OSINT Tools
The tools listed here are provided for informational purposes only and are freely available online. However, I do not support or encourage their use for non-ethical activities.
Transparency, which engenders truth, is the foundation for open-source intelligence. The key here is 'open', any use of 'cracked' or 'breached' data is against the law.
Below, you will also find guides for law enforcement agencies on how to investigate crimes on Twitter, OnlyFans, WhatsApp, Instagram and more.
GeoSpy v2
Tool for photo location tracking. Ideal for travel enthusiasts, historians, urban planners, law enforcement, bloggers, and event planners.
MetaOSINT
MetaOSINT is a free and openly available aggregation of "top" tools & resources intended to help jumpstart OSINT investigations.
OpenMeasures.io (SMAT)
Open Measures was designed to help analyze and visualize larger trends on a variety of platforms including Reddit, Gab, Parler, 4chan, 8kun, Telegram, Gettr and more.
WhoisFreaks
An API which allows you to search for WHOIS records by company name, owner name or keyword. Currently has over 430 million records dating as far back as 1986. Requires registration.
Pipl
A decent tool for locating people by name, address, email address, username and so on. Once offered as a free service many moons ago, now requires a paid subscription.
IACA Darkweb Tools
A collection of darkweb search tools. Allows you to query .onion search engines, marketplaces and social media sites.
Dargle
A data aggregation platform for dark web domains. Using this directory, we can generate a portfolio of domains and their statuses, gain insight into the content and nature of these services, as well as the connections between them.
The Harvester
The Harvester is a simple to use, yet powerful tool designed to be used during the reconnaissance stage of a red team assessment or penetration test. It performs open source intelligence (OSINT) gathering to help determine domain's external threat landscape. The tool gathers names, emails, IPs, subdomains, and URLs by usingmultiple public resources.
TOR Exit Nodes
Contains a full list of TOR exit nodes that are currently active as reported by the Tor Project.
Haystack
Search engine service to discover hidden services and gain access to onion sites or eepsites in the I2P network. NB: Requires TOR.
QRZ Callsign Database
Search for licensed HAM radio operators by callsign, real name, address, country and more.
Signal Identification Wiki
Identify radio signals through example sounds and waterfall images. Most signals are received and recorded using a software defined radio.
OnlyFans Law Enforcement Guide
A guide for law enforcement on what to do when dealing with OnlyFans investigations.
Facebook Law Enforcement Guide
Guidelines and resources for law enforcement officials seeking records from Facebook and/or Instagram.
Snapchat Law Enforcement Guide
A very useful guide for law enforcement when dealing with SnapChat during an investigation.
WhatsApp Law Enforcement Guide
A guide for law enforcement personnel when dealing with and requesting data from WhatsApp.
Danish National ID Centre
he Danish National ID Centre (NIDC) is an independent expert centre whose objective is to advice and support Danish authorities in the area of immigration and more specifically by identifying and determining the identity of aliens.
Twitter/X Law Enforcement Guide
A guide for law enforcement personnel when dealing with and requesting data from Twitter/X
Crt.sh
Crt.sh which is a web interface to a distributed database called the certificate transparency logs. It helps domain owners to monitor certificate issuance for their domain, and use that to detect mis-issued certificates.
SNDeepInfo
A service for checking a serial numbers of phones, smartphones, cameras, household appliances and IMEI phones of all brands.
License Plate Identifier (Global)
License plates for every country in the world, useful if you want to identify country of origin of a vehicle, assuming you have the an idea of what the license plate looks like.
Shodan.io
Shodan is an search engine for Internet-connected devices. Discover how Internet intelligence can help you make better decisions. Search by IP, name or domain.
IMEI.info
Every mobile phone, GSM modem or device has an IMEI number. Based on this number, you can check some information about the device like brand and model.
Judyrecords
Search engine in the US, offering instant access to over 740 million court cases. Better than PACER, the US federal judiciary's official system.
IPLeak
See what information you are giving away while browsing the internet. IP addresses, DNS leaks, WebRTC leaks, fingerprints and user-agent.
Vx-underground
A good source for malware samples available on the internet. They also have large archives of various whitepapers, zines and other interesting things.
Mitre Att&ck Groups
Great collection of known APT (advanced persistent threats) groups that are currently in operation as well as groups that are no longer active.
ExploitDB
An archive of exploits, vulnerabilities, shellcode, 0days, security articles, whitepapers and more. Ran by Offensive Security.
BeVigil OSINT API
A tool that provides access to millions of asset footprint data points including domain intel, cloud services, API information, and third party assets extracted from millions of mobile apps being continuously uploaded and scanned. Requires registration.
London Traffic Cams
Live feeds of traffic cameras in London, England. Not particularly useful in itself but archive versions exist online and some ML modelling can be done on them.
Airframes Aircraft Database
An unofficial, searchable, international aircraft registration database.
BIN List
BIN list is a public web service for looking up credit and debit card metadata. They also provide a free API.
Bitcoin Block Explorer
An online blockchain browser which displays the contents of individual Bitcoin blocks and transactions and the transaction histories and balances of BTC addresses.
BitcoinWhosWho
Provides plenty of useful tools for the Bitcoin network. Allows you to explore the blockchain, check if a BTC address has been reported as a scam, discover owners of BTC addresses, setup transaction alerts to notify you when a target BTC address has activity on the blockchain and more.
OCCRP Aleph
An investigative data platform that helps reporters follow the money. They provide public access to a vast archive of government records and open databases. OCCRP also grants access to journalists and activists on a case by case basis.
ImportYeti
Search over 70 Million U.S. Customs sea shipment records. Displays plenty of import information, analytics and company information.
PTArchive
Search for historical reverse DNS records. Currently has over 230 billion records retrieved from 2008 to now.
Cartell.ie
Database in Ireland for vehicles, which contains a detailed history of the vehicle, assuming you have the car registration number. It is a paid service however, and there are, of course, more discreet and easier ways to find ownership details of vehicles in Ireland.
VRT Ireland
A number of motor cars in Ireland are UK imports. Every motor vehicle brought into the country, other than temporarily by a visitor, must be registered with the tax authority (Revenue) and must have VRT paid for. A site you could use if you need to verify that.
Irish Immigration Decisions
Website that shows a list of immigration decisions by application number, assuming you have this application number, this shows you if it is approved or not. Historical data can also be found online via third party websites.
Infoveriti
The largest supplier of business information in Poland. It has an updated database of companies, associations and debtors. Full access requires a paid subscription.
192.com
192.com gives you more information about people, businesses, and places in the UK than any other directory, it is free or very low cost and it pulls data from a variety of UK sources like voter rolls and taxes.
I2P Search
A I2P search engine. I2P gateway is used for the search results to access I2P hidden services, known as "eepsites".
LocalFocus GIS Toolkit
A great collection of mapping tools for investigative researchers and journalists.
Image Hunter
The only search engine that includes over 115 million images and 54 satellite, aerial and DEM datasets from all around the world.
Google Maps
A web mapping platform and consumer application offered by Google. It offers satellite imagery, aerial photography, street maps, 360° interactive panoramic views of streets, real-time traffic conditions, and route planning for traveling by foot, car, air and public transportation.
YouTube GeoFind
Find geo-tagged videos and view them on a map. Sort by username, channel or location.
OpenCellID
The world's largest open database of cell towers. Something useful if you get your hands on telecomms data from a mobile provider.
BT Phonebook
BT phonebook, for the UK (can search by surname, area town or postcode to narrow it down).
Wigle.net
Consolidated database of location and information of wireless networks world-wide (Wi-Fi SSID).
BinaryEdge.io
Search through internet data. They scan the entire internet and DW for exposed assets and crawl the links just like a web search engine. Their data is also searchable from numerous APIs.
Grep.app
Search across a half million git repos. It searches for the exact string you enter, including any punctuation or other characters. You can also search by regular expression, using the RE2 syntax.
SoloCheck.ie
Company searches, business information and credit reports on individuals or registered entities in Ireland.
Electoral Rolls (UK)
If you are looking for someone in the UK, the electoral rolls might have a hit if you search in 'Census, Lands & Surveys'. A further search would be Births, Marriages & Deaths.
Military Records (UK)
If you know someone who served, or someone who knows someone who served in the military, you might find them in this list. Ancestry.com contains much of this information, both on their site and through databases that are available on parts of the darkweb.
Internet Archive
Internet Archive is a non-profit library of millions of free books, movies, software, music, websites, and more.
Wayback Machine
A digital archive of the World Wide Web. Allows you to search and view historical versions of websites.
The End of Term Archive
This archive contains snapshots of US federal government websites (.gov, .mil, etc) in the legislative, executive, or judicial branches of the US government.
iTools
iTools is not just a website repository, but it is also a website analyzer that provides you with specifics of the website like contact information, website traffic, Alexa rating, website reputation, data, etc.
Search Code
Search 75 billion lines of code from 40 million projects. Any search can be filtered down to a specific source or identified language using the refinement options, found in their FAQ.
Hunter.io
Useful tool for finding company emails, although their are better more secure ways, this is a more user-friendly approach.
NewspaperArchive
Explore billions of newspaper articles from all over the world. Extremely useful tool. Requires a paid subscription.
EffectGroup.io
A good tool for SOCMINT (social media intelligence) for searching people by username, email address, real name or phone number and to build a dossier.
OnePlus OSINT Toolkit
Provides easy to use tools for Facebook, Instagram, Twitter, Reddit, SnapChat, YouTube, Periscope, Twitch, Google+, LinkedIn and more.
Synapsint
Scrapes data from other sources, combines the results, then displays it using a simple interface. Search for domain, IP address, IPv6 address, ASN, SSL certs, Google accounts, email address, phone number, Twitter handle or Bitcoin address.
Social-Searcher
Allows to search for content in social networks in real-time and provides deep analytics data. Users can search without logging in for publicly posted information on Twitter, Google+, Facebook, YouTube, Instagram, Tumblr, Reddit, Flickr, Dailymotion and Vimeo.
AussieFinder
Search 5 different social media networks at once for Australian citizens. Uses a Google CSE.
PhantomBuster
A cloud-based data extraction tool designed to scrape useful data from Twitter, Facebook, LinkedIn, Instagram, and more. Allows data export to CSV and JSON formats. Requires a paid subscription.
Discord Snowflake to Timestamp
A "snowflake" is essentially a unique ID for a resource which contains a timestamp. You can copy the snowflake from a message, user, channel, etc by right clicking on them in Discord. This will let you check the age of a Discord account or server.
OSINT4ALL
Curated list of unconventional searchable databases like police databases, public voter records, published data dumps, account resolvers, extremist databases and more.
Frack
Frack is a useful tool that attempts to create an end-to-end solution to store, manage and query a breach data. The tool has got a very basic workflow making it easy to use.
Buzz.im Search
A tool that allows you to search Telegram channels, messages and authors for a specific string.
Telegcrack
A search engine for Telegra.ph. You can find the all posts with known title. Currently has around 3,554,101 posts indexed.
Twitch-Tools
A collection of Twitch tools, like username history, chat history, and other changelog history.
TinfoLeak
Create a dossier on a Twitter user. Information includes name, username, profile picture, location, followers, devices, applications and operating systems used, social networks, creation date, hashstags used, user mentions, and more.
Wikiwho
Discovering Wikipedia edits made by institutions, companies and government agencies. Tutoral on how to use it is online.
Bellingcat's Online Investigation Toolkit
This toolkit includes satellite and mapping services, tools for verifying photos and videos, websites to archive web pages, and much more.
xResolver.com
This is a good tool if you come across someone who plays video games and you know their username (XBOX, Playstation). Xresolver allows you to pull an IP address from their username. If you want it to work all the time, you should use OctoSniff, which is a fairly cheap program used to sniff IP addresses.
Sherlock Project
Sherlock, a powerful command line tool provided by Sherlock Project, can be used to hunt down social media accounts by username across social networks. It requires Python 3.6 or higher and works on MacOS, Linux and Windows.
Melissa Lookups
It contains good quality data, and you can get a free account and get 1,000 credits per month for free. If you need more then you can pay for more.
TLO (TransUnion)
A customized search and locate tool for law enforcement agents. Alternatives available for non-law enforcement.
LexisNexis: Accurint
Aids in the identification of people and their assets, addresses, relatives and business associates by providing instant access to a comprehensive database of public records that would ordinarily take days to collect.
DorkSearch.com
A Google dork query, also known as a custom query, is a search string or custom query that uses advanced search operators to find information that is not readily available on a website.
OnlyFinder
Search for accounts and images by username, keyword or geographical location on OnlyFans.com
Recruit'em X-Ray Search
Recruit'em is a tool that helps you find people on social networks. It creates a basic Boolean string that searches for publicly available webpages using Google.
NOC Social Search
Search for social accounts across multiple Mastodon/Fediverse instances. Discover content and users on this open source social network.
FollowGraph
Enter a Mastodon username and get a list of accounts followed by the people this profile follows.
SearchMyBio
Search a users bio on Instagram. Find users that list their location, interests, occupation, other social media accounts and whatever else is listed on their profile biography.
OSINT Combine Facebook Tools
A simple way to quickly search for multiple keywords from a list or open mutual friends for multiple profiles at the same time. It simply loads a new tab for each word or ID searched to create efficiency when working from a list of search terms or IDs, it does not do any advanced searching or automation.
Graphtreon
Provides information and statistics for Patreon accounts such as earnings, rank, creation date and more.
Camas Reddit Archive Search
One of the best Reddit archives out there. Search for deleted posts and comments. Allows you to search by username, subreddit, date range, string, or a commination of all.
Reveddit
A searchable archive of removed content on Reddit. Search by username, subreddit, link or domain.