper for authorized exposure and service discovery

Best for: Authorized network inventory, service discovery, exposure validation, and defensive technical assessment.

Street-level imagery platform for geolocation and scene context

Best for: Corroborating roads, storefronts, landmarks, signage, and local scene context in geolocation workflows.

U.S. campaign finance and lobbying research database

Best for: Researching U.S. political donations, lobbying records, PACs, industries, candidates, committees, and money-in-politics patterns.

Open-source passive reconnaissance for domains, subdomains, hosts, and emails

Best for: Collecting first-pass public leads around an organization's domains, hosts, and exposed contact patterns.

Browser extension for quick IOC and threat-intelligence pivots

Best for: Pivoting from domains, IPs, URLs, hashes, and CVEs into reputation and threat-intelligence sources during triage.

Open-source modular reconnaissance framework for technical OSINT

Best for: Technical analysts who need repeatable passive reconnaissance and enrichment around domains, organizations, contacts, or infrastructure leads.