Tool Directory
Search, filter, and explore 55 OSINT tools organized by data type and priority.
Showing 55 of 55 tools
Sherlock
Searches for a username across 400+ social networks simultaneously. Returns direct URLs to discovered profiles.
Holehe
Checks whether an email is registered on various services by exploiting password reset and login flows. Pivots from email to platform accounts.
theHarvester
Reconnaissance tool for gathering emails, subdomains, IPs, and URLs from search engines, PGP servers, and DNS.
Shodan
Search engine for internet-connected devices. Indexes open ports, services, SSL certificates, and device banners across the entire internet.
SpiderFoot
Automated OSINT platform that recursively queries 200+ data sources from a seed input to build a comprehensive intelligence graph.
Maltego
Visual link analysis and data mining platform. Uses modular Transforms to pivot across data types and map relationship networks.
Namechk
Checks username availability across social networks and domains. Quick browser-based cross-platform existence check.
WhatsMyName
Community-curated username enumeration tool with a frequently updated site list. High accuracy due to active community maintenance.
Censys
Internet-wide scan data with TLS/SSL certificate transparency focus. Discovers all certificates ever issued to a domain or organization.
GreyNoise
Analyzes internet-wide scan traffic to distinguish targeted attacks from opportunistic background noise. Classifies IPs as benign, malicious, or unknown.
Hunter.io
Finds and verifies professional email addresses. Returns known emails and naming patterns for any company domain.
Maigret
Advanced username enumeration across 2500+ sites with automatic profile data extraction. Generates structured reports with names, bios, and photos.
IPinfo
IP geolocation, ASN/organization attribution, carrier detection, and VPN/proxy identification. City-level location for any IP.
Have I Been Pwned
Breach notification service. Checks if an email appears in known data breaches, revealing associated platforms and potentially leaked identifiers.
AbuseIPDB
Community-driven IP reputation database. Aggregates abuse reports into confidence scores for malicious activity assessment.
USA.gov Vital Records
Portal to US vital records — birth, death, marriage, and divorce certificates. Links to state-level registrar offices.
UK GRO
UK General Register Office. Birth and marriage certificates naming parents and spouses for England and Wales.
Australia NAA RecordSearch
Australian National Archives. Historical immigration, passenger records, and naturalization files.
India IGRS
Inspector General of Registration and Stamps. Property registration and residency-linked records across Indian states.
FamilySearch.org
Largest free genealogical database. Marriage, birth, census, immigration, and naturalization records linking family members globally.
US County Assessor / Recorder
County-level property tax records listing owner name, property address, assessed value, and sometimes contact numbers.
UK Land Registry
Title search by owner name returns registered property address for England and Wales.
OpenCorporates
Largest open database of companies globally (200M+). Search director/officer appointments, registered addresses, and company roles.
SEC EDGAR
US Securities & Exchange Commission filings. Insider trades (Form 4), beneficial ownership (13D), executive bios, and enforcement actions.
EU Business Registers (BRIS)
Cross-EU company director and shareholder searches connecting national business registries.
PACER
US federal court docket search. Criminal, civil, and bankruptcy filings with party names, contact info, and case documents.
CourtListener / RECAP
Free-text search of millions of federal court documents. Judge financial disclosures via the Free Law Project.
BAILII
British and Irish Legal Information Institute. UK/Ireland court judgments and tribunal decisions searchable by party name.
WIPO Global Brand Database
World Intellectual Property Organization trademark database. Applicant address and ownership data for international trademarks.
INTERPOL Notices
International wanted persons database. Red Notices include photographs, nationality, and charges for cross-border fugitives.
LinkedIn (X-Ray Search)
Professional network with X-Ray search via Google (site:linkedin.com/in). Employment history, education, skills, and professional headshots.
X / Twitter (Advanced Search)
Microblog platform with advanced search operators for date ranges, locations, user mentions, and keyword filtering.
Facebook (Graph / Transparency)
Social network with friends lists, tagged photos, family relationship fields, and Transparency pages for public figures.
Instagram (Location + Hashtag)
Photo/video platform with location-based and hashtag search. Geotagged posts reveal travel patterns and visited locations.
TikTok
Short-form video platform. Username and sound-based search for discovering accounts and viral content.
Reddit (Pushshift Archives)
Forum with user post history and Pushshift archives. Search for name mentions in posts and comments to discover accounts.
Telegram (Channel / Group)
Messaging platform with channel and group search. Phone number association can surface names; public channels reveal activity.
Google Earth Pro / Street View
Satellite and street-level imagery for visual landmark verification and ground-truthing candidate locations.
SunCalc (Shadow Analysis)
Solar position calculator. Validates location and time by comparing shadow direction in images against computed sun position.
Snapchat Snap Map
Location-tagged social media. User-submitted snaps geolocated on a map for real-time and recent location intelligence.
Instagram Location Search
Geotagged photo discovery. Browse posts tagged at specific locations to find users who visited an area.
Sentinel Hub (Copernicus)
EU satellite imagery platform. Compare imagery over time for change detection and environmental monitoring.
ExifTool
Image metadata extraction tool. Reads EXIF GPS coordinates, camera model, timestamps, and software from photos and videos.
Overpass Turbo / OSM
Query OpenStreetMap for specific geographic features visible in images. Find mosques, railways, bridges within radius of a point.
State Professional License Registries
State-level license databases for doctors, engineers, contractors, etc. List licensee name, address, and qualifying education.
NCSBN Nursys
National nursing license verification. Confirms license status, education program, and disciplinary actions.
USPTO Patent Search
US patent filings listing inventor name, city/state/country, assignee (employer), and correspondence address.
Google Scholar / ORCID
Academic publications with author affiliation, contact email, and institutional profile photos.
GitHub / GitLab
Developer platforms. Git commits embed author email in metadata. Profile reveals username, employer/org affiliation, and activity.
Strava / Garmin Heatmaps
Fitness tracking platforms. Activity heatmaps reveal running/cycling routes, home locations, and travel patterns.
Ham Radio (FCC ULS / QRZ.com)
FCC amateur radio license database. Lists licensee name, mailing address, and phone number.
FAA Airmen Certification
Pilot certificate database. Lists certificate holder name, city, state, and certificate type.
FINRA BrokerCheck
Complete employment history, qualifying exams, and disclosure events (regulatory actions, complaints, criminal matters) for registered financial professionals.
State Bar Associations
Attorney lookup directories. Bar status, firm affiliation, admission date, law school, and office phone number.
Wayback Machine
Historical web snapshots. Recover deleted profiles, changed bios, removed social media content, and old website versions.