osint
Dark-web intelligence, structured. Free Dark Web OSINT Tool.
Turn research queries into collection, enrichment, relationship mapping, and export — in one workflow.
VoidAccess automates dark web OSINT investigations end to end — scraping Tor, clearnet sources, and paste sites, then extracting indicators and building a structured intelligence graph without a subscription or vendor lock-in.
Birdbrain is a local-first desktop app for capturing, organizing, and verifying web evidence.
Birdbrain is an open-source desktop app with a companion Chromium extension for capturing, organizing, and verifying web evidence. Captures include MHTML, a full-page screenshot, and extracted page text, sent to the desktop app over 127.0.0.1 and stored locally in per-case archives. Birdbrain has no cloud account and no telemetry; captures stay on your machine unless you export them.
CT Log Scanner
Gungnir is a command-line tool written in Go that continuously monitors certificate transparency (CT) logs for newly issued SSL/TLS certificates. Its primary purpose is to aid security researchers and penetration testers in discovering new domains and subdomains as soon as they are issued certificates, allowing for timely security testing.
Enumerate user accounts and registered authentication methods via the Microsoft Self-Service Password Reset (SSPR) portal.
Probe Microsoft's Self-Service Password Reset (SSPR) endpoint to enumerate registeted verification methods and flag any that lack a strong second factor. Provides user enumeration and an approximation of MFA posture across Entra accounts.
Check your IP reputation.
Check whether your public IP has been observed in a residential proxy network, and understand what to do next.
User Lookup, Trends & Archive Search.
Six tools built on the same infrastructure that powers THINKPOL: a 30B+ post archive with sub-300ms response times. Used by investigators, SOC teams and OSINT professionals worldwide.
OSINT recon through the Wayback Machine.
OSINT tool for researchers and professionals. Reveal what a domain has exposed over time (emails, subdomains, tech, leaks) from the Wayback Machine archive.
A project to rapidly extract all email addresses from any files in a given path.
Related contents:
Free email OSINT tool, 2500+ platforms, identity clustering, breach detection. No API keys required.
Self-hostable OSINT platform for investigating email addresses. Fan out across breach databases, social networks, DNS records, and the open web — get back a unified exposure score and structured findings you can export or pipe into Maltego.
live satellite positions + open telemetry.
A real-time control room for the ~23 cubesats currently broadcasting decodable open telemetry: their positions on a MapLibre globe, their batteries, temperatures and currents decoded locally from their actual radio frames, and the network of volunteer ground stations that heard them — self-hosted in Europe on one small server.
Related contents:
Interactive interface for browsing global, full-resolution satellite imagery.
A comprehensive 2026 guide to Open-Source Intelligence (OSINT): tools, methodologies, ethics, and techniques for responsible research and investigation.
🕵️♂️ Collect a dossier on a person by username from 3000+ sites.
Maigret collects a dossier on a person by username only, checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys required. AI profiling (demo).
Automated graph analysis & intelligence.
A modern platform for visual, flexible, and extensible graph-based investigations. For cybersecurity analysts and investigators.
Flowsint is an open-source OSINT graph exploration tool designed for ethical investigation, transparency, and verification.
🕵️♂️ (2-in-1) Email & Username OSINT suite. Analyzes 205+ scan vectors (100+ email / 105+ username) for security research, investigations, and digital footprinting.
The ultimate tool for finding a unique username across GitHub, X, Reddit, Instagram, and more in a single command.
Global Threat Intercept — Real-Time Geospatial Intelligence Platform.
Open-source intelligence for the global theater. Track everything from the corporate/private jets of the wealthy, and spy satellites, to seismic events in one unified interface. Hook an AI agent up to have it parse through data and find previously unseen correlations. The knowledge is available to all but rarely aggregated in the open, until now.
Related contents:
Automated Google Dorking Tool. Generates and runs advanced search queries for exposed files. It also test Vulns, Analyzes and extracts metadata.
Weaponizing Wayback for Recon, BugBounties, OSINT & More!
Weaponizing WaybackUrls for Recon, BugBounties , OSINT, Sensitive Endpoints and what not
You’ve heard of time travel in movies and comics, right? Well, this isn’t fiction anymore 😎. TheTimeMachine lets you dig through the past of any web app by scraping archived URLs from the Wayback Machine — and helps you find sensitive, forgotten, or deprecated endpoints for further exploitation.
Whether you’re into bug bounty, red teaming, or just love good ol’ recon, this tool was built to make my recon workflow faster, cleaner, and more effective. No more juggling multiple scripts — TheTimeMachine does it all in one shot.
Related contents:
Your own intelligence terminal. 27 sources. One command. Zero cloud. Intelligence Terminal. Your personal intelligence agent. Watches the world from multiple data sources and pings you when something changes.
The Ultimate Information Gathering Toolkit. A Python-based toolkit for Information Gathering & Reconnaissance.
Argus is an all-in-one, Python-powered toolkit designed to streamline the process of information gathering and reconnaissance. It brings together a clean, intuitive interface and a wide range of reliable modules, allowing analysts to efficiently assess networks, web applications, and security environments with consistency and precision.
Monitor your local neighbourhood's bluetooth activity.
Bluetooth Neighborhood - Track BLE devices in your area and analyze traffic patterns.
Related contents:
Real-time global intelligence dashboard — AI-powered news aggregation, geopolitical monitoring, and infrastructure tracking in a unified situational awareness interface.
Related contents:
Curated open-source intelligence tools for crypto forensics, digital investigations, and threat hunting — clean, fast, and field-ready.
SSL/TLS Security Tools. Free tools for SSL/TLS transparency, configuration analysis, and security monitoring.
Related contents:
API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process.
Related contents:
GreyNoise watches the internet's background radiation—the constant storm of scanners, bots, and probes hitting every IP address on Earth. We've cataloged billions of these interactions to answer one critical question: is this IP a real threat, or just internet noise? Security teams trust our data to cut through the chaos and focus on what actually matters.
Related contents:
Pioneering Collaborative Journalism.
Lighthouse uses the power of partnerships and innovation to advance investigative journalism that informs change.
OSINT tool that allows you to find a person's accounts and emails + breached emails.
Profil3r is an OSINT tool that allows you to find potential profiles of a person on social networks, as well as their email addresses. This program also alerts you to the presence of a data leak for the found emails.
Web path scanner. An advanced web path brute-forcer.
Related contents:
phishing, scam and brand impersonation detection – StalkPhish – We provide B2B tools, data and knowledge for a better phishing and brand impersonation detection.
StalkPhish-OSS is a tool created for searching into free OSINT databases for specific phishing kits URL. StalkPhish-OSS was made for phishing pages detection. More, StalkPhish-OSS is designed to try finding phishing kits sources.
Related contents:
Tool for complex approach to domain OSINT.
DPULSE is a software solution for conducting OSINT research in relation to a certain domain.
Data analysis & OSINT tool for everyone.
warning: created by ex-employee of the FSB
Related contents:
Domain Name Threat Intelligence.
The openSquat is a tool for identifying domain look-alikes by searching for newly registered domains that might be impersonating legit domains and brands.
MagicRecon is a powerful shell script to maximize the recon and data collection process of an objective and finding common vulnerabilities, all this saving the results obtained in an organized way in directories and with various formats.
Related contents:
Passive hostname, domain and IP lookup tool for non-robots.
wtfis is a commandline tool that gathers information about a domain, FQDN or IP address using various OSINT services. Unlike other tools of its kind, it's built specifically for human consumption, providing results that are pretty (YMMV) and easy to read and understand.
Filephish is a lightweight, user-friendly tool designed to help you quickly discover documents across the web by combining keywords, site-specific searches, and file type filters
🔍 An OSINT tool for discovering linked social accounts and associated emails across multiple platforms using a single username.
Linkook is an OSINT tool for discovering linked/connected social accounts and associated emails across multiple platforms using a single username. It also supports exporting the gathered relationships in a Neo4j-friendly format for visual analysis.
Automated Command Line Identity Generation Tool for OSINT Investigators. Command Line Sock Puppet Creator for Investigators.
Loki can create a sock puppet identity, that you can use to create a fake online presence to start your investigations. As an OSINT, Private or any other Investigator who seeks to conduct OSINT investigations; you need a sock puppet which cannot be traced back to you. Setting up a sock puppet is easy; only if you know where to look for.
Cybersecurity Search Engine.
Criminal IP is an OSINT search engine specialized in attack surface assessment and threat hunting.
It offers extensive cyber threat intelligence, including device reputation, geolocation, IP reputation for C2 or scanners, domain safety, malicious link detection, and APT attack vectors via search and API.
🕵️♂️ Collect a dossier on a person by username from thousands of sites.
Maigret collects a dossier on a person by username only, checking for accounts on a huge number of sites and gathering all the available information from web pages. No API keys are required. Maigret is an easy-to-use and powerful fork of Sherlock.
Related contents:
This tool can retrieve : 1.Deleted tweets and replies ,Even if The account is suspended 2 .Old bios and Timestamp of The tweets
Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.
Related contents:
🕵️♂️ Offensive Google framework.
GHunt (v2) is an offensive Google framework, designed to evolve efficiently. It's currently focused on OSINT, but any use related with Google is possible.
This is Sherlock's sister, Modern shiny CLI tool written with Golang to help you: 🔎 Hunt down social media accounts by username across social networks.
Related contents:
The best and most versatile OSINT utility for retrieving geolocation, DNS, WHOIS, phone, email, data breach information and much more (20 features). Perfect for investigators, pentesters, or anyone looking for an effective reconnaissance / OSINT tool.
skytrack is a planespotting and aircraft OSINT tool made using Python 🛩🔍.
skytrack is a command-line based plane spotting and aircraft OSINT reconnaissance tool made using Python. It can gather aircraft information using various data sources, generate a PDF report for a specified aircraft, and convert between ICAO and Tail Number designations. Whether you are a hobbyist plane spotter or an experienced aircraft analyst, skytrack can help you identify and enumerate aircraft for general purpose reconnaissance.
CF-Hero is a reconnaissance tool that uses multiple data sources to discover the origin IP addresses of Cloudflare-protected web applications
AIL-Framework is a powerful open-source project designed for online data analysis and web crawling, tailored for cybersecurity researchers and analysts.
Related contents:
D4TA-HUNTER is a tool created in order to automate the collection of information about the employees of a company that is going to be audited for ethical hacking.
In addition, in this tool we can find in the "search company" section by inserting the domain of a company, emails of employees, subdomains and IP's of servers.
Quickly discover exposed hosts on the internet using multiple search engines.
uncover is a go wrapper using APIs of well known search engines to quickly discover exposed hosts on the internet. It is built with automation in mind, so you can query it and utilize the results with your current pipeline tools.
Find a Photo's Location Instantly.
Unlock the Power of AI Image intelligence. Convert pixels into actionable intelligence using generative AI.
Related contents:
🔍 OSINT tool for searching people's digital footprint and leaked passwords across various social networks, written in Go.
Related contents:
Hound is a simple and light tool for information gathering and capture exact GPS coordinates.
Hound is a tool that can remotely capture the exact GPS coordinates of a target device using a PHP server, and can also grab basic information about the system and ISP. This tool can be very helpful in information gathering.
☆ An OSINT tool in python to find information about an email or phone number and get information about a URL then get information about an IP address
Open Source Intelligence Interface for Deep Web Scraping.
Darkdump is a OSINT interface for carrying out deep web investgations written in python in which it allows users to enter a search query in which darkdump provides the ability to scrape .onion sites relating to that query to try to extract emails, metadata, keywords, images, social media etc. Darkdump retrieves sites via Ahmia.fi and scrapes those .onion addresses when connected via the tor network.
Related contents:
I Know Where Your Cat Lives iknowwhereyourcatlives.com is a data experiment that locates a sample of 7 million public images of cats on a world map using the geocoordinates users unknowingly embedded in their metadata. The cats were accessed via publicly available APIs provided by popular photo sharing websites. The photos were then run through various clustering algorithms using a supercomputer in order to represent the enormity of the data source.
PhishTool automatically retrieves all of the relevant metadata from a phishing email, providing you with the most comprehensive technical view of a phishing email possible. This combined with our OSINT and heuristic detection, makes PhishTool one seriously powerful tool.