Domain / DNS
Domain, host, certificate, IP, and website footprint checks.
OSINT4ALL tool directory
Search OSINT tools by investigation task.
Search the OSINT tools directory by evidence type, access model, pricing, and verification needs so you can choose faster and document the limits.
Filter tools Search, category, pricing, and verification
Editorial standards
Use the data. Keep the judgment.
- Fit and limits stay visible.
- Commercial context cannot buy placement.
- Corrections are reviewed.
Directory workflow
Start broad. Leave with a shortlist.
Search by job
Start with the task, source type, signal, or tool name.
Narrow fit
Use category, pricing, access, and verification filters.
Pin candidates
Build a browser-only shortlist while browsing profiles.
Check context
Read caveats and disclosure before visiting the tool.
Start by job
Common investigation lanes
Pick a lane when the evidence type is clear and you need a faster shortlist.
Threat triage
Suspicious URLs, files, IPs, breach signals, and reputation checks.
Company research
Registries, filings, public records, and corporate footprint checks.
People & social
Handles, people, public topics, mentions, and media narratives.
Maps / geolocation
Place names, imagery, satellite, map, and sunlight checks.
Archives
Preserve pages, recover deleted sources, and document timelines.
Editorial proof card
AbuseIPDB
IP abuse-report and reputation lookup service
Verification: Pending Verification
Workflow: Enrichment, Verification
Pricing: Freemium
Best for: Checking suspicious IP addresses against public abuse reports during security, exposure, and infrastructure triage.
Editorial
AbuseIPDB
IP abuse-report and reputation lookup service
Editorial
Official-page screenshot
EmailRep.io
Email reputation lookup for risk and identity-signal triage
Verification: Pending Verification
Workflow: Enrichment, Verification
Pricing: Freemium
Best for: Adding email reputation context to fraud, breach, contact-vetting, and people-research triage.
Editorial
EmailRep.io
Email reputation lookup for risk and identity-signal triage
Editorial
Official-page screenshot
Mapillary
Street-level imagery platform for geolocation and scene context
Verification: Pending Verification
Workflow: Mapping, Verification
Pricing: Free
Best for: Corroborating roads, storefronts, landmarks, signage, and local scene context in geolocation workflows.
Editorial
Mapillary
Street-level imagery platform for geolocation and scene context
Editorial
Official-page screenshot
DomainTools
Commercial domain intelligence for WHOIS history and DNS pivots
Verification: Pending Verification
Workflow: Enrichment, Pivoting
Pricing: Freemium, Paid
Best for: Investigating domains, ownership history, DNS relationships, and infrastructure context around suspicious or important web properties.
Editorial
DomainTools
Commercial domain intelligence for WHOIS history and DNS pivots
Editorial
Official-page screenshot
BuiltWith
Website technology and competitor-footprint profiling
Verification: Verification status not listed
Workflow: Enrichment
Pricing: Freemium
Best for: Website technology profiling, historical stack checks, commercial due diligence, competitor research, and domain-context enrichment.
Editorial
BuiltWith
Website technology and competitor-footprint profiling
Editorial
Official-page screenshot
Wappalyzer
Passive website technology fingerprinting
Verification: Verification status not listed
Workflow: Enrichment
Pricing: Freemium
Best for: Passive website technology fingerprinting, technographic enrichment, and first-pass context around public domains before deeper web or infrastructure research.
Editorial
Wappalyzer
Passive website technology fingerprinting
Editorial
Official-page screenshot
Hudson Rock
Infostealer exposure intelligence
Verification: Verification status not listed
Workflow: Monitoring
Pricing: Paid
Best for: Infostealer-exposure checks around company domains, employee accounts, usernames, third-party risk, and defensive credential-risk triage.
Editorial
Hudson Rock Exposure Intelligence
Infostealer exposure intelligence
Editorial
Official-page screenshot
Hunter
Email pattern and verification
Verification: Verification status not listed
Workflow: Verification
Pricing: Freemium
Best for: Professional email discovery, domain search, email verification, and company-linked contact checks around an organization already in scope.
Editorial
Hunter
Email pattern and verification
Editorial
Editorial proof card
Microsoft / RiskIQ
Legacy PassiveTotal context and Microsoft threat intelligence
Verification: Verification status not listed
Workflow: Pivoting
Pricing: Enterprise
Best for: Understanding legacy PassiveTotal-style passive-DNS, certificate, WHOIS, tracker, reputation, and infrastructure pivots inside current Microsoft threat-intelligence context.
Editorial
RiskIQ PassiveTotal
Legacy PassiveTotal context and Microsoft threat intelligence
Editorial
Official-page screenshot
Censys
Censys Platform search for hosts, web properties, and certificates
Verification: Verification status not listed
Workflow: Pivoting
Pricing: Freemium
Best for: Certificate-led, host-led, and web-property infrastructure mapping from a scoped technical clue.
Editorial
Censys
Censys Platform search for hosts, web properties, and certificates
Editorial
Official-page screenshot
Intelligence X
Sensitive-source and archive search context
Verification: Verification status not listed
Workflow: Discovery
Pricing: Paid
Best for: Selector-based search across archived, public-web, leak-adjacent, WHOIS, DNS, dark-web-adjacent, and document datasets when the identifier is already in…
Editorial
Intelligence X
Sensitive-source and archive search context
Editorial
Official-page screenshot
SecurityTrails / Recorded Future
DNS history and domain intelligence for scoped investigations
Verification: Verification status not listed
Workflow: Enrichment
Pricing: Paid
Best for: Historical DNS, subdomain, IP, nameserver, and registration-adjacent context around domains already in scope.
Editorial
SecurityTrails
DNS history and domain intelligence for scoped investigations
Editorial
Official-page screenshot
Shodan
Public-internet exposure search for hosts and services
Verification: Verification status not listed
Workflow: Discovery
Pricing: Freemium
Best for: Fast first-pass checks on scoped IPs, hosts, ASNs, organizations, exposed services, ports, banners, screenshots, and technology fingerprints.
Tested
Shodan
Public-internet exposure search for hosts and services
Tested
Continue the investigation