Open source intelligence tools used by journalists, security teams and researchers to work with public information: infrastructure scanning, breach data, archives and link analysis.
These are research and defensive-security tools used by journalists, investigators and security teams. Use them lawfully and only on targets you are authorised to investigate. We have deliberately left out face-search and automated licence plate recognition products, because those are built for tracking people without their consent.
A browsable tree of investigation resources sorted by what you are starting from: a username, a domain, an email. Some links have rotted, and it is still the best map of the field.
Indexes internet-connected devices and the banners they expose. Security teams use it to find their own forgotten servers before somebody else does.
Similar ground to Shodan with better certificate and host data, and a query language worth learning. The two disagree often enough that serious work uses both.
Tells you which breaches an address or password appeared in, run by Troy Hunt with a strong privacy design. Domain-wide monitoring is free for verified domain owners.
Archived snapshots of the web going back to 1996. The first place to look when a page has quietly changed or vanished, and the reason to save a copy before you cite anything.
Works out the email pattern a company uses and verifies whether an address exists. Built for sales, borrowed constantly by journalists trying to reach a press office.
Link analysis that turns scattered entities into a graph you can actually explain to an editor or a court. The community edition is limited but enough to learn the method.
Automates reconnaissance across hundreds of data sources and correlates the results. Run it against your own infrastructure to see what an attacker would find first.
Command line collection of subdomains, hosts and emails for a domain from public sources. A standard first step in an authorised penetration test.
Loads a suspicious URL in a sandbox and reports what it contacted, what it loaded and what it looked like. The safe way to inspect a phishing link.
Historical DNS and WHOIS records, which is how you connect infrastructure that has since been cleaned up. The history is the product.
Domain registration, DNS and IP intelligence delivered as APIs for pipelines rather than manual lookups. Useful when you are enriching thousands of domains, not three.
Checks a username across hundreds of sites from the command line. False positives are common, so treat every hit as a lead to confirm rather than a finding.
Shows which public services an email address or phone number is registered with. Popular with fraud teams verifying that an account holder is real.
Archive of public exploits plus the GHDB, the reference collection of search queries that surface exposed files and devices. Use it to check what your own domain leaks.
A crowdsourced database of wireless networks and their locations, mapped by volunteers. Mostly used for wireless security auditing and coverage research.
Michael Bazzell collection of investigation workflows, tool links and privacy guidance. The methodology writing is more valuable than any single tool it points to.