Infrastructure & Network Reconnaissance
Tools that map internet-facing infrastructure — hosts, devices, certificates, DNS and WHOIS history.
Censys
Search engine for internet-facing hosts, certs, and services.
GreyNoise
Labels internet background scan and attack traffic to separate noise from real threats.
Masscan
Internet-scale TCP port scanner able to sweep huge address ranges very fast.
Netlas
Internet-wide scanning and attack-surface search platform.
Nmap
Free network scanner for host discovery, port scanning and service/OS detection.
OSINT.SH
All-in-one web toolkit: DNS history, reverse IP, WHOIS.
Shodan
Search engine for internet-connected devices, servers, and IoT.
SpiderFoot
Automates threat-intel and reconnaissance gathering.
Wappalyzer
Identifies the technology stack (CMS, frameworks, analytics) a website runs.
ZoomEye
Cyberspace search engine mapping internet-exposed devices, services and components.
theHarvester
Collects emails, subdomains, and names from public sources.