Domain / DNS
Domain, host, certificate, IP, and website footprint checks.
OSINT4ALL tool directory
Search OSINT tools by investigation task.
Search the OSINT tools directory by evidence type, access model, pricing, and verification needs so you can choose faster and document the limits.
Filter tools Search, category, pricing, and verification
Editorial standards
Use the data. Keep the judgment.
- Fit and limits stay visible.
- Commercial context cannot buy placement.
- Corrections are reviewed.
Directory workflow
Start broad. Leave with a shortlist.
Search by job
Start with the task, source type, signal, or tool name.
Narrow fit
Use category, pricing, access, and verification filters.
Pin candidates
Build a browser-only shortlist while browsing profiles.
Check context
Read caveats and disclosure before visiting the tool.
Start by job
Common investigation lanes
Pick a lane when the evidence type is clear and you need a faster shortlist.
Threat triage
Suspicious URLs, files, IPs, breach signals, and reputation checks.
Company research
Registries, filings, public records, and corporate footprint checks.
People & social
Handles, people, public topics, mentions, and media narratives.
Maps / geolocation
Place names, imagery, satellite, map, and sunlight checks.
Archives
Preserve pages, recover deleted sources, and document timelines.
Official-page screenshot
Hudson Rock
Infostealer exposure intelligence
Verification: Editorial review
Workflow: Monitoring
Pricing: Paid
Best for: Infostealer-exposure checks around company domains, employee accounts, usernames, third-party risk, and defensive credential-risk triage.
Affiliate
Hudson Rock Exposure Intelligence
Infostealer exposure intelligence
Affiliate
Official-page screenshot
HIBP
Breach exposure lookup for emails and domains
Verification: Editorial review
Workflow: Verification
Pricing: Free
Best for: Checking known breach, paste, password, domain, and supported stealer-log exposure in defensive account-security, credential-hygiene, and incident-response workflows.
Tested
Have I Been Pwned
Breach exposure lookup for emails and domains
Tested
Official-page screenshot
Intelligence X
Sensitive-source and archive search context
Verification: Editorial review
Workflow: Discovery
Pricing: Paid
Best for: Selector-based search across archived, public-web, leak-adjacent, WHOIS, DNS, dark-web-adjacent, and document datasets when the identifier is already in…
Editorial
Intelligence X
Sensitive-source and archive search context
Editorial
Official-page screenshot
Maltego
Link analysis and graphing for entity investigations
Verification: Editorial review
Workflow: Mapping
Pricing: Paid
Best for: Graph-led link analysis across entities such as domains, IPs, emails, people, companies, documents, social handles, and infrastructure clues.
Tested
Maltego
Link analysis and graphing for entity investigations
Tested
Official-page screenshot
SpiderFoot
Automated OSINT collection for scoped leads
Verification: Editorial review
Workflow: Enrichment
Pricing: Freemium
Best for: Authorized OSINT automation around domains, IPs, subnets, ASNs, emails, usernames, and organization exposure review.
Tested
SpiderFoot
Automated OSINT collection for scoped leads
Tested
Official-page screenshot
Sectigo
Free certificate-transparency lookup for domain pivots
Verification: Editorial review
Workflow: Discovery
Pricing: Free
Best for: Certificate-transparency pivots around domains, organizations, hostnames, SAN entries, fingerprints, and historical infrastructure naming patterns.
Editorial
crt.sh
Free certificate-transparency lookup for domain pivots
Editorial
Official-page screenshot
SecurityTrails / Recorded Future
DNS history and domain intelligence for scoped investigations
Verification: Editorial review
Workflow: Enrichment
Pricing: Paid
Best for: Historical DNS, subdomain, IP, nameserver, and registration-adjacent context around domains already in scope.
Editorial
SecurityTrails
DNS history and domain intelligence for scoped investigations
Editorial
Official-page screenshot
Censys
Censys Platform search for hosts, web properties, and certificates
Verification: Editorial review
Workflow: Pivoting
Pricing: Freemium
Best for: Certificate-led, host-led, and web-property infrastructure mapping from a scoped technical clue.
Editorial
Censys
Censys Platform search for hosts, web properties, and certificates
Editorial
Official-page screenshot
Shodan
Public-internet exposure search for hosts and services
Verification: Editorial review
Workflow: Discovery
Pricing: Freemium
Best for: Fast first-pass checks on scoped IPs, hosts, ASNs, organizations, exposed services, ports, banners, screenshots, and technology fingerprints.
Tested
Shodan
Public-internet exposure search for hosts and services
Tested
Continue the investigation