# OSINT Yourself

> An OSINT education, tools-directory and privacy site: how open-source intelligence techniques work, how much of your own footprint is discoverable with them, and a catalogued directory of the tools that do the discovering.

## About this file

This file is generated on request from the live catalogue and the site's guide registries; it is not a hand-kept copy. A shorter map of links with one-line descriptions is at [/llms.txt](https://osintyourself.com/llms.txt); the policy for AI use of this content is at [/ai.txt](https://osintyourself.com/ai.txt).

Longer descriptions appear only where they were checked against the vendor's own pages or an archived copy of them. Every other tool entry carries its short description only.

Last content change: 2026-10-24 (the most recent update to any published tool entry)

- Tools: 127
- Categories: 12
- Guides: 17
- Glossary terms: 83
- Alternatives pages: 10
- Data-removal guides: 11

## Tools directory

### Infrastructure & Network Reconnaissance

Tools that scan and map internet-facing infrastructure: hosts, open ports, exposed devices and the technology a website runs, plus IP reputation and IP data lookups, website crawling, and email and name harvesting for a domain.

#### BuiltWith

- Page: https://osintyourself.com/tools/builtwith
- Cost: Freemium
- Dual-use: no
- Official site: https://builtwith.com
- Last verified: 2026-10-01

Technology profiler that reports the frameworks, analytics, hosting and other services a website is built with.

BuiltWith identifies the technology stack behind websites, including frameworks, analytics tools, and hosting providers. It helps researchers understand the technical composition of a website, and is commonly used to review the services an organization's website employs.

#### Censys

- Page: https://osintyourself.com/tools/censys
- Cost: Freemium
- Dual-use: yes
- Official site: https://censys.io
- Last verified: 2026-10-12

Search engine for internet-facing hosts, certs, and services.

Privacy note: Censys scans every public IPv4 address and popular domain names and makes the results searchable, so a server, device or certificate you run that is reachable from the internet can appear in its results. Censys's opt-out page (docs.censys.com/docs/opt-out-of-data-collection) says to opt out you configure your firewall to drop traffic from the subnets and ASNs Censys scans from, and warns that doing so may stop you receiving its security alerts. The page says blocking does not remove historical data.

Censys says its Platform delivers real-time visibility and actionable intelligence needed to accelerate triage and manage Internet exposure. For exposure management, the page describes discovering unknown assets and continuously monitoring an external attack surface to reduce exposure.

#### Criminal IP

- Page: https://osintyourself.com/tools/criminal-ip
- Cost: Freemium
- Dual-use: no
- Official site: https://www.criminalip.io
- Last verified: 2026-10-17

Search engine and threat-intelligence platform for internet-exposed assets, IP reputation and domain scans.

Criminal IP's own page says its search engine lets analysts investigate IPs, domains and threat infrastructure in real time, and that ownership, abuse records, malware associations, passive DNS history and scanner activity can be uncovered using its filters and tags.

#### FOFA

- Page: https://osintyourself.com/tools/fofa
- Cost: Freemium
- Dual-use: no
- Official site: https://en.fofa.info
- Last verified: 2026-10-01

Cyberspace search engine that indexes internet-exposed hosts, services and web fingerprints for querying.

FOFA is a cyberspace search engine that indexes internet-exposed hosts, services, and web fingerprints so that users can query them. It is typically used for network reconnaissance to find exposed hosts and services, which helps researchers understand an external attack surface.

#### GreyNoise

- Page: https://osintyourself.com/tools/greynoise
- Cost: Freemium
- Dual-use: no
- Official site: https://www.greynoise.io
- Last verified: 2026-10-17

Labels internet background scan and attack traffic to separate noise from real threats.

GreyNoise describes its service as watching and analyzing malicious edge traffic in real time so that users can block novel exploitation, catch compromised devices and investigate critical alerts. It says a global grid of thousands of sensors observes what attackers scan for, the exploits they wield and the infrastructure they operate from. For alert triage, it states that it rules out benign internet background noise and enriches what remains with intent, CVE and tooling context.

#### IPinfo

- Page: https://osintyourself.com/tools/ipinfo
- Cost: Freemium
- Dual-use: no
- Official site: https://ipinfo.io
- Last verified: 2026-10-01

IP address data service returning geolocation, ASN, company and privacy-detection details for any IP.

IPinfo provides geolocation, autonomous system, and company details for any given IP address. It also includes privacy detection to identify proxies or VPNs. Researchers use this service to map network infrastructure and add context to IP addresses during digital investigations.

#### Masscan

- Page: https://osintyourself.com/tools/masscan
- Cost: Open source
- Dual-use: no
- Official site: https://github.com/robertdavidgraham/masscan
- Source code: https://github.com/robertdavidgraham/masscan
- Last verified: 2026-10-17

Internet-scale TCP port scanner able to sweep huge address ranges very fast.

The masscan README describes it as an "Internet-scale port scanner" and says: "It can scan the entire Internet in under 5 minutes, transmitting 10 million packets per second, from a single machine." That is the vendor's own claim and has not been tested here. It says its usage is similar to nmap and that it uses its own ad hoc TCP/IP stack, so anything other than simple port scans may conflict with the local TCP/IP stack. It can also complete the TCP connection to grab simple banner information on protocols such as FTP, HTTP and SSH.

#### Netlas

- Page: https://osintyourself.com/tools/netlas
- Cost: Freemium
- Dual-use: no
- Official site: https://netlas.io
- Last verified: 2026-10-12

Internet-wide scanning and attack-surface search platform.

Privacy note: Internet-exposed devices you run may be indexed and searchable here.

Netlas describes itself on its home page with the line "Discover, scan and monitor any online assets". Its search tools cover Internet Scan Data, DNS Records, IP WHOIS, Domain WHOIS and SSL Certificates. The page says it provides access to historical records for all data collections except SSL certificates, and that it can be used on the web, through a CLI, or through an API and Python SDK.

#### Nmap

- Page: https://osintyourself.com/tools/nmap
- Cost: Open source
- Dual-use: no
- Official site: https://nmap.org
- Source code: https://github.com/nmap/nmap
- Last verified: 2026-10-12

Free network scanner for host discovery, port scanning and service/OS detection.

Nmap ("Network Mapper") calls itself "a free and open source utility for network discovery and security auditing". Its site says it uses raw IP packets to determine what hosts are available on a network, what services those hosts are offering, what operating systems they are running and what type of packet filters or firewalls are in use. The suite also includes the Zenmap GUI, Ncat, Ndiff and Nping.

#### OSINT.SH

- Page: https://osintyourself.com/tools/osint-sh
- Cost: Free
- Dual-use: yes
- Official site: https://osint.sh
- Source code: https://github.com/secgron/osint.sh
- Last verified: 2026-10-12

All-in-one web toolkit: DNS history, reverse IP, WHOIS.

Privacy note: OSINT.SH lists WHOIS history, reverse WHOIS and an email finder among its tools, alongside DNS history and reverse IP lookups, so records tied to a domain you registered, and email addresses its Email Finder returns, can appear in its results.

OSINT.SH lists web tools including DNS History (view all DNS historical records for a specified domain name), Reverse IP (find all A records associated with an IP address), Whois History (the historical WHOIS records of a domain name), Subdomain Finder and Certificate Search, plus a technology stack checker and a search for public buckets on AWS S3 and Azure Blob by keyword. The README says its API is limited to sponsors only. The home page credits Teguh Aprianto.

#### Photon

- Page: https://osintyourself.com/tools/photon
- Cost: Open source
- Dual-use: no
- Official site: https://github.com/s0md3v/Photon
- Source code: https://github.com/s0md3v/Photon
- Last verified: 2026-10-06

Fast crawler that extracts URLs, emails, files and other data points from a website.

Photon is an open-source crawler designed for OSINT that extracts data from a website as it crawls, including URLs, files, email addresses and social media accounts, JavaScript files and their endpoints, and strings matching a custom regex. Extracted data is saved in an organised form or exported as JSON.

#### PublicWWW

- Page: https://osintyourself.com/tools/publicwww
- Cost: Freemium
- Dual-use: no
- Official site: https://publicwww.com
- Last verified: 2026-10-06

Search engine that finds websites by matching source-code snippets, IDs or scripts.

PublicWWW is a source-code search engine that finds web pages by matching snippets, signatures or keywords in their HTML, JavaScript and CSS. Its own examples include finding sites that share an analytics ID or use a particular theme or library, and results can be downloaded as a CSV file.

#### Shodan

- Page: https://osintyourself.com/tools/shodan
- Cost: Freemium
- Dual-use: yes
- Official site: https://www.shodan.io
- Last verified: 2026-10-17

Search engine for internet-connected devices, servers, and IoT.

Privacy note: Indexes devices exposed to the open internet — including ones an owner did not realise were reachable.

Shodan's homepage says "Use Shodan to discover everything from power plants, mobile phones, refrigerators and Minecraft servers." Under "Monitor Network Exposure" it says "Keep track of all your devices that are directly accessible from the Internet." It also says that "Within 5 minutes of using Shodan Monitor you will see what you currently have connected to the Internet within your network range". These are the vendor's own descriptions and have not been tested here.

#### SpiderFoot

- Page: https://osintyourself.com/tools/spiderfoot
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/smicallef/spiderfoot
- Source code: https://github.com/smicallef/spiderfoot
- Last verified: 2026-10-17

Automates threat-intel and reconnaissance gathering.

Privacy note: SpiderFoot can take an email address, phone number, username or a person's name as a scan target and runs more than 200 modules, including email, phone-number and human-name extraction and a module that tries to find social-media profiles for names it identifies. Its README says it can be used defensively "to gather information about what you or your organisation might have exposed over the Internet".

The SpiderFoot README calls it an open source intelligence (OSINT) automation tool that can be used through a web-based interface or completely via the command-line, with over 200 modules and CSV, JSON and GEXF export. It says it is written in Python 3 and MIT-licensed. The README says it can be used offensively, for example in a red team exercise or penetration test, or defensively to gather information about what you or your organisation might have exposed over the Internet.

#### Wappalyzer

- Page: https://osintyourself.com/tools/wappalyzer
- Cost: Freemium
- Dual-use: no
- Official site: https://www.wappalyzer.com
- Last verified: 2026-10-12

Identifies the technology stack (CMS, frameworks, analytics) a website runs.

Wappalyzer says it helps sales and GTM teams build technographic prospect lists, enrich CRM records, and monitor competitor installs with data from millions of websites. Its Technology lookup product is described as finding better prospects from the technologies they use, with the options Look up a website, Analyze a list and Use API. Its Website alerts product tracks website technology changes.

#### ZoomEye

- Page: https://osintyourself.com/tools/zoomeye
- Cost: Freemium
- Dual-use: no
- Official site: https://www.zoomeye.ai
- Last verified: 2026-10-17

Cyberspace search engine mapping internet-exposed devices, services and components.

Privacy note: Internet-exposed devices you run (cameras, routers, NAS) may be indexed and searchable here.

ZoomEye's own llms.txt describes it as "a global cyberspace asset search engine for IPv4/IPv6 device discovery, website asset search, vulnerability impact analysis, bug bounty asset discovery, and attack surface monitoring." Its agent guide says the data "describes assets observed on the public internet" and warns that "A search result is not permission to scan, exploit, authenticate to, disrupt, or otherwise interact with an asset." The guide lists a web interface, a REST API that takes an API key in a request header, and a Python SDK and CLI as ways in.

#### theHarvester

- Page: https://osintyourself.com/tools/theharvester
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/laramies/theHarvester
- Source code: https://github.com/laramies/theHarvester
- Last verified: 2026-10-17

Collects emails, subdomains, and names from public sources.

Privacy note: theHarvester gathers emails, subdomains and names for a domain or organization from search engines, certificate transparency logs, DNS datasets, code repositories and other public sources, so an email address or name connected to a domain you are linked to can be collected. Its README says to run it only against targets you own or have explicit permission to test.

The theHarvester README says it "gathers open-source intelligence about a domain or organization from search engines, certificate transparency logs, DNS datasets, code repositories, threat-intelligence platforms, and other public sources". It states: "Run it only against targets you own or have explicit permission to test." It also notes "Passive means the target is not contacted directly, but the selected providers still receive the target string", says it "requires Python 3.14", and is distributed under the GNU General Public License version 2 only.

### Username & Social Media Tracking

Tools that check a username across social platforms and other services, and that search or collect public posts and profiles from social networks.

#### Blackbird

- Page: https://osintyourself.com/tools/blackbird
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/p1ngul1n0/blackbird
- Source code: https://github.com/p1ngul1n0/blackbird
- Last verified: 2026-10-12

Fast username and email search across 600+ platforms.

Privacy note: Reusing one username lets tools like this link all of your accounts together.

Blackbird is a command-line tool that takes a username (--username) or an email address (--email) and searches for it across more than 600 platforms. Its README says it is fully integrated with the WhatsMyName project and lists PDF and CSV exports among its features. The README's disclaimer says the program is "for Educational purpose ONLY" and "Do not use it without permission."

#### Instaloader

- Page: https://osintyourself.com/tools/instaloader
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/instaloader/instaloader
- Source code: https://github.com/instaloader/instaloader
- Last verified: 2026-10-17

Downloads Instagram photos, videos, captions and metadata from public profiles.

Privacy note: Instaloader downloads Instagram photos, videos, captions, comments, geotags and metadata from profiles, so the posts on an account can be saved in bulk by anyone who runs it. Its documentation says it can also download private profiles when run with its login option.

Instaloader is installed with pip3 and run from the command line as instaloader followed by a profile name. Its README says it allows fine-grained customization of filters and of where downloaded media is stored, and that it automatically resumes previously-interrupted download iterations. The README also states that "Instaloader is licensed under an MIT license."

#### Maigret

- Page: https://osintyourself.com/tools/maigret
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/soxoj/maigret
- Source code: https://github.com/soxoj/maigret
- Last verified: 2026-10-12

Builds a dossier from a username, checking thousands of sites for matching accounts.

Privacy note: Reusing one username lets tools like this link all of your accounts together.

Maigret is installed with pip and run as maigret followed by a username; its README says it checks for accounts on a huge number of sites by username only and that no API keys are required. It supports 5,900 sites, and a default run checks the 500 highest-ranked sites by traffic, while passing -a scans everything. It can make HTML, PDF and XMind reports, export results with --csv and --txt, ships with a web interface and can be embedded in Python projects. The README says the open-source Maigret is MIT-licensed.

#### Namechk

- Page: https://osintyourself.com/tools/namechk
- Cost: Freemium
- Dual-use: yes
- Official site: https://namechk.com

Checks whether a username or domain is available or already taken across many sites.

Privacy note: Reusing one username lets tools like this link all of your accounts together.

#### OSINT Industries

- Page: https://osintyourself.com/tools/osint-industries
- Cost: Paid
- Dual-use: yes
- Official site: https://osint.industries
- Last verified: 2026-10-17

Paid platform for reverse email/phone/username lookups across hundreds of services.

Privacy note: Shows how many accounts a single email or phone number silently reveals — a strong argument for compartmentalised aliases.

OSINT Industries presents an OSINT platform, API access and training on its homepage. Its Registered Accounts section says: "See which online accounts are linked to any email or phone number." Findings can be exported as PDF, DOC, EXCEL or JSON. The homepage states "we never store search results"; that is the vendor's own claim and has not been tested here.

#### Osintgram

- Page: https://osintyourself.com/tools/osintgram
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/Datalux/Osintgram
- Source code: https://github.com/Datalux/Osintgram
- Last verified: 2026-10-01

Open-source Instagram OSINT tool, run as a local web app, that gathers followers, posts, comments and locations from a public account by username.

Privacy note: Given a username, it gathers followers, posts, comments and geotagged locations from a public Instagram account. Its README says it cannot see private profiles.

Osintgram is an open-source tool that operates as a local web application to collect data from public Instagram accounts. It gathers information such as followers, posts, comments, and location tags based on a provided username. This utility is typically used for social media analysis of public accounts.

#### Sherlock

- Page: https://osintyourself.com/tools/sherlock
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/sherlock-project/sherlock
- Source code: https://github.com/sherlock-project/sherlock
- Last verified: 2026-10-12

Hunts a username across hundreds of sites.

Privacy note: Demonstrates how far a single reused username can be traced — a practical case for per-platform aliases.

Sherlock searches for a username across social networks from the command line: the repository page shows "sherlock user123" for one username and "sherlock user1 user2 user3" for several. Output is stored in an individual text file named for each username, and the help text lists --csv and --xlsx options for other file formats. It is released under the MIT licence.

#### Social Analyzer

- Page: https://osintyourself.com/tools/social-analyzer
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/qeeqbox/social-analyzer
- Source code: https://github.com/qeeqbox/social-analyzer
- Last verified: 2026-10-12

API, CLI and web app that finds a person's profiles across 1000+ social sites.

Privacy note: Reusing one username lets tools like this link all of your accounts together.

Social Analyzer is an API, CLI and web app with detection modules, and its README says you can choose which modules to use during the investigation process. The detection modules produce a rate value from 0 to 100 (No-Maybe-Yes). The analysis can be saved as a JSON file. The README's disclaimer says the tool is meant to be used locally, not as a service, and that it does not have any Access Control.

#### Social Searcher

- Page: https://osintyourself.com/tools/social-searcher
- Cost: Freemium
- Dual-use: yes
- Official site: https://www.social-searcher.com
- Last verified: 2026-10-17

Free real-time search engine for public social-media posts and mentions.

Privacy note: Social Searcher searches social-media posts, profiles, mentions and images by keyword, hashtag or name, so posts and profiles under your name or handle can be surfaced. Its homepage describes what it finds as "publicly available profiles, posts, and mentions".

Social Searcher's home page describes how to "Look up mentions and public posts" and to "Order results by relevance or date". It says the service "uses publicly indexed data from major search engines" and "supports several advanced search operators", listing exact phrase, exclude terms (-) and OR.

#### TGStat

- Page: https://osintyourself.com/tools/tgstat
- Cost: Freemium
- Dual-use: yes
- Official site: https://tgstat.com
- Last verified: 2026-10-06

Analytics platform for searching and tracking Telegram channels and groups.

Privacy note: TGStat catalogs Telegram channels and groups, lets visitors search across their posts and track channels over time, and also publishes ratings of brands and people, so a channel you run or are named in can be found and followed there.

TGStat is an analytics platform and catalogue for Telegram channels and groups, which its site classifies by country, language and category. It also offers channel and group ratings, search by posts, Telegram monitoring and an API.

#### Telegago

- Page: https://osintyourself.com/tools/telegago
- Cost: Free
- Dual-use: yes
- Official site: https://cse.google.com/cse?cx=006368593537057042503:efxu7xprihg

Google Custom Search engine scoped to indexed Telegram channel content.

Privacy note: Telegago is a Google Custom Search engine scoped to indexed Telegram channel content.

#### WhatsMyName

- Page: https://osintyourself.com/tools/whatsmyname
- Cost: Open source
- Dual-use: yes
- Official site: https://whatsmyname.app
- Source code: https://github.com/WebBreacher/WhatsMyName
- Last verified: 2026-10-12

Enumerates a username's presence across sites.

Privacy note: WhatsMyName checks whether a username exists across hundreds of websites, so a username you reuse can be linked across the sites it covers. Its README says sites behind paywalls or login walls can't be checked, and that a site is only included if its profile URL contains the username.

WhatsMyName is a community-maintained dataset, kept as a single JSON file (wmn-data.json), that its README says lets you find out if a username exists across hundreds of websites. Each entry describes what URL to query and what a successful or "not found" response looks like; separate tools read the file and do the actual checking. For a site to be included it must be publicly accessible and its profile URL must contain the username. The README points to whatsmyname.app as a free, browser-based tool built on the dataset.

#### snscrape

- Page: https://osintyourself.com/tools/snscrape
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/JustAnotherArchivist/snscrape
- Source code: https://github.com/JustAnotherArchivist/snscrape
- Last verified: 2026-10-17

Scrapes posts and profiles from Twitter/X, Reddit, Telegram and other networks.

Privacy note: snscrape scrapes user profiles, hashtags and searches from services including Facebook, Instagram, Mastodon, Reddit, Telegram, Twitter, VKontakte and Weibo and returns the posts it finds, so posts and profile details on those services can be collected in bulk. Its README lists these as supported; the repository has had no push since November 2023.

The snscrape README calls it "a scraper for social networking services (SNS)" that "returns the discovered items, e.g. the relevant posts". It lists Facebook, Instagram, Mastodon, Reddit, Telegram, Twitter, VKontakte and Weibo as supported services and says it "requires Python 3.8 or higher". The command line's default output is "the URL of each result", with `--jsonl` for JSONL output, and the program is licensed under the GNU General Public License, version 3 or any later version.

### Data Visualization & Analysis

Tools for analysing and visualising collected data, including link-analysis graphs, timelines, graph databases and data-transformation utilities, plus platforms for searching and cross-referencing leaked documents and for monitoring exposed credentials and data.

#### Aleph

- Page: https://osintyourself.com/tools/aleph
- Cost: Open source
- Dual-use: no
- Official site: https://aleph.occrp.org
- Source code: https://github.com/alephdata/aleph
- Last verified: 2026-10-06

OCCRP's platform for searching and cross-referencing leaked and public documents and data.

Aleph is OCCRP's platform for searching and cross-referencing leaked and public documents and data. It indexes documents such as PDF, Word and HTML files alongside structured data such as CSV, XLS and SQL, and can cross-reference mentions of people and companies against watchlists. It is built with investigative reporting as a primary use case. Its README says the core team's maintenance of this open-source version was to end after December 2025, with development moving to a rewritten product, Aleph Pro.

#### CyberChef

- Page: https://osintyourself.com/tools/cyberchef
- Cost: Open source
- Dual-use: no
- Official site: https://gchq.github.io/CyberChef/
- Source code: https://github.com/gchq/CyberChef
- Last verified: 2026-10-01

GCHQ's browser-based "Cyber Swiss Army Knife" for decoding, decrypting, transforming and analysing data.

CyberChef is a browser-based utility designed for decoding, decrypting, transforming, and analysing various types of data. Security professionals and researchers use it to process encoded information and analyse data in the browser. Its modular approach allows users to chain operations for complex data manipulation tasks.

#### Flare

- Page: https://osintyourself.com/tools/flare
- Cost: Paid
- Dual-use: no
- Official site: https://flare.io
- Last verified: 2026-10-12

Threat-exposure and dark-web monitoring: finds leaked credentials, stealer logs, and exposed data.

Privacy note: The defensive side of breach data — monitors whether your credentials have surfaced on illicit markets.

Flare's home page describes its foundation as "Continuous dark & clear web scanning for fraud, abuse, phishing domains, and exposed human and non-human identities." It says its Identity Exposure Management solution "integrates with Entra ID to automatically detect, validate, and remediate exposed accounts", and that Flare "plugs in underneath the stack you already run, your SIEM/SOAR, your AI SOC, your response".

#### Gephi

- Page: https://osintyourself.com/tools/gephi
- Cost: Open source
- Dual-use: no
- Official site: https://gephi.org
- Source code: https://github.com/gephi/gephi
- Last verified: 2026-10-17

Open-source platform for visualizing and analyzing large network graphs.

Gephi is software that its site describes as free and open source, built and maintained by a community of contributors; its README says it runs on Windows, Mac OS X and Linux. The site lists built-in algorithms for community detection, centrality measures and clustering analysis, a spreadsheet interface to manipulate data columns, and export to PNG, PDF and SVG.

#### Lampyre

- Page: https://osintyourself.com/tools/lampyre
- Cost: Freemium
- Dual-use: yes
- Official site: https://lampyre.io
- Last verified: 2026-10-12

Data-analysis and OSINT tool pulling 100+ sources into graphs, maps and tables.

Privacy note: Lampyre pulls together more than 100 regularly updated data sources into graphs, maps and tables, so details about a person that appear in those sources can be collected and linked in one place. Its privacy policy (lampyre.io/privacy) covers people who use Lampyre's own websites and software; no removal route for people who appear in the third-party sources it queries was found.

Lampyre's home page calls it a "Data analysis & OSINT tool for everyone" that lets you "Obtain, visualize and analyze data in one place". It lists "More than 100 regularly updated data sources", "Importing data from a file for working offline" and a Python API. The page describes "4 different visualization modes": "table, map, graph and all three of them together".

#### Maltego

- Page: https://osintyourself.com/tools/maltego
- Cost: Freemium
- Dual-use: no
- Official site: https://www.maltego.com
- Last verified: 2026-10-12

Visual link-analysis mapping relationships between data points.

Maltego's home page lists Maltego Graph under "Complex link analysis of large datasets" and describes it as a way to "Conduct deep investigations into complex OSINT cases and cyber threats with access to all external and internal data". It also lists Maltego Data ("Instant access to 120+ data providers") and Maltego Cases ("Store and collect all your investigations in one place").

#### Neo4j

- Page: https://osintyourself.com/tools/neo4j
- Cost: Freemium
- Dual-use: no
- Official site: https://neo4j.com
- Last verified: 2026-10-17

Graph database for storing and querying connected data and relationships.

Neo4j's getting-started documentation says: "With a property graph database at its core, Neo4j offers an ecosystem of tools, applications, and libraries which aim to help you get started with the technology." The same page points to "Learn Cypher®, Neo4j’s graph query language", to Graph Data Science, which it describes as "a library of graph algorithms for analysts and data scientists", and lists "Import from a relational database into Neo4j" under its "GraphAcademy courses" heading.

#### Timesketch

- Page: https://osintyourself.com/tools/timesketch
- Cost: Open source
- Dual-use: no
- Official site: https://timesketch.org
- Source code: https://github.com/google/timesketch
- Last verified: 2026-10-12

Open-source collaborative forensic timeline analysis tool.

Timesketch's README says that, using sketches, collaborators can organize their timelines and analyze them all at the same time, and that raw data can be given meaning with "rich annotations, comments, tags and stars". The README also states: "This is not an official Google product (experimental or otherwise), it is just code that happens to be owned by Google."

#### i2 Analyst's Notebook

- Page: https://osintyourself.com/tools/i2-analysts-notebook
- Cost: Paid
- Dual-use: no
- Official site: https://i2group.com/solutions/i2-analysts-notebook
- Last verified: 2026-10-17

Link-analysis and visualisation software for mapping relationships, timelines and networks in investigations.

i2 describes Analyst's Notebook as the advanced visual analysis solution for investigators to combat fraud and crime. Its page says users can model and visualize data as entities, links, events, timelines or attributes, apply integrated Social Network Analysis tools to the structure, hierarchy and operations of complex networks, and produce redacted versions of charts to share the right level of information with others with differing security clearances. It also describes a drag-and-drop data input mode.

### Email & Phone Lookup

Tools that check which services or accounts an email address or phone number is linked to, look up Google accounts and breach exposure for an address, run caller-ID and reverse phone lookups, and find email addresses for a domain.

#### Epieos

- Page: https://osintyourself.com/tools/epieos
- Cost: Freemium
- Dual-use: yes
- Official site: https://epieos.com
- Last verified: 2026-08-30

Reverse email lookup and digital-footprint tracing.

Privacy note: Reverse email lookups show how much a single address links back to real-world accounts — a reason to use separate addresses for separate contexts.

Description source: archived copy of the vendor's page, captured 2026-10-09.
Epieos's home page describes it as "An OSINT search engine" for email reverse lookup. The vendor states "We do not log your queries" and "we do not save any of your requests and results"; these are its own claims and have not been tested here.

#### GHunt

- Page: https://osintyourself.com/tools/ghunt
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/mxrch/GHunt
- Source code: https://github.com/mxrch/GHunt
- Last verified: 2026-10-12

Investigates Google accounts, extracting data tied to a Gmail address.

Privacy note: A Gmail address can expose your name, profile photo, reviews and more.

GHunt's README calls it "an offensive Google framework" that is "currently focused on OSINT", usable as a command-line tool or a Python library, with JSON export. It must be authenticated to Google first: `ghunt login` is completed with the GHunt Companion browser extension. It is under the AGPL licence, and the README says: "Use it only in personal, criminal investigations, pentesting, or open-source projects."

#### GetContact

- Page: https://osintyourself.com/tools/getcontact
- Cost: Freemium
- Dual-use: yes
- Official site: https://getcontact.com
- Last verified: 2026-10-01

Caller-ID and spam-blocking app with a web lookup that identifies who a phone number belongs to.

Privacy note: GetContact can show how other users have saved your number in their address books, which may expose nicknames or context you never published. GetContact publishes a "Manage Your Privacy Profile" page (getcontact.com/en/manage).

GetContact is a caller identification and spam-blocking application that also offers a web-based lookup service. It allows users to look up a phone number to identify who it belongs to, helping individuals check unknown callers.

#### Holehe

- Page: https://osintyourself.com/tools/holehe
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/megadose/holehe
- Source code: https://github.com/megadose/holehe
- Last verified: 2026-10-12

Checks whether an email is registered on 120+ sites via password-reset flows.

Privacy note: Reveals which services your email is registered on — check your own exposure.

Holehe checks whether an email is attached to an account on sites like twitter, instagram, imgur and more than 120 others, retrieving information using the forgotten password function. It can be run from the CLI or embedded within existing Python applications. The README lists the GNU General Public License v3.0.

#### Hunter.io

- Page: https://osintyourself.com/tools/hunter
- Cost: Freemium
- Dual-use: yes
- Official site: https://hunter.io
- Last verified: 2026-10-17

Finds and verifies professional email addresses associated with a domain.

Privacy note: Hunter crawls public web pages for names, professional email addresses, job titles and social-profile URLs, and can generate a professional email address from a name and employer when none is published, so a work address of yours may be findable through your employer's domain. Hunter publishes a claim page (hunter.io/claim) that says claiming an email address removes the information associated with it.

Hunter's homepage describes the Hunter app as a place to find and verify emails, enrich companies and send outreach. On its data page the vendor states that its database leverages the public web, that Domain Search results are returned with information about where and when they were found, and that the Email Finder indicates whether a result is a guess or has public sources. It also states that data that no longer has public sources is removed and that its crawler follows the robots.txt standard. These are the vendor's own statements and have not been tested here.

#### NumLookup

- Page: https://osintyourself.com/tools/numlookup
- Cost: Freemium
- Dual-use: yes
- Official site: https://www.numlookup.com
- Last verified: 2026-10-01

Reverse phone lookup for US numbers that shows basic results instantly, with fuller background reports on a paid subscription.

Privacy note: A lookup of your number can return basic details instantly, and paid reports add address history and relatives. Check what it shows for your own number.

NumLookup provides reverse phone lookup for United States numbers, showing basic results instantly. It offers fuller background reports on a paid subscription.

#### PhoneInfoga

- Page: https://osintyourself.com/tools/phoneinfoga
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/sundowndev/phoneinfoga
- Source code: https://github.com/sundowndev/phoneinfoga
- Last verified: 2026-10-17

Scans and footprints international phone numbers using OSINT sources.

Privacy note: Your phone number can be traced to carrier, region and linked accounts.

The PhoneInfoga README describes it as an information gathering framework for phone numbers that works with a collection of scanners which must be configured for the tool to be effective. It says the tool does not automate everything and does not claim to provide relevant or verified data. Its README lists among its anti-features: "Does not allow to hack a phone". The README also states that the project is stable but unmaintained.

#### Truecaller

- Page: https://osintyourself.com/tools/truecaller
- Cost: Freemium
- Dual-use: yes
- Official site: https://www.truecaller.com
- Last verified: 2026-10-01

Caller-ID and reverse phone lookup service that shows a name and spam label for a phone number.

Privacy note: Your name and number can appear in Truecaller's caller-ID database even if you never used the app. Truecaller publishes an unlisting page (truecaller.com/unlisting) where anyone can ask for their number to be excluded from name search.

Truecaller is a caller identification and reverse phone lookup service that displays the name associated with a phone number. It also provides spam labels to help users identify potentially unwanted calls. This tool is commonly used to check what name and spam label a phone number carries.

#### h8mail

- Page: https://osintyourself.com/tools/h8mail
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/khast3x/h8mail
- Source code: https://github.com/khast3x/h8mail
- Last verified: 2026-10-17

Email OSINT and breach-hunting tool that pulls exposures for an address.

Privacy note: Reveals which breaches your email appears in — check your own exposure.

The h8mail README describes it as an email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches. It is installed with pip3, supports bulk file-reading for targeting, and can write output to a CSV file or JSON. Its table of supported services marks several as needing an API key, and the README states the licence is BSD 3 clause.

### Reverse Image Search & Geolocation

Tools that search for where an image or a face appears online, and that help work out where and when a photo was taken.

#### FaceCheck.ID

- Page: https://osintyourself.com/tools/facecheck-id
- Cost: Freemium
- Dual-use: yes
- Official site: https://facecheck.id
- Last verified: 2026-10-06

FaceCheck ID — sometimes searched as face check id — is a freemium facial-recognition search engine that finds where a face appears across the web. It is a dual-use OSINT tool: used responsibly, treat it like PimEyes and check what a face search reveals about you before running it on anyone else.

Privacy note: A facial-recognition search built from a photo of a stranger can enable stalking or harassment — used responsibly, it is best treated like PimEyes: check what a face search reveals about you.

FaceCheck.ID is a facial-recognition search engine: a user uploads a photo and it returns web pages where matching faces appear, with filters for source types such as social media, news and blogs, videos and mugshots, and with match bands from weak to certain. The site itself warns that many unrelated people look alike and that a face search should be cross-referenced against other sources.

#### Google Lens

- Page: https://osintyourself.com/tools/google-lens
- Cost: Free
- Dual-use: yes
- Official site: https://lens.google
- Last verified: 2026-10-12

Google's visual search to identify objects, places and text in images.

Privacy note: Your public photos can be matched to identify people, places or objects in them.

Google's Lens page says: "Use your camera, an image, or a screenshot to search." It describes using the camera to "translate menus, signs, handwriting, or anything else in over 100 languages", or to copy text to a phone or computer, and using Lens "to learn more about artwork, murals, and landmarks". It adds that "With Google Lens in Chrome desktop, easily select, search and ask questions about anything you see on the web".

#### Picarta

- Page: https://osintyourself.com/tools/picarta
- Cost: Freemium
- Dual-use: yes
- Official site: https://picarta.ai
- Last verified: 2026-10-12

AI tool that predicts where a photo was taken from its visual content.

Privacy note: Photos you post can be geolocated even when they carry no GPS metadata.

Picarta's FAQ says its AI predicts where a photo was taken and returns GPS coordinates with confidence scores. You can upload a photo or paste an image link, and it returns the top predicted locations on a map. It says Picarta does not rely on EXIF metadata or embedded GPS tags, and that accuracy depends on the image content and how distinctive its geographical features are.

#### PimEyes

- Page: https://osintyourself.com/tools/pimeyes
- Cost: Freemium
- Dual-use: yes
- Official site: https://pimeyes.com
- Last verified: 2026-10-17

Facial-recognition search engine that finds where a face appears online.

Privacy note: Anyone with a photo of you can find other pictures of you across the web — consider requesting removal.

PimEyes' home page describes uploading a photo "to perform a reverse image search and find pictures containing given faces across the Internet". Its Privacy & Ethics page says the system "only indexes images from publicly accessible websites that allow such indexing" and that social media platforms and professional networks "are intentionally excluded" from its search coverage. It says PimEyes is "available exclusively through this website" and that it does not offer "Telegram bots, mobile apps, or subscriptions through third-party platforms".

#### Search4faces

- Page: https://osintyourself.com/tools/search4faces
- Cost: Freemium
- Dual-use: yes
- Official site: https://search4faces.com
- Last verified: 2026-10-01

Reverse face search that matches a photo against profile pictures collected from VK, Odnoklassniki, TikTok and ClubHouse.

Privacy note: Matches a face against profile photos collected from VK, Odnoklassniki, TikTok and ClubHouse (per the site), so a single social-media avatar can be enough to identify you. Treat it like PimEyes: search your own face to see what it returns.

Search4faces is a reverse face search tool that matches a photo against profile pictures collected from VK, Odnoklassniki, TikTok and ClubHouse. It lets users upload a photo and see matching profile pictures from those platforms.

#### SunCalc

- Page: https://osintyourself.com/tools/suncalc
- Cost: Free
- Dual-use: no
- Official site: https://www.suncalc.org
- Last verified: 2026-10-12

Shows sun position and shadow direction for any place and time, used to verify photo timing.

SunCalc's help text says it "shows the movement of the sun and sunlight-phase for a certain day at a certain place". For the selected location the page lists dawn, sunrise, sunset, dusk, daylight duration, altitude, azimuth and shadow length, and it has a reverse calculation from sun altitude and azimuth at a given time.

#### TinEye

- Page: https://osintyourself.com/tools/tineye
- Cost: Freemium
- Dual-use: no
- Official site: https://tineye.com
- Last verified: 2026-10-17

Reverse image search that finds where an image appears and its earliest known use.

TinEye's help articles describe it as "a reverse image search engine" and say you can submit an image "to find out where it came from, how it is being used, if modified versions of the image exist or to find higher resolution versions." They state that TinEye uses "image recognition technology rather than keywords, metadata or watermarks", does not typically find similar images, and "finds image matches including those that have been cropped, edited or resized." TinEye is described as free for non-commercial use, with the TinEye API offered for commercial use.

#### Yandex Images

- Page: https://osintyourself.com/tools/yandex-images
- Cost: Free
- Dual-use: yes
- Official site: https://yandex.com/images/
- Last verified: 2026-10-12

Reverse image search noted for strong face and location matching.

Privacy note: Your public photos can be matched to identify you or where they were taken.

Yandex's Images help page says "Yandex Images is a service for searching images on the internet." It lists "Copies of various sizes or similar images" and "Images from a specific site" among the things you can find with it. The Yandex Images home page is titled "Search by images and photos".

### Domain, DNS & WHOIS

Tools that look up domains, DNS records, certificates and registration history, and that enumerate the subdomains of a domain.

#### Amass

- Page: https://osintyourself.com/tools/amass
- Cost: Open source
- Dual-use: no
- Official site: https://github.com/owasp-amass/amass
- Source code: https://github.com/owasp-amass/amass
- Last verified: 2026-10-06

In-depth attack-surface mapping and asset discovery via DNS enumeration and network recon.

OWASP Amass is an open-source project that maps attack surfaces and discovers external assets using open-source information gathering and active reconnaissance, including DNS enumeration.

#### DNSDumpster

- Page: https://osintyourself.com/tools/dnsdumpster
- Cost: Free
- Dual-use: no
- Official site: https://dnsdumpster.com
- Last verified: 2026-10-12

Free domain research tool that maps a domain's subdomains and hosts.

DNSDumpster describes itself as a free domain research tool that can discover hosts related to a domain. Its page says that finding visible hosts from the attackers perspective is an important part of the security assessment process, and that network defenders benefit from passive reconnaissance in a number of ways. It also says it can map an organizations attack surface using the DNS records associated with the target organization.

#### DomainTools

- Page: https://osintyourself.com/tools/domaintools
- Cost: Freemium
- Dual-use: no
- Official site: https://www.domaintools.com
- Last verified: 2026-10-01

Domain intelligence platform with WHOIS history, reverse WHOIS and DNS pivoting for investigating who is behind a domain.

DomainTools is a domain intelligence platform that provides historical WHOIS data, reverse WHOIS lookups, and DNS pivoting capabilities. It is commonly used by investigators to research the history of a domain, who is behind it, and how it connects to other internet assets.

#### MxToolbox

- Page: https://osintyourself.com/tools/mxtoolbox
- Cost: Freemium
- Dual-use: no
- Official site: https://mxtoolbox.com
- Last verified: 2026-10-17

Web diagnostics for DNS, MX, SPF/DKIM/DMARC, blacklist and SMTP checks on a domain or IP.

The MxToolbox MX lookup page says the test "will list MX records for a domain in priority order" and that the lookup "is done directly against the domain's authoritative name server". It says the Diagnostics option "will connect to the mail server, verify reverse DNS records, perform a simple Open Relay check and measure response time performance". Each MX record's IP address can also be checked against "DNS based blacklists", which the page says are "Commonly called RBLs, DNSBLs".

#### SecurityTrails

- Page: https://osintyourself.com/tools/securitytrails
- Cost: Freemium
- Dual-use: no
- Official site: https://securitytrails.com
- Last verified: 2026-08-31

Historical DNS, WHOIS and subdomain data for domains and IP addresses.

Description source: archived copy of the vendor's page, captured 2026-10-08.
An archived copy of the SecurityTrails home page, captured 2026-10-08, says "Use the SecurityTrails API to fetch any domain, DNS, and IP-related data." The page says the API "Allows your apps to use our current and historical data", and labels its data counters "Historical DNS lookups", "Historical WHOIS records", "Total hostnames tracked" and "Domains tracked". One listed use is "Manage infrastructure sprawl and find forgotten digital assets".

#### Subfinder

- Page: https://osintyourself.com/tools/subfinder
- Cost: Open source
- Dual-use: no
- Official site: https://github.com/projectdiscovery/subfinder
- Source code: https://github.com/projectdiscovery/subfinder
- Last verified: 2026-10-06

Fast passive subdomain discovery tool that enumerates valid subdomains for a domain.

Subfinder is an open-source subdomain discovery tool that returns valid subdomains for a domain using passive online sources. It has a modular architecture, supports JSON, file and stdout output, and can be used with STDIN and STDOUT in command-line workflows.

#### ViewDNS.info

- Page: https://osintyourself.com/tools/viewdns
- Cost: Free
- Dual-use: no
- Official site: https://viewdns.info
- Last verified: 2026-10-12

Collection of free DNS, WHOIS, reverse-IP and network lookup tools.

ViewDNS.info lists free tools including Reverse IP Lookup (find all sites hosted on a given server), IP History (historical IP addresses for a domain), Subdomain Discovery (find all known subdomains for a domain) and DNS Record Lookup (view all DNS records for a specified domain). It also lists a Port Scanner that checks if common ports are open on a server, a Global Ping Test from multiple locations worldwide and a DNS Propagation Checker.

#### Waymore

- Page: https://osintyourself.com/tools/waymore
- Cost: Open source
- Dual-use: no
- Official site: https://github.com/xnl-h4ck3r/waymore
- Source code: https://github.com/xnl-h4ck3r/waymore
- Last verified: 2026-10-06

Pulls a domain's archived URLs from the Wayback Machine and other sources for recon.

Waymore is an open-source reconnaissance tool that collects a domain's archived URLs from the Wayback Machine and other sources such as Common Crawl, Alien Vault OTX, URLScan and Virus Total. According to its README it can also download the archived responses for Wayback Machine and URLScan URLs so they can be searched for further links, developer comments and parameters.

#### Whoxy

- Page: https://osintyourself.com/tools/whoxy
- Cost: Freemium
- Dual-use: no
- Official site: https://www.whoxy.com
- Last verified: 2026-10-12

WHOIS lookup and reverse-WHOIS history, including registrant-name search.

Privacy note: Domains you register with real details are searchable by your name or email here.

Whoxy offers a WHOIS API, described on its home page as a hosted web service that returns well-parsed WHOIS fields in XML and JSON formats per HTTP request, along with a WHOIS History API and a Reverse WHOIS API. Its search box offers Whois Lookup, Whois History, Owner Name, Company Name, Email Address and Domain Keyword searches. The page advertises free account signup, zero monthly fee and pay as you go.

#### crt.sh

- Page: https://osintyourself.com/tools/crt-sh
- Cost: Free
- Dual-use: no
- Official site: https://crt.sh
- Last verified: 2026-08-31

Searches Certificate Transparency logs to enumerate a domain's certificates and subdomains.

#### dnstwist

- Page: https://osintyourself.com/tools/dnstwist
- Cost: Open source
- Dual-use: no
- Official site: https://github.com/elceef/dnstwist
- Source code: https://github.com/elceef/dnstwist
- Last verified: 2026-10-06

Generates and checks domain permutations to detect typosquatting and phishing lookalikes.

dnstwist is an open-source command-line tool that generates permutations of a domain name and checks which of them are in use, to find lookalike domains that could be used for typosquatting, phishing or brand impersonation. It can also compare the web pages of lookalike domains using fuzzy hashes, and exports results to CSV and JSON.

### Breach & Leak Data

Tools and services that search known data breaches and leaks for exposed email addresses, usernames and credentials.

#### BreachDirectory

- Page: https://osintyourself.com/tools/breachdirectory
- Cost: Free
- Dual-use: yes
- Official site: https://breachdirectory.org
- Last verified: 2026-08-31

BreachDirectory is a free breach-search tool for OSINT investigations: enter an email address or username to check whether it appears in known public data breaches, so you can spot exposed accounts and know which passwords to rotate.

Privacy note: Check whether your email or username appears in known breaches.

#### DeHashed

- Page: https://osintyourself.com/tools/dehashed
- Cost: Paid
- Dual-use: yes
- Official site: https://dehashed.com
- Last verified: 2026-10-12

Search engine over billions of breached credentials and personal records.

Privacy note: Assume any password in a past breach is public — check and rotate yours.

DeHashed's home page describes its search as collecting sensitive data that has been posted on the clear-web and deep-web. It also lists a monitoring service that sends breach notifications by text message, email or webhook whenever a data breach affecting you or your organization occurs, and an API for building advanced queries and programmatically pulling data into your own apps.

#### Have I Been Pwned

- Page: https://osintyourself.com/tools/have-i-been-pwned
- Cost: Free
- Dual-use: no
- Official site: https://haveibeenpwned.com
- Last verified: 2026-10-12

Checks emails/accounts against known breaches.

Privacy note: The defensive counterpart to breach-hunting tools — lets you check your own exposure rather than someone else's.

#### Hudson Rock

- Page: https://osintyourself.com/tools/hudson-rock
- Cost: Freemium
- Dual-use: yes
- Official site: https://www.hudsonrock.com
- Last verified: 2026-10-01

Infostealer-intelligence platform for finding devices and credentials compromised by stealer malware.

Privacy note: Hudson Rock's data comes from infostealer-malware logs; if a device you used was infected, saved logins for your accounts may be searchable by email or domain.

Hudson Rock is an infostealer intelligence platform for finding devices and credentials that stealer malware has compromised. It is commonly used in incident response and threat hunting work.

#### Intelligence X

- Page: https://osintyourself.com/tools/intelx
- Cost: Freemium
- Dual-use: yes
- Official site: https://intelx.io
- Last verified: 2026-10-17

Search engine over leaks, pastes, darknet and historical web data.

Privacy note: Leaked data tied to you may be searchable here — check your exposure.

Intelligence X describes itself as a search engine and data archive. Its About page says the search works with selectors, meaning specific search terms, and searches in places such as the darknet and public data leaks. It says it keeps a historical data archive of results, similar to how the Wayback Machine stores historical copies of websites.

#### LeakCheck

- Page: https://osintyourself.com/tools/leakcheck
- Cost: Freemium
- Dual-use: yes
- Official site: https://leakcheck.io
- Last verified: 2026-10-24

Data-breach search engine for exposed emails, usernames and passwords.

Privacy note: Check whether your credentials appear in known breaches.

LeakCheck's page lists 10B+ entries in its database from 1,366+ breach sources, searchable by email or username in the browser or through an API. It offers breach monitoring that alerts you when a monitored email address or username turns up in a newly added leak, and BulkCheck for uploading files. Its FAQ says passwords are hidden in results on free accounts. Its removal guide says a leak tied to your email address can be made unsearchable on LeakCheck through a removal request, that the data stays available where it was retrieved from, and that a leak containing only usernames cannot be removed.

#### Snusbase

- Page: https://osintyourself.com/tools/snusbase
- Cost: Paid
- Dual-use: yes
- Official site: https://snusbase.com
- Last verified: 2026-10-12

Paid breach-search database indexing leaked credentials and personal data.

Privacy note: Data leaked about you may be indexed here — check and secure affected accounts.

Snusbase says on its home page that it "indexes information from websites that have experienced database leaks" and has "made it easy to stay on top of the latest database breaches since its debut in 2016". It says its "search API is available free of charge to any paying member up to 2048 requests per day". The vendor states "We do not store any data on your search terms"; that is its own claim and has not been tested here.

#### SpyCloud

- Page: https://osintyourself.com/tools/spycloud
- Cost: Paid
- Dual-use: yes
- Official site: https://spycloud.com
- Last verified: 2026-10-01

Enterprise identity-threat platform built on credentials and data recaptured from breaches and infostealer malware.

Privacy note: SpyCloud indexes credentials and identity data recaptured from breaches and infostealer malware for enterprise customers. Its free check reports an organisation's exposure, not what it holds on you personally.

SpyCloud is an enterprise platform built on credentials and data recaptured from breaches and infostealer malware. It helps organizations identify compromised identities and assess account-takeover risk, and is typically used by security teams to protect user accounts.

### People Search & Public Records

Company registries, filings and ownership databases, offshore-leak and relationship databases, sanctions and watchlist data, and people-search and identity-data services that aggregate public records.

#### Companies House

- Page: https://osintyourself.com/tools/companies-house
- Cost: Free
- Dual-use: no
- Official site: https://find-and-update.company-information.service.gov.uk
- Last verified: 2026-10-01

UK government register for searching company filings, officers and persons with significant control.

Companies House is the UK government register that provides public access to company filings, officer details, and persons with significant control. It is a resource for checking corporate entities and identifying individuals associated with registered businesses in the United Kingdom. Researchers use it to trace ownership structures and review official statutory documents submitted by companies.

#### Crunchbase

- Page: https://osintyourself.com/tools/crunchbase
- Cost: Freemium
- Dual-use: no
- Official site: https://www.crunchbase.com
- Last verified: 2026-10-01

Company and investor database covering funding rounds, leadership and acquisitions for startups and private companies.

Crunchbase is a database that tracks funding rounds, leadership changes, and acquisitions for startups and private companies. It is commonly used by researchers and journalists to identify investors and map out business relationships.

#### FastPeopleSearch

- Page: https://osintyourself.com/tools/fastpeoplesearch
- Cost: Free
- Dual-use: yes
- Official site: https://www.fastpeoplesearch.com
- Last verified: 2026-08-31

Free US people lookup by name, phone or address.

Privacy note: Your address, phone and relatives may be listed here — a free opt-out is available.

Description source: archived copy of the vendor's page, captured 2026-10-12.
In an archived copy of its homepage, FastPeopleSearch says: "Find a person by name, phone number, or street address." It states "Our people search is 100% FREE!" and that its data "includes landline, cell phone, business and residential phone numbers, as well as information for addresses and people all across the U.S." These are the vendor's own statements and have not been tested here.

#### ICIJ Offshore Leaks Database

- Page: https://osintyourself.com/tools/icij-offshore-leaks
- Cost: Free
- Dual-use: no
- Official site: https://offshoreleaks.icij.org
- Last verified: 2026-10-01

ICIJ's searchable database of offshore entities and officers from the Panama, Paradise and Pandora Papers and other leaks.

The ICIJ Offshore Leaks Database is a searchable archive of information from major journalistic investigations into offshore finance. It allows researchers to examine connections between offshore entities and their officers revealed in documents like the Panama, Paradise and Pandora Papers. It is typically used for investigative journalism and academic research into offshore corporate structures. ICIJ states that there are legitimate uses for offshore companies and trusts, and that appearing in the database does not imply improper conduct.

#### LittleSis

- Page: https://osintyourself.com/tools/littlesis
- Cost: Free
- Dual-use: no
- Official site: https://littlesis.org

Free database mapping relationships between powerful people and organizations.

#### OpenCorporates

- Page: https://osintyourself.com/tools/opencorporates
- Cost: Freemium
- Dual-use: no
- Official site: https://opencorporates.com
- Last verified: 2026-10-12

Largest open database of companies and their officers from official registries.

Privacy note: Company directorships you hold are public and searchable here.

OpenCorporates says its information comes direct from official primary sources across 140+ jurisdictions. Its home-page search lets you choose Companies or Officers and pick a jurisdiction, and there is an advanced search as well. For use in your own applications it links API developer documentation and a bulk-delivery guide. Its listed use cases include investigations and third-party risk management.

#### OpenSanctions

- Page: https://osintyourself.com/tools/opensanctions
- Cost: Freemium
- Dual-use: no
- Official site: https://www.opensanctions.org
- Source code: https://github.com/opensanctions/opensanctions
- Last verified: 2026-10-06

Open database of sanctioned entities, politically exposed persons and other watchlists.

OpenSanctions is an open-source database that aggregates sanctions lists, politically exposed persons and other watchlists from hundreds of sources. It offers an entity search covering people, companies, vessels and more, and its site says investigators and journalists rely on the data.

#### Pipl

- Page: https://osintyourself.com/tools/pipl
- Cost: Paid
- Dual-use: yes
- Official site: https://pipl.com
- Last verified: 2026-10-01

Enterprise identity-data service that links names, emails, phones and addresses for fraud and verification teams.

Privacy note: Pipl compiles identity records (names, emails, phones, addresses) about individuals for enterprise fraud and verification customers. It is not a public self-serve search; Pipl publishes a disclosure and deletion request form (pipl.com/personal-information-removal-request).

Pipl is an enterprise identity data service that links names, emails, phone numbers, and addresses. It is typically used by fraud prevention and verification teams to check the details people provide.

#### SEC EDGAR Full-Text Search

- Page: https://osintyourself.com/tools/sec-edgar
- Cost: Free
- Dual-use: no
- Official site: https://www.sec.gov/edgar/search/
- Last verified: 2026-10-01

Full-text search across SEC filings back to 2001 by company, filer name, form type and keyword.

This tool provides full-text search across Securities and Exchange Commission filings dating back to 2001. Users can query documents by company, filer name, form type, or specific keywords to locate public corporate disclosures. It is commonly used for researching company disclosures and filing history.

#### Spokeo

- Page: https://osintyourself.com/tools/spokeo
- Cost: Paid
- Dual-use: yes
- Official site: https://www.spokeo.com
- Last verified: 2026-10-12

People-search service aggregating public records and social profiles.

Privacy note: Your profile is likely compiled here — Spokeo offers an opt-out.

#### ThatsThem

- Page: https://osintyourself.com/tools/thatsthem
- Cost: Free
- Dual-use: yes
- Official site: https://thatsthem.com
- Last verified: 2026-08-31

Free people search aggregating names, addresses, emails and phone numbers.

Privacy note: Your contact details may be listed here — an opt-out is available.

Description source: archived copy of the vendor's page, captured 2026-10-16.
The vendor's FAQ says ThatsThem's data "is aggregated from more than 50 sources each of which is updated monthly"; that is the vendor's own claim and has not been tested here. Its page footer states "Information returned by ThatsThem.com is not authoritative. Before relying on this information, you will need to do your own research to verify and validate it."

#### TruePeopleSearch

- Page: https://osintyourself.com/tools/truepeoplesearch
- Cost: Free
- Dual-use: yes
- Official site: https://www.truepeoplesearch.com
- Last verified: 2026-08-31

Free US people search returning addresses, phone numbers and relatives.

Privacy note: Your address, phone and relatives may be listed here — a free opt-out is available.

### Metadata & Document Forensics

Tools that extract metadata from documents and images, analyse images and video for signs of manipulation, and index, search and extract entities from large document collections.

#### Datashare

- Page: https://osintyourself.com/tools/datashare
- Cost: Open source
- Dual-use: no
- Official site: https://datashare.icij.org
- Source code: https://github.com/ICIJ/datashare
- Last verified: 2026-10-06

ICIJ's tool for indexing, searching and extracting entities from large document sets.

Datashare is an open-source, self-hosted search engine built by the International Consortium of Investigative Journalists for finding stories in large collections of files. It offers full-text search across formats such as PDFs, emails and office documents, OCR for scanned images, and named-entity extraction for people, organisations and locations.

#### ExifTool

- Page: https://osintyourself.com/tools/exiftool
- Cost: Open source
- Dual-use: no
- Official site: https://exiftool.org
- Source code: https://github.com/exiftool/exiftool
- Last verified: 2026-10-12

Extracts hidden metadata from images, documents, and media.

Privacy note: Photos and documents often carry embedded GPS coordinates, device IDs and edit history — strip metadata before sharing files publicly.

ExifTool's home page describes it as a platform-independent Perl library plus a command-line application for reading, writing and editing meta information in a wide variety of files. Its description names EXIF, GPS, IPTC and XMP among the metadata it handles. Listed features include output in tab-delimited, HTML, XML and JSON, comparing two files for metadata differences, and deleting meta information individually, in groups, or altogether. It is also available as a Windows executable and a MacOS package.

#### FOCA

- Page: https://osintyourself.com/tools/foca
- Cost: Open source
- Dual-use: no
- Official site: https://github.com/ElevenPaths/FOCA
- Source code: https://github.com/ElevenPaths/FOCA
- Last verified: 2026-10-17

Extracts hidden metadata and info from Office, PDF and image files.

FOCA's README says it is a tool used mainly to find metadata and hidden information in the documents it scans. It says it can analyse a wide variety of documents and names Microsoft Office, Open Office and PDF files among them, and that local files can be added to extract the EXIF information from graphic files. The README lists Microsoft Windows (64 bits) and an instance of SQL Server 2014 or greater as requirements and gives the licence as the GNU General Public Licence.

#### Forensically

- Page: https://osintyourself.com/tools/forensically
- Cost: Free
- Dual-use: no
- Official site: https://29a.ch/photo-forensics/
- Last verified: 2026-10-01

Free in-browser image-forensics toolkit (error-level analysis, clone detection, noise analysis, metadata) that never uploads your images.

Forensically is a free, browser-based toolkit for analysing digital images without uploading them to external servers. It provides methods for error-level analysis, clone detection, noise analysis, and metadata examination.

#### FotoForensics

- Page: https://osintyourself.com/tools/fotoforensics
- Cost: Free
- Dual-use: no
- Official site: https://fotoforensics.com
- Last verified: 2026-10-12

Online error-level analysis and metadata inspection to detect edited images.

FotoForensics describes itself as providing tools and training for digital picture analysis, including error level analysis, metadata, and tutorials; its upload form lists JPEG, PNG, WebP, HEIC and AVIF as supported formats. Its FAQ says the site does not draw conclusions or interpret results and just shows raw data, and that users interpret the results. It also warns that this is a public site with no web login and no privacy, and that you should not assume submitted pictures will be kept private.

#### InVID WeVerify

- Page: https://osintyourself.com/tools/invid-weverify
- Cost: Free
- Dual-use: no
- Official site: https://weverify.eu
- Last verified: 2026-10-06

Browser plugin for verifying and analyzing images and videos found on social media.

The InVID-WeVerify verification plugin is a browser extension that bundles tools for working with images, videos and social media content, aimed at journalists, fact-checkers, researchers and others. According to the project's pages, its tools include image context analysis, optical character recognition in images, a FactChecks search and a forensic feature.

#### Jimpl

- Page: https://osintyourself.com/tools/jimpl
- Cost: Free
- Dual-use: no
- Official site: https://jimpl.com
- Last verified: 2026-10-12

Online EXIF viewer showing a photo's hidden camera, GPS and timestamp data.

Privacy note: Photos you share may embed GPS and device data — strip it before posting.

Jimpl reads the metadata of an uploaded photo and shows it, including date, time, camera settings and geolocation coordinates. It can also give you the photo back with the EXIF data removed. Its FAQ says a location can be found only if the picture has GPS location data, and that EXIF info cannot be relied on to be 100% true because it can be edited with available software. It says it deletes all files within 24 hours after upload.

#### Metagoofil

- Page: https://osintyourself.com/tools/metagoofil
- Cost: Open source
- Dual-use: no
- Official site: https://github.com/opsdisk/metagoofil
- Source code: https://github.com/opsdisk/metagoofil
- Last verified: 2026-10-17

Searches Google for public documents of chosen file types on a domain and can download them.

Its README says metagoofil "searches Google for specific types of files being publicly hosted on a web site and optionally downloads them to your local box"; the example query is site:example.com filetype:pdf. The README describes this as a maintained fork of the original laramies/metagoofil and says that, unlike the original, "a design decision was made to not do metadata analysis and instead defer to other tools like `exiftool`". It also warns that after HTTP 429 errors, "Google has rightfully detected you as a bot and will block your IP for a set period of time".

### Maps & Geospatial

Tools for satellite imagery and maps, map-data queries, flight and ship tracking, and wireless-network mapping.

#### ADS-B Exchange

- Page: https://osintyourself.com/tools/adsb-exchange
- Cost: Freemium
- Dual-use: no
- Official site: https://globe.adsbexchange.com
- Last verified: 2026-10-06

Live and historical aircraft tracking built from crowdsourced, unfiltered ADS-B receiver data.

ADS-B Exchange is a flight-tracking network that shows live and historical aircraft positions from crowdsourced, unfiltered ADS-B receiver data. Its own site describes displaying aircraft broadcasts as received, in real time and as history, for enthusiasts, researchers and journalists.

#### FlightAware

- Page: https://osintyourself.com/tools/flightaware
- Cost: Freemium
- Dual-use: no
- Official site: https://www.flightaware.com
- Last verified: 2026-10-01

Live and historical flight tracking with aircraft, airport and tail-number lookups; deeper history on paid plans.

FlightAware provides live and historical flight tracking data, allowing users to look up aircraft, airports, and tail numbers. It serves as a resource for researching aviation movements. Deeper historical records are available on paid plans.

#### Flightradar24

- Page: https://osintyourself.com/tools/flightradar24
- Cost: Freemium
- Dual-use: no
- Official site: https://www.flightradar24.com
- Last verified: 2026-10-17

Live and historical aircraft flight tracking.

Flightradar24 describes itself as a global flight tracking service that provides real-time information about thousands of aircraft around the world, available online and for iOS or Android devices. It says it tracks flights using more than 50,000 receivers, and that it combines the tracking data from each aircraft with commercial flight plan and schedule data and aircraft information from its own database.

#### Google Earth

- Page: https://osintyourself.com/tools/google-earth
- Cost: Free
- Dual-use: no
- Official site: https://earth.google.com/web/
- Last verified: 2026-10-12

Google Earth is not a live satellite feed — its imagery is periodically updated historical and aerial photography, not real-time video. For OSINT work it still offers a global historical-imagery timeline, 3D terrain views, distance and area measurement tools, and KML/KMZ support for mapping and geolocation research.

Google's Earth versions page lists Google Earth on web, Google Earth on mobile and Google Earth Pro on desktop. It describes viewing high-resolution satellite imagery, exploring 3D terrain and buildings in hundreds of cities, and Street View's 360° perspectives. It says Google Earth Pro on desktop is for users with advanced feature needs, can import and export GIS data and go back in time with historical imagery, and is available on PC, Mac, or Linux. The page also says Earth Pro will no longer be available for download beginning June 25, 2027.

#### MarineTraffic

- Page: https://osintyourself.com/tools/marinetraffic
- Cost: Freemium
- Dual-use: no
- Official site: https://www.marinetraffic.com
- Last verified: 2026-08-31

Live and historical ship and vessel tracking via AIS.

#### NASA FIRMS

- Page: https://osintyourself.com/tools/nasa-firms
- Cost: Free
- Dual-use: no
- Official site: https://firms.modaps.eosdis.nasa.gov
- Last verified: 2026-10-01

NASA's Fire Information for Resource Management System, mapping near-real-time satellite fire and thermal-anomaly detections.

NASA FIRMS provides near-real-time satellite data on fire and thermal anomalies globally. Researchers and decision-makers use this free tool to monitor active fires and thermal anomalies, which it presents on a web map.

#### OpenStreetMap

- Page: https://osintyourself.com/tools/openstreetmap
- Cost: Free
- Dual-use: no
- Official site: https://www.openstreetmap.org
- Last verified: 2026-10-17

Free, editable world map with rich open geographic data.

The OpenStreetMap about page says the project "is built by a community of mappers that contribute and maintain data about roads, trails, cafés, railway stations, and much more, all over the world", and that contributors "use aerial imagery, GPS devices, and low-tech field maps". It states "OpenStreetMap is open data: you are free to use it for any purpose as long as you credit OpenStreetMap and its contributors", adding that if you alter or build upon the data in certain ways, "you may distribute the result only under the same licence".

#### Overpass Turbo

- Page: https://osintyourself.com/tools/overpass-turbo
- Cost: Free
- Dual-use: no
- Official site: https://overpass-turbo.eu
- Last verified: 2026-10-17

Query and visualize OpenStreetMap data by feature and area.

Its README describes overpass turbo as "a GUI for testing and developing queries for the Overpass-API" and says it can also be used for simple analysis of OSM data. The README lists overpass-turbo.eu as the stable version and tyrasd.github.io/overpass-turbo as the latest version. Other applications can link to it with URL parameters, for example to provide a query to load, set the initial map location or load a template.

#### VesselFinder

- Page: https://osintyourself.com/tools/vesselfinder
- Cost: Freemium
- Dual-use: no
- Official site: https://www.vesselfinder.com
- Last verified: 2026-10-01

Live AIS ship-tracking map with vessel details, ports and voyage history; extended data on paid plans.

VesselFinder provides a live map for tracking ships using Automatic Identification System data, displaying vessel details, port locations, and voyage history. Extended data is available on paid plans.

#### WiGLE

- Page: https://osintyourself.com/tools/wigle
- Cost: Freemium
- Dual-use: yes
- Official site: https://wigle.net
- Last verified: 2026-08-31

Crowdsourced map and database of Wi-Fi networks and cell towers by location.

Privacy note: Your Wi-Fi network name and its rough location may be mapped here.

### Dark Web & Threat Intelligence

Tools for accessing and searching Tor services, scanning URLs and files, and checking or sharing indicators of compromise.

#### ANY.RUN

- Page: https://osintyourself.com/tools/any-run
- Cost: Freemium
- Dual-use: no
- Official site: https://any.run
- Last verified: 2026-10-01

Interactive online malware sandbox that runs suspicious files and URLs and records their behaviour.

ANY.RUN is an interactive online malware sandbox that runs suspicious files and URLs and records their behaviour. It is commonly used by security professionals and researchers in threat intelligence and incident response work.

#### AbuseIPDB

- Page: https://osintyourself.com/tools/abuseipdb
- Cost: Freemium
- Dual-use: no
- Official site: https://www.abuseipdb.com
- Last verified: 2026-10-01

Community-maintained database of reported malicious IP addresses, with reputation lookups and a free API tier.

Description source: archived copy of the vendor's page, captured 2026-10-05.
AbuseIPDB says it provides a central blacklist for webmasters, system administrators and other interested parties to report and find IP addresses that have been associated with malicious activity online. Its page lets users check the report history of an IP address to see whether anyone else has reported malicious activities, and offers a free API to report abusive IPs and check whether an IP has been reported. The page says: "You can report an IP address associated with malicious activity, or check to see if an IP address has been reported, by using the search box above."

#### Ahmia

- Page: https://osintyourself.com/tools/ahmia
- Cost: Free
- Dual-use: no
- Official site: https://ahmia.fi
- Last verified: 2026-10-12

Search engine for Tor hidden services (.onion), excluding abuse material.

Ahmia's home page says it searches hidden services on the Tor network and that you need the Tor browser bundle to access them. It says abuse material is not allowed on Ahmia and asks visitors to report abuse material found in the index, which it says will be removed as soon as possible. The About page says Ahmia is developed on GitHub as a free and open source project, and that onion service operators can add onion domains and sub-domains for indexing.

#### AlienVault OTX

- Page: https://osintyourself.com/tools/alienvault-otx
- Cost: Free
- Dual-use: no
- Official site: https://otx.alienvault.com
- Last verified: 2026-08-31

Open Threat Exchange sharing community indicators of compromise.

Description source: archived copy of the vendor's page, captured 2026-09-23.
Open Threat Exchange's API documentation page says "The OTX DirectConnect API allows you to easily synchronize the Threat Intelligence available in OTX to the tools you use to monitor your environment." It also says the DirectConnect SDK is "available in Java and Python".

#### MISP

- Page: https://osintyourself.com/tools/misp
- Cost: Open source
- Dual-use: no
- Official site: https://www.misp-project.org
- Source code: https://github.com/MISP/MISP
- Last verified: 2026-10-12

Open-source platform for sharing and correlating threat intelligence.

MISP's README describes it as "an open source software solution for collecting, storing, distributing and sharing cyber security indicators and threats". It lists an automatic correlation engine that reveals relationships between attributes and indicators, and says MISP can automatically synchronize events and attributes among different MISP instances. Exports include OpenIOC, CSV, MISP JSON and STIX, and the data is also reachable through a ReST API described as OpenAPI.

#### Tor Browser

- Page: https://osintyourself.com/tools/tor-browser
- Cost: Open source
- Dual-use: no
- Official site: https://www.torproject.org
- Source code: https://gitlab.torproject.org/tpo/applications/tor-browser
- Last verified: 2026-10-01

Privacy-focused browser that routes traffic through the Tor network and can open .onion hidden services.

Tor Browser is a privacy-focused web browser that routes internet traffic through the Tor network and can open .onion hidden services. Researchers commonly use it when they need to reach .onion sites.

#### VirusTotal

- Page: https://osintyourself.com/tools/virustotal
- Cost: Freemium
- Dual-use: no
- Official site: https://www.virustotal.com
- Last verified: 2026-10-12

Scans files and URLs against many engines and aggregates threat intel.

VirusTotal says it inspects items with over 70 antivirus scanners and URL/domain blocklisting services, in addition to a myriad of tools to extract signals from the studied content. Its How it works page lists file submission methods including the primary public web interface, desktop uploaders, browser extensions and a programmatic API, and says VirusTotal is free to end users for non-commercial use in accordance with its Terms of Service.

#### urlscan.io

- Page: https://osintyourself.com/tools/urlscan
- Cost: Freemium
- Dual-use: no
- Official site: https://urlscan.io
- Last verified: 2026-10-17

Sandboxes and analyzes websites, capturing requests, screenshots and tech.

The urlscan.io About page calls it "a free service to scan and analyze websites". It says that when a URL is submitted, "an automated process will browse to the URL like a regular user and record the activity that this page navigation creates", including "the domains and IPs contacted" and the requested resources, and that it will "take a screenshot of the page, record the DOM content, JavaScript global variables, cookies created by the page". The page adds that "we also offer commercial products for heavy users and organizations that need additional insight".

### All-in-one Frameworks & Aggregators

Multi-source OSINT frameworks and platforms, collections of tools and techniques, investigation notes and capture software, web archives, and search tools for source code and Google dorks.

#### Bellingcat Online Investigation Toolkit

- Page: https://osintyourself.com/tools/bellingcat-toolkit
- Cost: Free
- Dual-use: no
- Official site: https://bellingcat.gitbook.io/toolkit
- Last verified: 2026-10-12

Curated, maintained directory of open-source investigation tools.

Bellingcat's page says the toolkit provides regularly updated deep-dive reviews of satellite and mapping services, tools for verifying photos and videos, and websites to archive web pages. Tools are grouped into categories such as Maps & Satellites, Geolocation and Companies & Finance, and the toolkit can be downloaded as a csv. The page also says inclusion does not imply that Bellingcat endorses or recommends a specific tool and that some listed tools come with significant caveats.

#### Google Hacking Database

- Page: https://osintyourself.com/tools/ghdb
- Cost: Free
- Dual-use: no
- Official site: https://www.exploit-db.com/google-hacking-database
- Last verified: 2026-10-06

Exploit-DB's curated archive of Google search queries ("dorks") that surface exposed data.

The Google Hacking Database is Exploit-DB's index of search queries, called dorks, used to find publicly available information, and its maintainers describe it as intended for pentesters and security researchers. Entries are organised into categories such as Sensitive Directories, Vulnerable Servers and Error Messages.

#### Hunchly

- Page: https://osintyourself.com/tools/hunchly
- Cost: Paid
- Dual-use: no
- Official site: https://www.hunch.ly
- Last verified: 2026-10-06

Browser capture tool that automatically logs and timestamps webpages visited during research.

Hunchly is a browser capture tool that automatically records the URL, timestamp and hash of each page visited during research and makes full-page captures of sites, searches and social media. Captures can be categorised, tagged and searched, and stored either locally or in cloud storage.

#### IntelTechniques

- Page: https://osintyourself.com/tools/inteltechniques
- Cost: Freemium
- Dual-use: no
- Official site: https://inteltechniques.com
- Last verified: 2026-10-12

Michael Bazzell's OSINT search tools, books and training resources.

The IntelTechniques home page calls itself "the new home for all of our sites". It says it offers "print and digital books about OSINT and Privacy" in its Book Store and a quarterly magazine, and an Online Video Training for becoming a "certified Open Source Intelligence Professional (OSIP)".

#### OSINT Framework

- Page: https://osintyourself.com/tools/osint-framework
- Cost: Free
- Dual-use: no
- Official site: https://osintframework.com
- Last verified: 2026-10-12

Web directory categorizing hundreds of OSINT tools and data sources.

The OSINT Framework page describes it as "focused on gathering information from free tools or resources", with the intention "to help people find free OSINT resources". A key on the page explains four letters: T (a link to a tool that must be installed and run locally), D (Google Dork), R (requires registration) and M (a URL that contains the search term and must be edited manually). The page warns that some included sites "might require registration or offer more data for $$$".

#### Obsidian

- Page: https://osintyourself.com/tools/obsidian
- Cost: Freemium
- Dual-use: no
- Official site: https://obsidian.md
- Last verified: 2026-10-06

Local markdown note-taking app used by investigators to organize and link case notes.

Obsidian is a markdown note-taking app that stores notes on the user's device, works offline, and lets users link notes to one another. This directory lists it because it can be used to keep case notes.

#### Recon-ng

- Page: https://osintyourself.com/tools/recon-ng
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/lanmaster53/recon-ng
- Source code: https://github.com/lanmaster53/recon-ng
- Last verified: 2026-10-17

Modular web-recon framework with a Metasploit-like workflow.

Privacy note: Recon-ng is a modular web-reconnaissance framework, and what it returns about a person depends on the modules an operator installs. Its module marketplace includes modules named for turning domains into contacts (such as whois_pocs and hunter_io), contacts into profiles (fullcontact) and contacts into breach records (hibp_breach).

The Recon-ng README says it is designed exclusively for web-based open source reconnaissance and has a look and feel similar to the Metasploit Framework. It describes the framework as completely modular and points to a Development Guide for building and maintaining modules. For exploitation or social engineering, the README points to the Metasploit Framework and the Social-Engineer Toolkit instead, and it describes Recon-ng as free software.

#### ShadowDragon

- Page: https://osintyourself.com/tools/shadowdragon
- Cost: Paid
- Dual-use: yes
- Official site: https://shadowdragon.io
- Last verified: 2026-10-01

Commercial OSINT suite (SocialNet) for collecting and linking social-media and open-source data in investigations.

Privacy note: ShadowDragon's SocialNet collects and links social-media and open-source data on individuals for investigators. The vendor says SocialNet relies on publicly available information.

ShadowDragon is a commercial OSINT suite, built around its SocialNet product, for collecting and linking social-media and open-source data. It is typically used by professional investigators.

#### Skopenow

- Page: https://osintyourself.com/tools/skopenow
- Cost: Paid
- Dual-use: yes
- Official site: https://www.skopenow.com
- Last verified: 2026-10-01

Commercial OSINT platform that compiles social-media and public-record profiles for investigations and threat assessment.

Privacy note: Commercial investigation platform that compiles social-media and public-record profiles on individuals for insurers, law enforcement, security and legal teams (per the site). Skopenow publishes a redaction request form open to any individual (skopenow.com/personal-information-redaction-request).

Skopenow is a commercial OSINT platform designed to compile social media and public record profiles. It supports investigations and threat assessment.

#### Social Links

- Page: https://osintyourself.com/tools/social-links
- Cost: Paid
- Dual-use: yes
- Official site: https://sociallinks.io
- Last verified: 2026-10-01

Commercial OSINT investigation platform that gathers social-media, messenger and open-source data on a target.

Privacy note: Commercial platform that aggregates social-media, messenger and open-source data on individuals for corporate and law-enforcement investigators.

Social Links is a commercial platform designed to gather data from social media, messaging applications, and open sources for investigative purposes. It consolidates information from various online channels into a single interface, and is typically used for digital investigations.

#### Wayback Machine

- Page: https://osintyourself.com/tools/wayback-machine
- Cost: Free
- Dual-use: no
- Official site: https://web.archive.org
- Last verified: 2026-10-17

Internet Archive's index of historical snapshots of web pages.

The Wayback Machine home page says it is "an initiative of the Internet Archive, a 501(c)(3) non-profit, building a digital library of Internet sites and other cultural artifacts in digital form". Its Save Page Now section says it will "Capture a web page as it appears now for use as a trusted citation in the future".

#### archive.today

- Page: https://osintyourself.com/tools/archive-today
- Cost: Free
- Dual-use: no
- Official site: https://archive.ph
- Last verified: 2026-10-06

Web archiving service that saves and serves permanent snapshots of pages on demand.

Archive.today is a free web archiving service that takes a snapshot of a webpage on request and saves a text and a graphical copy at a short link. The site states the copy stays online even if the original page disappears, and the archive can be searched by host, by host with subdomains, or by exact URL.

#### grep.app

- Page: https://osintyourself.com/tools/grep-app
- Cost: Free
- Dual-use: no
- Official site: https://grep.app
- Last verified: 2026-10-06

Search engine for source code across public GitHub repositories.

grep.app, now presented as Grep by Vercel, is a free code search engine for finding code, files and paths across GitHub repositories, which its site puts at a million.

#### sn0int

- Page: https://osintyourself.com/tools/sn0int
- Cost: Open source
- Dual-use: yes
- Official site: https://github.com/kpcyrd/sn0int
- Source code: https://github.com/kpcyrd/sn0int
- Last verified: 2026-10-17

Semi-automatic OSINT framework and package manager for entity recon.

Privacy note: sn0int's README says it can harvest emails from PGP keyservers and whois, find somebody's profiles across the internet, discover compromised logins in breaches, gather information about phone numbers and harvest activity and images from social-media profiles. The same README says it can be used to gather intelligence "about yourself" as well as about a target.

The sn0int README describes it as a semi-automatic OSINT framework and package manager, and says it is used to gather intelligence about a given target or about yourself. It says the results are mapped in a unified format for followup investigations. The investigations are not hardcoded in the source: they are provided by modules that are executed in a sandbox, and users can share their own modules by publishing them to the sn0int registry.

## Guides

### What Someone Can Find From Your Email Address

- Page: https://osintyourself.com/learn/what-someone-can-find-from-your-email
- Reviewed: 2026-09-02

Hand someone nothing but your email address and, depending on how you have used it over the years, they can still end up with a surprisingly detailed picture: which services you have an account on, whether any of those accounts were caught up in a breach, and sometimes a name or a second identifier that lets them keep pulling the thread. None of this requires guessing a password or breaking into anything — it is mostly a matter of checking what the address itself, and the accounts registered to it, are already willing to reveal.

#### Linked accounts, found without logging in

Most sign-up and password-reset forms will confirm, one way or another, whether a given email address already has an account — even to someone who does not have the password and never gets one. Run that same check against a long list of platforms and the result is a map of where an address is registered, built entirely from public sign-up behaviour rather than anything private.

This is the core idea behind account-existence checking tools: they can, depending on which services someone has registered an address with, surface a working list of accounts tied to that email without ever needing to log in as the owner.

#### Breach history tied to the address

Separately, an email address can be checked against the large number of breach and leak datasets that have accumulated online over the years. A hit does not hand over a current password, but it confirms the address was registered on a specific service at a specific point, and depending on what that particular breach exposed, it can also surface an associated name, a second recovery address, or other account metadata that was stored alongside it.

A breach lookup service like Have I Been Pwned exists specifically to let you check your own address against this history for free, which is worth doing before assuming what a lookup on you would turn up.

#### Names, usernames, and profile leakage

Depending on how an address has been used, it can also be a pivot into a name or a username. A breach dataset that included a display name, a social account registered under the same address, or even a Gravatar-style profile photo tied to the address by its hash can all hand over a real name or a recognisable image from nothing but the email string itself.

For a Gmail address specifically, tools built around Google account investigation can, depending on what the account owner has made visible, pull additional detail such as a profile photo, a linked name, or reviews left under that account — none of it hidden exactly, but not something most people expect their email address alone to unlock.

The domain the address sits on matters too: a personal webmail address, a corporate address on an employer’s domain, and a disposable or temporary-mail address all read very differently to anyone piecing together a profile, and the choice of domain is itself a small signal about how the address is used.

#### How much of this applies to you

How exposed a given address is depends heavily on its history — an address used for a decade across dozens of sign-ups carries a much larger trail than one created recently and used narrowly. The same address reused for banking, social media, and a throwaway forum account concentrates all of that trail in one identifier, which is exactly what makes it worth checking against yourself the same way an outsider would.

Running an account-existence and breach check on your own address is the most direct way to see what it currently gives away — it is the same workflow described above, just pointed at yourself instead of someone else.

#### Reducing what your email reveals

The most effective structural fix is separation: using distinct addresses for distinct contexts — one for finance, one for shopping and newsletters, one for social platforms — so that a single breach or lookup cannot connect all of your accounts to one identifier. Provider-level aliasing, where your inbox supports it, lets you generate effectively unlimited variants without managing separate accounts.

Beyond separation, checking your own breach exposure periodically and removing yourself from data-broker listings that surface alongside an address are the two habits that keep the picture from growing stale.

FAQ:

**Q: Can someone find my name from just my email address?**

A: Sometimes, depending on your footprint — a breach dataset, a linked social account, or a Google account lookup can surface a name or profile photo tied to the address. It is not guaranteed for every address, and any name found this way is a lead to verify, not a confirmed identity.

**Q: Does checking my own email for breaches cost anything?**

A: No — breach-notification services like Have I Been Pwned are built for exactly this and are free to use on your own address.

**Q: Is it legal for someone to look up my email address this way?**

A: Checking whether a public account exists under an address is different from what someone does with that information afterward, and laws vary by jurisdiction. Consent matters — see the ethics-and-law guide if you are unsure.

**Q: Does using one email for everything make me easier to find?**

A: Yes, qualitatively — reusing the same address across many sign-ups concentrates your account trail in a single identifier, so a breach or lookup on that one address can surface more of your footprint at once than it would if you had used separate addresses.

**Q: How do I stop my email from linking my accounts together?**

A: Use separate addresses, or provider-level aliases, for separate contexts — finance, shopping, social — and check your existing exposure with a breach lookup so you know what a current search on your address would already show.

Sources:

- https://haveibeenpwned.com/
- https://github.com/megadose/holehe
- https://github.com/mxrch/GHunt
- https://epieos.com
- https://hunter.io

### What Someone Can Find From Your Phone Number

- Page: https://osintyourself.com/learn/what-someone-can-find-from-your-phone-number
- Reviewed: 2026-09-02

A phone number looks like ten anonymous digits, but it is not. Beyond the number itself, it can point to a carrier and a rough region, tie back to messaging-app accounts registered under it, and — via people-search sites that aggregate public records and broker feeds — sometimes to a name, an address, and family connections. None of this needs a warrant or special access; it is mostly a matter of checking what carriers, apps, and aggregators already make findable.

#### Carrier, line type, and region

The number itself already encodes a country code and, in most numbering plans, an area code or prefix pointing to a rough region and sometimes a specific carrier. A carrier and line-type lookup can go further and distinguish a mobile number from a landline or a VoIP number, which matters because a VoIP number is cheap, disposable, and far less tied to a real, stable identity than a long-held mobile contract.

A tool built for this kind of footprinting, such as PhoneInfoga, can work from an international number through carrier and line-type detail and out to other OSINT sources tied to it, depending on what is available for that specific number.

#### Accounts and messaging apps linked to the number

Many messaging and social apps let you check whether a given number is already registered with them — the same account-existence pattern used for email addresses — which can, depending on the app and the account’s privacy settings, surface a linked display name or profile photo without ever messaging the number directly.

Dedicated phone-OSINT tools can automate parts of this — checking format and carrier, and flagging where a number appears — rather than checking each app by hand, though how much they surface depends entirely on what the number is publicly tied to.

#### People-search listings

Separately from any account check, people-search aggregators like ThatsThem compile names, addresses, and phone numbers from public records and data-broker feeds, and can surface a household or family connection tied to a number even when no messaging-app check does. These listings are built from the same kind of public-record and broker data that feeds name-and-address lookups, just indexed by phone number instead.

A listing like this is a lead, not a confirmed current identity — numbers get reassigned and ported between people, so a people-search result can describe whoever held the number previously rather than its current owner.

#### SIM-swap and social-engineering risk

A phone number is also often the recovery path into other accounts via SMS-based two-factor authentication, which is why a number that is easy to find, combined with enough personal detail found elsewhere, can feed a SIM-swap or account-recovery social-engineering attempt aimed at a carrier’s support line rather than at the phone itself. The number being findable is one input into that risk, not the whole of it — but it is the one this guide is about.

#### Reducing your own number’s exposure

Avoid posting your primary number publicly, and consider a secondary number — through a carrier’s own second-line feature or a separate VoIP number — for sign-ups and listings where you do not want your main line tied to the account. Be deliberate about which apps get contact-list access, since syncing contacts is one of the more common ways a number ends up linked to a name and photo it was never directly given to.

Most people-search aggregators offer some form of opt-out, and removing your number from them directly closes off the listing itself rather than just making it harder to notice.

FAQ:

**Q: Can someone find my home address from just my phone number?**

A: Sometimes, depending on your footprint — if a people-search aggregator has a listing tying that number to a name and address from public records or a broker feed. This is exactly the kind of listing the data-removal guide covers opting out of.

**Q: Are phone number lookups always accurate?**

A: No. Numbers are reassigned and ported between people, VoIP numbers can be disposable, and a listing can easily reflect a previous owner rather than the current one. Treat any single result as a lead, not a confirmed identity.

**Q: Does a VoIP number protect my privacy better than my real mobile number?**

A: It can, qualitatively, for sign-ups you do not want tied to your main line, since VoIP numbers are less consistently linked to a stable real-world identity. It is not a complete defence — some services flag or restrict VoIP numbers specifically because of this.

**Q: Is it legal to look up someone’s phone number?**

A: This depends on what you do with the result and where you are, and laws vary by jurisdiction. Consent and context matter — see the ethics-and-law guide.

**Q: How do I get my number off people-search sites?**

A: Avoid posting it publicly, use a secondary number for sign-ups where possible, limit which apps get contact-list access, and opt out of aggregators directly using the process in the data-removal guide.

Sources:

- https://github.com/sundowndev/phoneinfoga
- https://thatsthem.com
- https://www.truepeoplesearch.com
- https://www.fcc.gov/consumers/guides/wireless-number-portability

### What Someone Can Find From Your Username

- Page: https://osintyourself.com/learn/what-someone-can-find-from-your-username
- Reviewed: 2026-09-02

Most people do not invent a new username for every account they create. They reuse the same handle, or a close variant of it, out of habit — which means a single string of characters picked years ago for one forgotten forum can still be sitting on a dating app, a fitness tracker, and a professional network today, all under the same name. Checking where else a handle has been registered does not require guessing a password; it is mostly a matter of looking, systematically, at whether that exact username exists elsewhere.

#### One handle spanning many platforms

When a platform asks for a username, the natural instinct is to reuse whatever handle you already use elsewhere, or a small variation of it — the same word with a different number tacked on, an underscore swapped in, or a common prefix. That habit is convenient at sign-up time, but it also creates a thread connecting otherwise unrelated corners of a person’s online life, tied together by nothing but the handle itself.

A username enumeration tool — the class of tool popularised by projects like Sherlock — takes a single handle and checks whether an account with that exact name exists across a long list of sites, typically by requesting each site’s profile URL pattern and reading whether the response indicates a profile exists. Depending on how widely a handle has been reused, this can surface a working list of accounts spanning years and very different platforms.

#### Cross-linking profiles, bios, and avatars

A hit from an enumeration tool only confirms that an account with that exact username exists somewhere — it does not by itself confirm ownership, especially for short or common handles that unrelated people could plausibly have picked independently. What turns a list of hits into a real profile is corroboration: comparing avatars, bios, claimed locations, and posting topics across the hits to see how many independent details line up.

A reused profile photo does a lot of this linking work on its own, even across accounts with different usernames — a reverse image search on an avatar can connect profiles that a username check alone would miss. So can a bio that repeats the same wording, a linked website, or an outbound link to another confirmed profile. The more of these line up across accounts, the more confident a researcher — or anyone else — can be that they belong to the same person.

#### Deanonymisation risk of handle reuse

This is where handle reuse becomes a genuine privacy risk rather than just a convenience trade-off: a username picked for an anonymous account — a pseudonymous forum, a niche community, an account meant to stay separate from a real name — can be linked back to a professional or personal identity if the same or a near-identical handle turns up on an account that is tied to a real name elsewhere.

The link, when it happens, is usually not anything either account explicitly says — it is the handle itself, or the avatar, or the bio, doing the connecting. Depending on how consistently a handle has been reused across a person’s accounts, this can undo an intended separation between an anonymous presence and a named one.

#### Corroborating a match before trusting it

Treat every hit as a lead, not a confirmed identity. Short, dictionary-word, or otherwise "desirable" usernames get reused by unrelated people constantly, so a match on a common name plus a birth year is much weaker evidence than a match on an unusual, invented word unlikely to have been picked twice by coincidence. Enumeration tools can also misreport when a site serves a generic page regardless of whether an account exists, so a result worth relying on is worth opening and checking by hand.

#### Making your own handles harder to link

The same technique that traces someone else’s accounts works just as well against your own, so it is worth running a check on the handles you actually use — a forgotten dormant account under a familiar handle is still a live data point for anyone running the same search against you.

Going forward, the simplest defence is deliberately not reusing the same handle across contexts you want kept separate — a distinct username for anything you do not want linked to your real name or professional accounts, rather than a variant close enough to still be recognisable. Reusing the same profile photo across accounts undermines this even when the usernames differ, since the avatar becomes the new thread connecting them.

FAQ:

**Q: Can one reused username really connect all my accounts?**

A: Depending on how consistently you have reused it, yes — an enumeration check across platforms can surface every account registered under the same handle, and a reused avatar or bio can strengthen the link even further.

**Q: Is a username match on its own proof it is the same person?**

A: No. A hit only confirms an account with that exact handle exists on that site. Short or common usernames especially can be picked independently by unrelated people, so a match needs corroboration — a matching avatar, bio, or writing style — before it is treated as confirmed.

**Q: Does using a different username on every site actually help?**

A: Yes, qualitatively — it removes the handle itself as a link between your accounts. It is not a complete defence on its own, since a reused profile photo or writing style can still connect accounts even when the usernames differ.

**Q: Can these tools find a private account under my username?**

A: Generally they can only see what an anonymous visitor to the profile URL would see. A fully private profile may still register as "exists" without revealing its contents, depending on the platform.

**Q: Is it legal to check what a username reveals about someone else?**

A: Checking whether a public profile exists under a handle is different from what you do with that information afterward, and laws vary by jurisdiction. Consent matters — see the ethics-and-law guide if you are unsure.

Sources:

- https://github.com/sherlock-project/sherlock
- https://github.com/WebBreacher/WhatsMyName
- https://github.com/soxoj/maigret
- https://namechk.com

### What Someone Can Find From a Photo of You

- Page: https://osintyourself.com/learn/what-someone-can-find-from-your-photo
- Reviewed: 2026-09-02

A photo carries more than the picture you see. Depending on where it came from and how it has travelled since, it can carry hidden technical metadata, be matched against other copies of itself online, be matched against other photos of the same face, or simply give away a location through what is visible in the background. None of this requires special access — it is mostly a matter of checking what the file itself, and the platforms that have handled it, are already willing to reveal.

#### Hidden metadata — and why platforms usually strip it

Most cameras and phones embed a block of metadata inside a photo file alongside the image data itself: the device make and model, capture settings, and often the exact date and time, based on the camera’s own clock. Many phones also embed GPS coordinates directly into that metadata when location services were enabled at the moment the photo was taken — the single most sensitive field a photo can carry, since it can point to a specific address rather than a general area.

Many major social media and messaging platforms strip this metadata automatically on upload, which is why a photo pulled from a typical social post has usually already had it removed. That stripping is not consistent across every platform, feature, or file type, though, and it says nothing about a copy shared a different way — as a direct email attachment, over an app that does not strip it, or through cloud storage. Never assume a photo carries no location data just because it came from a platform that usually removes it — the original file, or a copy sent another way, may still have it intact. A metadata viewer tool can check the actual file directly.

#### Reverse image search — finding other copies of the same photo

A reverse image search engine does not read a photo the way a person does; it breaks the image into visual signatures and looks for other images online with a matching or similar signature. This can, depending on where a photo has been posted, surface every other place it has appeared — useful for checking whether your own photos have been reused somewhere without your knowledge, on a scam profile or a site you never uploaded to.

General engines like Google Lens and dedicated ones like TinEye each index a different slice of the web, so the same photo can return different results on different engines, and a photo kept behind a login or only shared in private messages will not show up regardless of how good the engine is.

#### Face search — the highest-risk technique here

A separate category of tool exists specifically for faces rather than whole images. A facial-recognition search engine is built to find other photos where the same face appears, across sites the person may never have linked to their name themselves — a materially more invasive capability than a general content-match search, because it can surface images the subject never intended to be connected to each other.

This is exactly why face search carries a heavier ethical weight than the rest of this list. The same capability that lets you check where your own face has been reused online can be pointed at a stranger just as easily, and doing so without consent is where a legitimate self-audit technique turns into something that enables stalking or harassment. Use a face-search tool on yourself to see what it finds — treat using it on someone else as a question for the ethics-and-law guide first, not an assumption.

#### Background and chronolocation clues

Even a photo with no metadata and no prior online copy can still give away a location through what is simply visible in it — street signs, shop names, distinctive architecture, license plates, the position of the sun, or the weather and season. Manually reading these clues, sometimes called chronolocation or geolocation from visual content, is a slower but often more reliable process than any automated match when a photo has never been indexed anywhere else.

#### Reducing what your photos reveal

Check your own photos the same way an outsider would: view the metadata on files before you share them directly rather than through a platform that strips it automatically, and run a reverse image search on photos you have posted publicly to see whether they have been reused somewhere you did not expect. Controlling who can see your photos in the first place — rather than relying on platforms to strip data after the fact — is the more durable protection, since a public photo can still be indexed, matched, or saved by anyone who sees it regardless of what metadata it carries.

FAQ:

**Q: Does every photo reveal my location?**

A: No. GPS metadata is only embedded when location services were enabled at the moment of capture, many platforms strip it on upload, and not every photo has a background detailed enough to geolocate. Whether a given photo reveals a location depends on the specific file and where it has travelled.

**Q: Is face search the same thing as reverse image search?**

A: No. A standard reverse image search compares an entire image to find matches or near-duplicates of that same image. A facial-recognition search isolates a face and finds other, different photos where that same face appears — a more powerful and more privacy-sensitive technique.

**Q: Is it legal to run a face search on someone else’s photo?**

A: Laws vary by jurisdiction, and face search carries real potential for misuse, including stalking and harassment. Consent matters — see the ethics-and-law guide before pointing a face-search tool at anyone other than yourself.

**Q: If a photo has no metadata, is it safe to assume it has no location data?**

A: No. Many platforms strip metadata automatically on upload, so a lack of visible metadata on a downloaded copy often reflects the platform’s processing rather than the original file. Check the actual file you have when it matters.

**Q: Can I remove my face from a face-search index?**

A: Some face-search tools offer a removal-request process, though results depend on the specific service and cannot be guaranteed to cover every index a photo of you may have been matched into.

Sources:

- https://www.exif.org/Exif2-2.PDF
- https://exiftool.org/
- https://lens.google
- https://tineye.com
- https://pimeyes.com
- https://facecheck.id

### What Someone Can Find From Your Home Address

- Page: https://osintyourself.com/learn/what-someone-can-find-from-your-home-address
- Reviewed: 2026-09-02

A home address is one of the more consequential pieces of personal information to have findable, because it sits at the centre of a web that people-search sites and property records are specifically built to connect: name to address, address to phone number, and address to the other people who live there. Checking what your own address currently reveals — and what it takes to get it removed — is worth doing before assuming a listing does not exist.

#### Address, name, and phone number, linked both ways

People-search sites aggregate public records and data-broker feeds into searchable profiles, and the linkage runs in both directions: search a name and get an address, or search an address and get the name (or names) of who has lived there, along with a phone number where one is on file. Sites like TruePeopleSearch and FastPeopleSearch are built around exactly this kind of free, US-focused lookup, and ThatsThem and Spokeo compile similar aggregated profiles from public records and broker feeds.

Because these listings pull from public records, court filings, voter files, and data-broker feeds rather than any single authoritative source, the same address can show up across several different aggregators with slightly different detail on each, which is part of why checking just one site does not give a complete picture of what is findable.

#### Relatives and household connections

A common feature of these listings is a "possible relatives" or associated-persons section, built from shared addresses, shared surnames, and public records that connect people living at or having lived at the same location. This means an address does not just expose the person searching for it — it can also surface names of family members or past housemates who never searched for anything themselves and may not know they are listed.

This is one of the reasons address exposure is treated more seriously than some other lookups in this series: the exposure is not fully contained to one person, and a listing can persist even after someone has moved, tied to a previous resident who has no easy way to know it is still there.

#### Property and business records

Beyond people-search aggregators, an address can also surface through official or quasi-official records: property ownership records tie an address to a legal owner’s name in many jurisdictions, and if a business is registered using a home address — common for sole proprietors and small companies — a company-registry lookup like OpenCorporates can surface that address as the registered office, tied to the owner’s name as a director or officer.

These records exist for legitimate transparency reasons — property ownership and company directorships are generally public by design in many jurisdictions — but they mean that avoiding a home address on data-broker sites alone does not fully address an address that is also on file as a registered business or property record.

#### Why removal is a recurring chore, not a one-time fix

Because people-search sites source from public records and broker feeds that are continually refreshed and resold, an address removed from one aggregator today can reappear later as that site re-ingests an updated feed, or show up on a different aggregator that was never checked in the first place. There is no single central registry to opt out of once — each aggregator maintains its own listings and its own opt-out process.

This is why address exposure tends to need periodic rechecking rather than a single cleanup pass: treat it as a recurring task, not something that is finished once the first round of opt-outs goes through.

#### Opting out

Most people-search sites, including TruePeopleSearch, FastPeopleSearch, and Spokeo, provide a free opt-out process, though the exact steps vary by site and can require locating your specific listing first. A data-broker opt-out directory can walk through the process site by site rather than requiring you to find each one’s removal page independently, and rechecking your own name and address periodically is the practical way to catch a listing that has reappeared.

FAQ:

**Q: Can someone find my phone number just from my address?**

A: Sometimes, depending on your footprint — people-search aggregators frequently list a phone number alongside an address when one is on file in the public records or broker feed they draw from.

**Q: Will my family members show up if my address is searched?**

A: They can, depending on the listing — a "possible relatives" or associated-persons section built from shared addresses and public records is a common feature of these sites, and it can name people who never searched for anything themselves.

**Q: If I opt out of one people-search site, am I done?**

A: No. Each aggregator maintains its own listings sourced from public records and broker feeds that get refreshed over time, so a listing removed from one site can reappear later, or show up on a different site that was never checked. Treat opt-outs as a recurring task.

**Q: Is it legal for these sites to publish my address?**

A: This depends on the jurisdiction and the specific source the data comes from — public records and property records are generally lawful to publish in many places, but rules on data-broker aggregation vary and are changing in some jurisdictions. See the ethics-and-law guide for the general framing.

**Q: Does running a home business expose my address differently?**

A: Yes — a business registered to a home address can appear in a company registry lookup tied to your name as an owner or officer, which is a separate exposure from data-broker listings and needs to be handled through the registry itself rather than a people-search opt-out.

Sources:

- https://www.truepeoplesearch.com
- https://www.fastpeoplesearch.com
- https://www.spokeo.com
- https://thatsthem.com
- https://opencorporates.com

### How to Check If Your Email Was in a Data Breach

- Page: https://osintyourself.com/learn/check-data-breach-exposure
- Reviewed: 2026-09-02

Somewhere, right now, there is a decent chance a password you have used is sitting in a file that was never supposed to leave the company that collected it. Checking whether your email shows up in a data breach is quick and free — but understanding what that check actually tells you, and what it does not, matters more than the lookup itself.

#### What a data breach actually is

A data breach happens when a company, app, or service that stores your information — an account database, a customer list, a support-ticket system — is accessed by someone who was never supposed to see it. Sometimes that is an attacker who broke in deliberately. Sometimes it is a database left open to the internet by mistake and found by someone scanning for exactly that. Either way, whatever was stored in that system — email addresses, usernames, password hashes, sometimes far more — can end up copied out.

Once a breach dataset exists, it rarely stays with one person. Copies get traded, resold, and eventually dumped for free on forums and marketplaces. Different breaches also get merged together into large combined lists, so a single lookup can turn up matches from several unrelated incidents at once. This is why breach-lookup services describe results in terms of which named breach an identifier appeared in, and roughly when — that provenance is often the only way to tell what kind of data was actually exposed.

#### How breach-lookup services work

The basic mechanism behind a breach-lookup service is straightforward: it ingests copies of known breach datasets, indexes the email addresses or usernames inside them, and lets you search that index. Enter an email address, and it tells you whether that address appears in any breach it holds — and usually which ones, by name and rough date, so you can judge how serious or how old the exposure is.

A positive result does not automatically mean your current password is compromised. Some breaches exposed only email addresses and account metadata, not credentials at all. Others exposed password hashes that were reasonably well protected. Others exposed plaintext passwords outright. The breach name and date a lookup service gives you is the clue to which situation you are in — it is worth reading a little about what a specific named breach involved rather than treating every hit the same way.

#### Free notification services vs. paid investigator databases

Breach-lookup tools broadly split into two classes. Free, notification-oriented services exist to tell you — the owner of an email address — whether it has appeared in a breach, and often let you register for alerts when new breaches involving that address surface. They are built around a narrow, consumer-facing question: has this address been exposed, and where.

A second class of tool is built for investigators, researchers, and security teams who need to search across breach corpora more broadly — by username, phone number, or other fields, not just a single email you already own — and who are usually paying for that access. These are dual-use by nature: the same search capability that helps a defender understand their own exposure can help someone build a profile on a person who has not consented to it. Treat any tool in this category with the same care you would apply to other dual-use OSINT tools, and be honest with yourself about whose data you are looking up and why.

#### What to do if you turn up in a breach

The single most useful habit a breach exposes is password reuse — because the real risk is rarely the one breached account, it is every other account where you used the same password. If a lookup confirms you were in a breach that included credentials, change the password on that account, and then check whether you reused that same password anywhere else. If you did, change it there too.

Beyond that one incident, the durable fix is structural: use a unique, randomly generated password for every account, stored in a password manager so you never have to remember or reuse one. Turn on two-factor authentication wherever it is offered, especially on your email account, since email is usually the recovery path into everything else. A future breach of some unrelated service then costs you nothing beyond changing one password, because nothing else was ever sharing it.

#### Checking a password itself, without exposing it

Some breach-lookup services also let you check whether a specific password has appeared in known breach data, which is a different question from checking an email address. The obvious worry is that typing a real password into a website hands that password to whoever runs it. The better implementations avoid this using a technique called k-anonymity: your password is hashed on your own device, only the first few characters of that hash are sent to the service, and the service returns every breached hash sharing that prefix. Your device then checks locally whether your full hash is among them. The service never receives your actual password, and never even receives your full hash — only a short prefix shared by many other hashes.

That design is worth understanding before you use any password-checking tool, because it is exactly the property that makes the check safe to run. If you want to try this on this site rather than a third party, see the password check linked below, which runs the same kind of check client-side in your browser.

FAQ:

**Q: What does it mean if my email shows up in a data breach?**

A: It means an account associated with that email address — on some service you signed up for — was included in a dataset that leaked or was stolen. The specific breach named in the result tells you which service and roughly when, which is the best clue to what kind of data (just the email, or also a password, or more) was actually exposed.

**Q: Does a breach hit automatically mean my password is compromised?**

A: Not necessarily. Some breaches exposed only email addresses or account metadata, not passwords at all. Others exposed hashed passwords, and others exposed them in plaintext. Read what the named breach actually involved rather than assuming the worst case every time.

**Q: Is it safe to enter my email into a breach-lookup site?**

A: Checking whether an email address has been breached is a narrower, lower-risk action than entering a password, since the address itself is often already circulating. Stick to well-established, reputable services and be more cautious with any tool that asks for more than the identifier you are checking.

**Q: What is the real difference between free and paid breach-search tools?**

A: Free, consumer-facing services are built to answer one narrow question — has this address of mine been exposed — and to alert you about future breaches. Paid, investigator-oriented databases search more broadly across breach corpora and are dual-use: useful for legitimate research and defence, but capable of being used to profile someone without their consent.

**Q: I was breached years ago — does it still matter?**

A: It matters if you were still reusing that password anywhere at the time, or have reused it since. Old breaches feed the same combined credential lists attackers use for automated login attempts today, so an old exposure with a reused password is still a live risk even if the original service is long gone.

Sources:

- https://haveibeenpwned.com/
- https://haveibeenpwned.com/Passwords
- https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
- https://pages.nist.gov/800-63-3/sp800-63b.html
- https://en.wikipedia.org/wiki/Data_breach

### How to Reverse Image Search (and What It Reveals About You)

- Page: https://osintyourself.com/learn/reverse-image-search
- Reviewed: 2026-09-02

Reverse image search flips the usual search box around: instead of typing words to find a picture, you feed in a picture and ask where else it exists, or what it shows. It is one of the oldest OSINT techniques precisely because it is so versatile — the same query can catch a stolen product photo, unmask a fake dating profile, or trace a screenshot back to the account that originally posted it.

#### What reverse image search actually does

A reverse image search engine does not read a photo the way a person does. It breaks the image down into a set of visual signatures — patterns of shape, color, and texture — and then looks for other images on the web with a matching or similar signature. Some engines search for near-duplicates of the exact file (useful for finding reposts or the original source of a picture), and some go further and try to recognize what is in the picture, such as a landmark, an object, or a face.

That distinction matters. A search built to find copies of the same image will surface a different set of results than a search built to recognize a face across many different photos of the same person. Knowing which kind of tool you are using changes what you can reasonably conclude from the results.

#### When people actually use it

The most common everyday use is verification: someone sends you a photo — a product listing, a news image, a profile picture — and you want to know if it is genuine or lifted from somewhere else. Running it through a reverse image search can show you the earliest places it appeared online, which is a strong signal of whether it is original or recycled.

It is also the standard first check against catfishing and fake dating or social profiles. A profile picture that turns out to be a stock photo, a stolen photo of an unrelated person, or an image that already appears attached to a different name elsewhere is a clear red flag. The same technique is used the other way around too: to find out whether your own photos have been reused somewhere without your knowledge, such as on a scam profile or a site you never uploaded to.

Journalists and researchers rely on it to check whether an image circulating during a breaking news event is actually new, or whether it is an older photo being recirculated out of context — a pattern that shows up constantly around wars, disasters, and protests.

#### Content-match engines vs. face-search engines

General-purpose engines like Google Lens are built to identify objects, places, and text in an image, and to find visually similar or matching images elsewhere on the web. TinEye takes a narrower, well-defined approach: it is built specifically to find where an image has previously appeared online and its earliest known use, which makes it useful for tracing a photo's origin rather than for general visual recognition. Yandex Images has a reputation among investigators for particularly strong face and location matching compared with other general engines, which is why it often turns up in OSINT guides even for non-Russian subjects.

A separate category exists specifically for faces. PimEyes is a facial-recognition search engine: instead of matching an image as a whole, it is built to find other photos where the same face appears, across sites the person in the photo may never have linked to their name themselves. That is a materially more invasive capability than a general content-match search, and it is why face-search tools carry a heavier ethical weight — the same tool that helps you find out where your own face has been reused can just as easily be pointed at a stranger. See our guide on ethics and the law before using one on anyone other than yourself.

Picarta occupies a different niche again: rather than matching to existing copies of an image, it is an AI tool that predicts where a photo was taken from its visual content — meaning it can suggest a location even for a photo that carries no matches elsewhere online and no GPS data of its own.

#### How to run one, step by step

Start with the cleanest copy of the image you have — a screenshot of a screenshot loses detail that the matching algorithm relies on. Most engines let you either upload a file directly or paste an image URL, and browser extensions for several of them add a right-click "search image" option so you never have to save the file first.

Run the same image through more than one engine. Because each one indexes a different slice of the web and weighs visual features differently, a photo that returns nothing on one engine can return several matches on another. If your goal is provenance — has this specific image appeared before, and where — a content-match engine like TinEye or Google Lens is the right starting point. If your goal is finding a location from the scene itself, a prediction tool like Picarta or a manual visual-clues approach is more appropriate than a face or content-match search.

Read the results critically rather than taking the first match as fact. A cropped or recompressed version of an image can still register as a match, and a genuine visual match only tells you the image (or something close to it) has appeared elsewhere — it does not by itself tell you which copy is the original, or confirm any claim being made about the photo.

#### Limits worth knowing

Reverse image search only finds what has already been indexed by that engine, which means a photo posted somewhere the crawler has not reached, kept behind a login, or shared only in private messages will not show up no matter how good the tool is. A negative result means "not found by this engine," not "does not exist anywhere."

Heavy editing — cropping tightly, mirroring, adding filters, or compositing the subject into a different background — can be enough to break a match on some engines while leaving it intact on others, which is another reason to check more than one tool before concluding a photo is either original or a fake.

FAQ:

**Q: Is reverse image search legal?**

A: A reverse image search works from images that are already published rather than anything private. Whether any particular use is lawful depends on what you do with the results, whether you have a legitimate reason to search for someone, and where you are — laws vary by jurisdiction and consent matters. See our ethics and law guide before searching for another named person.

**Q: What's the difference between reverse image search and facial recognition search?**

A: A standard reverse image search compares an entire image to find visual matches or near-duplicates of that image elsewhere. A facial-recognition search, like PimEyes, is built specifically to isolate a face and find other, different photos where that same face appears — even photos that look nothing alike otherwise. That makes face search a more powerful and more privacy-sensitive technique.

**Q: Can reverse image search find where a photo was physically taken?**

A: Sometimes indirectly, if the photo (or a captioned copy of it) has already been published somewhere with location information attached. Tools built specifically to predict a location from the visual content of a photo, like Picarta, take a different approach and do not require an existing indexed copy.

**Q: Why does the same photo return different results on different engines?**

A: Each engine indexes a different portion of the web and uses its own matching algorithm, so coverage and sensitivity to cropping, filters, or edits vary. That's why it's worth checking a photo on more than one engine rather than trusting a single negative result.

**Q: Can I stop my own photos from turning up in reverse image search?**

A: You can't guarantee a photo will never be indexed once it's public, but you can reduce exposure by controlling who can see your photos, checking whether images of you already appear in searches, and using removal-request processes some face-search tools offer. Our findability check is a good place to start.

Sources:

- https://lens.google
- https://tineye.com
- https://yandex.com/images/
- https://pimeyes.com
- https://picarta.ai

### How to Geolocate a Photo: Finding Where a Picture Was Taken

- Page: https://osintyourself.com/learn/geolocate-a-photo
- Reviewed: 2026-09-02

Geolocating a photo means figuring out where it was taken, and it splits into two very different disciplines. One is fast and mechanical: read the location data the camera already wrote into the file. The other is slow and observational: read the scene itself — the buildings, the signage, the shadows — and cross-reference it against maps and satellite imagery. Most real investigations end up using both, because the fast method usually comes up empty.

#### Path one: EXIF GPS data

Many phone cameras write GPS coordinates directly into a photo's EXIF metadata at the moment it is taken, alongside details like the device model and timestamp. If that data survived, reading it is the fastest possible geolocation: it hands you exact coordinates without any guesswork.

The catch is that it usually doesn't survive. Most major social platforms and messaging apps strip GPS and other EXIF data from images on upload, partly for user privacy and partly to reduce file size. That means EXIF GPS data is realistically only useful on photos sent directly as original files — an email attachment, a photo pulled straight off a device, or a download rather than a screenshot — rather than on anything already posted to social media.

Even when the GPS field itself is gone, the rest of the EXIF block can still be useful. A surviving camera or phone model, software version, and original timestamp won't tell you where a photo was taken, but they can help you tell whether a photo is a first-generation original or has been re-saved and passed through another app — which matters before you invest time trying to geolocate the scene at all.

#### Path two: visual and chronolocation clues

When there is no usable metadata, the alternative is to treat the photo like a puzzle and read the scene for anything identifiable. Street signs, shopfront names, license plate formats, road markings, architecture style, vegetation, and even the side of the road traffic drives on can each narrow down a country or region before you ever open a map.

Once you have a candidate location, sun position and shadow direction can help pin down the time of day or even season the photo was taken — a technique often called chronolocation. A tool like SunCalc shows sun position and shadow direction for a given place and time, which lets you check whether the shadows in a photo are consistent with a claimed date, time, or location, or use them to narrow down the range of times when a photo could have been taken.

Seasonal cues add another layer to chronolocation: whether trees are bare or in leaf, whether there's snow on the ground, what people are wearing, and what seasonal decorations or events are visible can all narrow a plausible date range independently of shadow angle. When you have more than one photo of the same claimed event, comparing shadows and seasonal detail across all of them is a stronger check than relying on a single frame.

#### Cross-referencing against maps and imagery

Once you have candidate landmarks, the next step is confirming them against real-world geography. Google Earth's satellite imagery and 3D globe let you visually match a skyline, an intersection layout, or a distinctive building shape against the actual terrain from above or at a low angle. OpenStreetMap provides a free, editable map with rich open geographic data — street names, footpaths, and smaller features that can help confirm a location, especially where local contributors have mapped an area in detail.

For more targeted searches — for example, finding every building of a certain type within a candidate area, or every road matching a particular pattern — Overpass Turbo lets you query OpenStreetMap's underlying data directly by feature and area rather than browsing the map by eye, which is useful once you've narrowed a search down to a city or district and need to check specific candidate locations against a visual clue in the photo.

#### A practical workflow

Check EXIF first, because it costs nothing and occasionally hands you the answer directly. If that comes back empty, list every visible clue in the photo — language on signage, vehicle and plate style, architecture, vegetation, terrain — and use those to narrow a plausible country or region.

From there, work from broad to specific: use satellite imagery to look for a matching skyline or landscape in the candidate region, then narrow to a specific street or building, then check sun and shadow angles against the claimed or estimated time to see whether the physical evidence is consistent. Treat each step as a hypothesis to test against the next piece of evidence, not a conclusion — a single matching detail can be a coincidence, but several independent details converging on the same location rarely are.

Keep a record of which clue supported which conclusion as you go. Geolocation is cumulative reasoning built from several independent, individually weak pieces of evidence, and being able to point to exactly which detail supports a given candidate location — a specific building shape, a specific shadow angle, a specific piece of signage — makes it much easier to catch your own mistake if a later clue turns out to contradict an earlier one.

#### How this cuts both ways

The same techniques used by journalists to verify a news photo or by researchers to fact-check a viral claim can be used against an ordinary person — to work out where a photo in a dating profile, a social post, or a public account was taken, and from there, where someone lives, works, or spends time. A photo doesn't need visible GPS data to be geolocatable if the scene itself contains enough identifiable detail.

Reducing your own exposure starts with knowing what your photos actually carry. You can check a photo's metadata directly in your browser with our EXIF viewer before posting anything, and be deliberately cautious about backgrounds — house numbers, street signs, distinctive landmarks, and reflections in windows or sunglasses are all things a geolocation attempt can latch onto even when the metadata is clean.

FAQ:

**Q: Do all photos have GPS location data attached?**

A: No. Many cameras and phones do embed GPS coordinates in a photo's EXIF metadata by default, but that data is commonly stripped when the photo is uploaded to social media or messaging apps. Whether it survives depends heavily on the device, its settings, and the platform the photo passed through.

**Q: What is chronolocation?**

A: Chronolocation is estimating when a photo was taken, as opposed to geolocation, which estimates where. It often relies on sun position and shadow direction for a candidate location, checked against a tool like SunCalc, alongside other time-specific clues in the scene such as seasonal vegetation or event signage.

**Q: Can a photo be geolocated even with no GPS data and no visible landmarks?**

A: It becomes much harder, but not always impossible — tools designed to predict location from general visual patterns in a photo can sometimes suggest a plausible region even without a recognizable landmark, though such predictions should be treated as a starting hypothesis rather than a confirmed location.

**Q: Does WiGLE help geolocate a photo?**

A: Not directly from the image itself — WiGLE is a crowdsourced database of Wi-Fi networks and cell towers mapped by location, so it's more relevant when a Wi-Fi network name is visible or known than when working from visual clues in a photo alone.

**Q: Is it legal to geolocate a photo someone else posted?**

A: Using publicly visible information in a photo to work out where it was taken does not itself require special access, but what you do with that conclusion matters — laws vary by jurisdiction and consent matters. See our ethics and law guide before geolocating a photo of another named person.

Sources:

- https://www.suncalc.org
- https://earth.google.com/web/
- https://www.openstreetmap.org
- https://overpass-turbo.eu
- https://wigle.net

### How to View a Photo's Hidden Metadata (EXIF)

- Page: https://osintyourself.com/learn/photo-metadata-exif
- Reviewed: 2026-09-02

A photo file is not just the picture you see when you open it. Most cameras and phones embed a block of metadata alongside the image data itself — details about the device that took it, the settings it used, and sometimes exactly when and where it was taken. That data is invisible in a normal photo viewer, but it travels with the file wherever it goes, unless something along the way strips it out.

#### What EXIF actually is

EXIF, short for Exchangeable Image File Format, is a standard for embedding metadata inside photo files, most commonly JPEGs. It was designed so cameras could record technical detail about how a photo was taken — alongside the pixels themselves — in a structured way that other software could read back out.

The metadata lives in the file itself, not in some separate database, which is why it survives copying a file from a camera to a computer, attaching it to most emails, or uploading it to a site that does not process the image before storing it. Whether it survives further depends entirely on what the destination does with the file.

#### What it can actually reveal

A typical EXIF block includes technical camera settings — aperture, shutter speed, ISO, focal length — along with the make and model of the device that took the photo, and often the exact date and time it was captured, down to the second, based on the camera or phone’s own clock.

Many phones also embed GPS coordinates directly into the EXIF data when location services were enabled at the time the photo was taken, which is the single most sensitive field a photo can carry: it can pin down not just a general area but a specific address, down to which room of a building a photo was taken in, if the coordinates are precise enough.

Some devices and editing software also embed a thumbnail preview inside the file separately from the main image, and that embedded thumbnail is not always updated when the visible photo is cropped or edited — so in some cases the metadata can contain an older, uncropped version of an image that the visible photo no longer shows.

#### Why the absence of metadata is not the same as safety

Many major social media, messaging, and photo-sharing platforms strip EXIF metadata from images automatically when they are uploaded, partly for user privacy and partly to save storage and bandwidth on data most viewers never look at. That means a photo pulled straight from a social media post has often already had its metadata removed by the platform, regardless of what the original file contained.

The problem is that this is not consistent or guaranteed across every platform, feature, or file type, and it says nothing about photos shared other ways — as a direct email attachment, over a messaging app that does not strip metadata, through cloud storage links, or on a personal or lesser-known site. A photo having no visible metadata on one platform tells you about that platform’s processing, not about whether the original file, or a copy sent a different way, still carries the full data.

Because of that, never assume a photo is free of location or device data just because it came from a place that usually strips it. Check the actual file you have in hand.

#### How to view a photo’s metadata

On most desktop operating systems, right-clicking an image file and looking at its properties or "get info" panel will show at least some basic EXIF fields, such as the camera model and capture date, though built-in file browsers often do not surface GPS coordinates directly.

Dedicated metadata viewer tools — including browser-based ones that read the file locally without uploading it anywhere, and command-line tools built specifically for reading and editing EXIF data — will show the full set of embedded fields, including GPS coordinates if present, in a readable format. This site’s own in-browser EXIF viewer works the same way: it reads the file on your device rather than sending it anywhere.

When you only have a link to an image rather than the original file — for example a photo embedded in a webpage — downloading the actual file first matters, because a screenshot of an image, or a version re-encoded by the site displaying it, will not carry the original metadata even if the source file did.

#### Metadata beyond photos

The same idea applies well beyond camera photos. Office documents, PDFs, and spreadsheets routinely embed their own metadata: the author name from the software’s configured user profile, the organisation the software license is registered to, when the file was created and last modified, and sometimes a full revision history or the names of everyone who has edited it.

This is particularly relevant for documents an organisation publishes publicly — a PDF report or a shared spreadsheet can carry internal author names, department information, or software version details that were never meant to be part of the published content, simply because nobody cleared the metadata before publishing it.

Before sharing a photo or document publicly, it is worth checking its metadata the same way you would check the visible content, and stripping or editing it if it contains anything you did not mean to include.

FAQ:

**Q: Does every photo have GPS coordinates in its metadata?**

A: No. GPS data is only embedded when the device had location services enabled at the moment the photo was taken, and not every camera or phone records it at all. Many photos have no location field present.

**Q: If a photo has no EXIF data, is it safe to assume it was never in the original?**

A: No. Many platforms strip metadata automatically on upload, so a lack of visible metadata on a downloaded copy often reflects the platform’s processing rather than the original file. Check metadata on the original file whenever that is what matters.

**Q: Can editing or cropping a photo remove its metadata?**

A: It depends on the software. Some editing tools strip or rewrite metadata when saving, while others preserve it, and an embedded thumbnail inside the file can in some cases still show an older, uncropped version even after the visible image has been edited.

**Q: Do documents like PDFs and Word files carry the same kind of hidden data?**

A: Yes, though the fields differ from photos. Office documents commonly embed an author name, organisation, creation and modification dates, and sometimes an edit history, all readable the same way EXIF data is.

**Q: Is it legal to look at the metadata in a photo someone else shared publicly?**

A: Laws vary by jurisdiction, and viewing metadata that is already embedded in a file you have legitimate access to is different from other uses. Consent matters for what you do with what you find, so treat it as a legal question when it matters, not just a technical one.

Sources:

- https://www.exif.org/Exif2-2.PDF
- https://exiftool.org/

### How to Investigate an Email Address (Reverse Email Lookup)

- Page: https://osintyourself.com/learn/investigate-an-email-address
- Reviewed: 2026-09-02

An email address looks like a single, simple piece of information, but it is usually a hub — the one identifier reused across dozens of accounts, sign-ups, and breach dumps someone signed up for years ago and forgot about. A reverse email lookup is the process of working outward from that one address to see what it connects to. This guide covers what that process can genuinely reveal, how to run it methodically, where it produces false positives, and what it means for the linkability of your own address.

#### What an email address can actually reveal

The most direct signal comes from account-existence checks: many sign-up and password-reset flows will confirm, intentionally or not, whether a given email address already has an account on that service — without ever needing the password. Run across a wide list of platforms, this produces a map of where an address is registered, even when no other information is public.

A second signal is breach and leak appearance: whether the address shows up in any of the large number of credential and account databases that have been exposed over the years. A hit does not tell you the current password, but it does confirm the address was in active use on a specific service at a specific point, and sometimes surfaces an associated name or a second address used for recovery.

From there, associated names, usernames, and profile details can sometimes be pulled from services that specialize in digital-footprint tracing, and the domain and provider of the address itself (a personal webmail account versus a corporate domain versus a disposable or temporary-mail provider) is a useful signal about how seriously to weigh everything else you find.

#### A practical workflow

Start by normalizing the address — case does not matter for most providers, but plus-addressing (the part after a "+" in the local part) and provider-specific aliasing conventions can make the same inbox look like several different addresses. Search breach-notification and leak-index services first, since a confirmed breach hit is usually the most reliable signal you will get.

Next, run account-existence checks across a broad set of common platforms rather than guessing at a handful. Any positive result becomes a pivot point: if the address is registered on a social platform, that platform’s own username or display name becomes a new thread to follow with username- and social-lookup techniques.

If the goal is researching a company or a domain rather than a specific person, the direction reverses — email-finder and verifier tools work from a domain outward to surface the publicly associated professional addresses on it, which is a different starting point than investigating one address you already have.

#### False positives and dead ends

Shared and generic addresses — a family inbox, a small business’s general contact address — will produce results that describe several different people, and it is easy to misattribute an account to the wrong individual. Deactivated or repurposed accounts can also leave stale positive results long after the original owner has moved on.

Many services rate-limit or deliberately obscure account-existence checks to prevent exactly this kind of automated probing, so an absence of results does not reliably mean an address has no accounts elsewhere — it may just mean the check was blocked. Treat every result as a lead to corroborate against something else, not as a confirmed fact on its own.

#### Reducing your own email’s linkability

The same techniques that make an address investigable are the reason it is worth compartmentalizing your own. Using separate addresses for separate contexts — one for financial accounts, one for shopping and newsletters, one for social platforms — limits how much a single leak or lookup can connect. Provider-level aliasing (plus-addressing, or a catch-all domain if you run your own) lets you generate effectively unlimited variants without managing separate inboxes.

Periodically checking your own address against a breach exposure checker is the same workflow described above, run against yourself, and a listing on a data broker or people-search site tied to your address is usually worth removing directly.

#### Consent and appropriate use

Running these checks against your own address is straightforward. Running them against someone else’s carries different weight, and what is appropriate depends on context and consent as much as on the law — which varies by jurisdiction. See the ethics-and-law guide before investigating anyone other than yourself.

FAQ:

**Q: Does a reverse email lookup reveal someone’s real name?**

A: Sometimes, indirectly — a breach dataset or a linked social account may include a display name, but the address itself does not encode a legal identity. Any name you find is a lead to verify, not a confirmed fact.

**Q: Can I check my own email for breaches for free?**

A: Yes — breach-notification and leak-index services are built for exactly this, and this site’s breach exposure checker uses the same idea. There is no need to pay to find out whether your own address has been exposed.

**Q: Why do account-existence checks sometimes give the wrong answer?**

A: Many services rate-limit or deliberately obscure sign-up and password-reset responses to prevent automated probing, so a negative result can reflect a blocked check rather than a genuine absence of an account.

**Q: Is it legal to look up someone else’s email address?**

A: This depends on what you do with it and where you are, and laws vary by jurisdiction. Consent matters — see the ethics-and-law guide rather than assuming it is fine because the information is technically public.

**Q: How do I stop one email address from linking to everything I do online?**

A: Use separate addresses or provider-level aliases for separate contexts (finance, shopping, social) so a single leak or lookup cannot connect all of your accounts to one identifier.

Sources:

- https://haveibeenpwned.com/
- https://github.com/megadose/holehe
- https://github.com/khast3x/h8mail
- https://epieos.com

### How Reverse Phone Lookup Works

- Page: https://osintyourself.com/learn/reverse-phone-lookup
- Reviewed: 2026-09-02

A phone number carries more structure than it looks like at first glance. Beyond the ten or so digits, it encodes information about who issued it, roughly where it is registered, and — once you start checking it against messaging apps and people-search listings — who it is likely to belong to. Reverse phone lookup is the process of working from a bare number outward to that picture. This guide covers what is genuinely findable, a practical workflow, where the results get unreliable, and how to reduce what your own number gives away.

#### What a phone number can reveal

The number itself, without any lookup, already encodes a country code and, in most numbering plans, an area code or prefix that points to a rough region and sometimes a specific carrier. Line-type checks can further distinguish a mobile number from a landline or a VoIP number, which matters because VoIP numbers are cheap, disposable, and much less tied to a real person than a long-held mobile contract.

Beyond the technical detail, many messaging and social apps let you check whether a given number is registered with them — the same account-existence pattern used for email addresses — which can surface a linked display name or profile photo without needing to message the number at all. People-search sites separately aggregate names, addresses, and phone numbers from public records and data broker feeds, and often surface a household or family connection tied to a number even when no individual account check does.

#### A practical workflow

Start with a carrier and line-type lookup to establish the basics: is this plausibly a personal mobile number, a business line, or a disposable VoIP number likely to be reassigned or dropped soon. That framing changes how much weight to put on everything that follows.

From there, check messaging-app presence for a linked name or photo, and separately search people-search aggregators for listings tied to the number. Treat each source independently and look for agreement across at least two of them before drawing a conclusion — a single listing on one aggregator, on its own, is a lead rather than a confirmed identity.

Corroborate any name you get against a second, unrelated signal before treating it as settled — a shared surname on one listing and a matching city on another is a much stronger indicator than either alone. If the number turns out to be a landline or a known VoIP block, weight the people-search result more cautiously, since those number types change hands more freely than a long-held mobile contract does.

#### Accuracy limits and scam-callback risk

Phone numbers get reassigned and ported between carriers and even between people far more often than most people assume, which means a people-search listing can easily describe whoever held the number previously rather than its current owner. VoIP numbers in particular can be spun up, used briefly, and abandoned, making any lookup on them unreliable almost by design.

There is also a real, practical risk worth naming directly: calling back an unknown number from a spam or scam call, in an attempt to identify it, can confirm to the other end that your own number is active and answered — which is valuable information to a scam operation and can increase, not decrease, how much you get targeted. Prefer a lookup service over a callback when you are trying to identify a number that already looks suspicious.

#### Reducing your own number’s exposure

Avoid posting your primary number publicly, and consider a secondary number — through a carrier’s own second-line feature or a separate VoIP number — for sign-ups and listings where you do not want your main line tied to the account. Be deliberate about which apps you grant contact-list access to, since syncing contacts is one of the more common ways a number ends up linked to a name and photo it was never directly given to.

Most people-search aggregators offer some form of opt-out, and this site’s data-removal guide walks through the general process. Combine that with checking your own overall footprint through the findability audit to see what a number-based lookup on you would actually surface.

#### When it involves someone else

Looking up your own number, or checking a suspicious caller before deciding whether to answer, is a straightforward defensive use of these techniques. Using them to build a profile on someone else is a different matter, and what is appropriate depends on consent and context as well as the law, which varies by jurisdiction — see the ethics-and-law guide before assuming a lookup is fine just because the source data is technically public.

FAQ:

**Q: Can someone find my home address from just my phone number?**

A: Sometimes, if a people-search aggregator has a listing tying that number to a name and address from public records or a data broker feed. This is exactly the kind of listing the data-removal guide covers opting out of.

**Q: Are reverse phone lookups always accurate?**

A: No. Numbers are reassigned and ported between people, VoIP numbers can be disposable, and a listing can easily reflect a previous owner rather than the current one. Treat any single result as a lead, not a confirmed identity.

**Q: Is it illegal to look up someone’s phone number?**

A: This depends on what you do with the result and where you are, and laws vary by jurisdiction. Consent and context matter — see the ethics-and-law guide.

**Q: Should I call back an unknown number to find out who it is?**

A: It is usually better not to. Calling back a suspicious number confirms your own number is active and answered, which can increase how much you get targeted rather than resolve who called.

**Q: How do I keep my own number off people-search sites?**

A: Avoid posting it publicly, use a secondary number for sign-ups where possible, be careful which apps get contact-list access, and opt out of aggregators directly using the process in the data-removal guide.

Sources:

- https://github.com/sundowndev/phoneinfoga
- https://thatsthem.com
- https://www.fcc.gov/consumers/guides/wireless-number-portability

### How to Find Accounts Linked to a Username

- Page: https://osintyourself.com/learn/username-search
- Reviewed: 2026-09-02

Most people reuse the same handle, or a close variant of it, across dozens of sites without thinking about it. A username someone picked for a gaming forum in 2014 can still be sitting on a dating app, a fitness tracker, and a niche hobby forum today, all under the same name. Finding those accounts does not require guessing passwords or breaking into anything — it is mostly a matter of checking, systematically, where else a given string of characters has been registered.

#### Why one username tends to span many platforms

People rarely invent a brand-new username for every service they sign up for. When a platform asks you to pick a handle, the natural instinct is to reuse whatever you already use elsewhere, or a small variation of it — the same word with a different number tacked on, an underscore swapped in, or a common prefix like the first letter of a name.

That habit is convenient for the person creating the account, but it also creates a thread that connects otherwise unrelated corners of their online life. A username picked for an anonymous forum can end up sitting next to a real name on a site where the same person used it without thinking twice, and the link between the two is the handle itself, not anything either account explicitly says.

#### How username enumeration tools actually work

The class of tool used for this — often called a username checker, enumerator, or Sherlock-style tool after the family of open-source projects that popularised the approach — takes a single handle you supply and checks whether an account with that exact name exists on a long list of sites. Under the hood this is usually done by requesting each site’s profile URL pattern (something like a site’s domain followed by the username) and looking at whether the response indicates a profile exists or a "not found" page.

Different tools in this class vary in how many sites they check, how they are configured, and whether they run from the command line, a web interface, or both, but the underlying idea is the same across the family: automate a check that would otherwise mean manually typing a username into hundreds of different site URLs one at a time.

Because the method relies on public profile pages responding differently depending on whether an account exists, it only surfaces what the platform itself is willing to reveal to an anonymous visitor. It does not bypass privacy settings, log in as anyone, or access anything that is not already reachable by simply visiting the URL.

#### Corroborating a match before you trust it

A hit from an enumeration tool means only one thing: an account with that exact username exists on that site. It does not by itself mean the account belongs to the same person you are researching, especially for short or common handles that plenty of unrelated people could plausibly have picked independently.

Treat every hit as a lead to check, not a confirmed link. Open the profile and compare it against what you already know: does the avatar match or look like the same person or a variant of an image used elsewhere, does the bio reuse the same wording, links, or claimed location, do posts reference the same interests, employer, or city, and does the account link out to — or get linked from — another profile you have already confirmed. The more independent details line up, the more confident you can be that it is the same person rather than a coincidence.

Account creation dates and posting activity can also help. A profile that was created around the same time as accounts you have already confirmed, or that went quiet at the same point the person’s other accounts did, is a mild additional signal — though on its own it is still not proof.

#### Where false positives come from

Short, dictionary-word, or otherwise "desirable" usernames get reused by unrelated people constantly, so a match on a handle like a common first name plus a birth year is much weaker evidence than a match on an unusual, invented word that is unlikely to have been picked twice by coincidence.

Enumeration tools can also misreport. Some sites return a generic page with the same layout whether or not an account exists, which can register as a false "found" result, and site redesigns can break the pattern a tool relies on to tell the two cases apart. Whenever a result matters, open the profile yourself and confirm it actually shows account content rather than a placeholder or error page styled to look like one.

#### Making your own handles harder to link together

The same technique that makes it easy to trace someone else’s accounts works just as well against your own, so it is worth running a check on the handles you actually use. If the results surface accounts you forgot existed, or connections between a professional and a personal identity you meant to keep separate, that is useful to know before someone else finds it first.

Going forward, the simplest defence is deliberately not reusing the same handle across contexts you want to keep separate — a distinct username for anything you want kept away from your real name or your professional accounts, rather than a variant close enough to still be recognisable. Reusing the same profile photo across accounts undermines this even if the usernames differ, since the avatar becomes the new thread connecting them.

It is also worth periodically checking old accounts you no longer use. A dormant profile under a handle tied to your current identity is still a live data point for anyone running the same search against you, even if you never log into it again.

FAQ:

**Q: Is checking someone else’s username across sites legal?**

A: Laws vary by jurisdiction, and how you use what you find matters as much as how you found it. Checking whether a public profile exists under a given handle is different from what you do with that information afterward. Consent matters, and if you are unsure, treat it as a legal question, not just a technical one.

**Q: Why did a tool report an account that does not actually exist?**

A: This is a known limitation of the technique. Some sites serve a similar-looking page whether or not a username is registered, and site redesigns can break the pattern a tool uses to distinguish "found" from "not found." Always open a result yourself before relying on it.

**Q: Can these tools find a private or deactivated account?**

A: They generally can only see what an anonymous visitor to the profile URL would see. A fully private profile may still show up as "exists" without revealing its contents, and a deactivated account often reverts to a "not found" state, so results depend heavily on each platform’s behaviour.

**Q: Does using a different username on every site actually help?**

A: Yes, qualitatively — it removes the handle itself as a link between your accounts. It is not a complete defence on its own, since a reused profile photo, bio, or writing style can still connect accounts even when the usernames differ.

**Q: How many sites do these tools typically check?**

A: It varies by tool and how it is configured; the general class checks a curated list of sites that is added to and maintained over time rather than a fixed, universal set. See each tool’s own listing for specifics.

Sources:

- https://github.com/sherlock-project/sherlock
- https://github.com/WebBreacher/WhatsMyName
- https://github.com/soxoj/maigret

### How to Investigate a Domain: WHOIS, DNS and Certificate Records

- Page: https://osintyourself.com/learn/investigate-a-domain
- Reviewed: 2026-09-02

A domain name looks like a single, opaque string, but registering and running one leaves a trail of records that are public by design: who registered it and when, what servers answer for it, what other names share its infrastructure, and what certificates have ever been issued for it. None of this requires special access — it is published as part of how the domain and certificate systems work — but knowing where to look, and in what order, turns a pile of raw records into an actual picture of what a site is and who is behind it.

#### What a domain registration reveals — and what it doesn’t anymore

Every registered domain has WHOIS data attached to it: the registrar it was bought through, the date it was first registered and when it is due to expire or renew, and the name servers it currently points to. Historically WHOIS also exposed the registrant’s name, email, and postal address directly.

Most registrars now offer, and in some regions are required to apply, privacy or proxy redaction that replaces those personal fields with the registrar’s own placeholder contact details. So a WHOIS lookup today frequently tells you the registrar, the registration and expiry dates, and the name servers, but not a real name or address behind the domain — treat the absence of registrant details as the default, not as something suspicious in itself.

When registrant details are not redacted, or when a domain was registered before privacy redaction became standard, WHOIS can still directly name an organisation or individual, which is worth checking even though you should not assume it will be there.

#### What DNS records add on top of WHOIS

Where WHOIS describes the registration, DNS records describe how the domain actually functions. An A or AAAA record points the domain at the IP address serving its content; MX records show which mail servers handle its email; TXT records often contain verification strings for services the domain owner has connected, such as email-sending or hosting platforms; and NS records show which name servers are authoritative for the domain, which can point at a specific hosting or DNS provider.

Looking up a domain’s IP address and then checking what else resolves to that same address can surface other domains hosted on the same server or behind the same infrastructure — useful when a suspicious site is one of several sharing an IP with a common operator, though shared hosting also means an IP address alone is weak evidence of a relationship between two domains, since large hosting providers put many unrelated sites on the same address.

#### Subdomains and certificate transparency logs

Most domains have subdomains beyond the main site — a mail portal, a staging environment, an API endpoint, an old subdomain nobody decommissioned — and these are not always linked from the site itself. One of the more reliable ways to discover them is through certificate transparency logs: every publicly trusted TLS certificate issued for a domain, including ones for its subdomains, is recorded in public, append-only logs that certificate authorities are required to submit to.

Searching a certificate transparency log for a domain returns every certificate ever issued for it and its subdomains, which is often the fastest way to enumerate subdomains a site operator did not intend to advertise. A subdomain showing up in these logs does not mean it is currently live or still resolves to anything, only that a certificate was issued for it at some point.

#### Historical records: what a domain used to be

Domains change hands, change hosting, and change purpose over time, and current WHOIS and DNS records only show the present state. Historical WHOIS and DNS records — where a service has archived past lookups — can show a different registrant, a different set of name servers, or a completely different site under the same domain at an earlier point, which matters when trying to work out whether a domain has always been run by the same party or was repurposed after expiring or being sold.

This kind of history is particularly relevant for domains that look newly suspicious: an otherwise ordinary-looking domain that changed registrant and hosting a few months before it started being used for something questionable tells a very different story than one that has been consistent for years.

#### A practical order of operations for checking a suspicious site

Start with WHOIS to establish the basics: how old the domain is, who it is registered through, and whether registrant details are visible or redacted. A domain registered only days or weeks before it started being used, especially alongside a low-cost or privacy-focused registrar, is a mild caution signal on its own, though plenty of legitimate sites also use privacy redaction and recent registrations, so weigh it alongside everything else rather than treating it as decisive by itself.

Next check the DNS records to see what is actually serving the site and where its email, if any, is handled, then check certificate transparency logs for subdomains that might reveal a login portal, admin panel, or staging copy of the site not linked from the homepage. Finally, if the domain’s current story does not add up, check historical records to see whether it has a longer, different history that current records alone would not show.

None of these checks individually proves a site is malicious or legitimate — each one adds a data point, and the overall picture is built by combining them, the same way it is with any other OSINT technique.

FAQ:

**Q: Why can’t I see the registrant’s name in WHOIS anymore?**

A: Most registrars now apply privacy or proxy redaction by default, which replaces personal registrant fields with the registrar’s own placeholder contact details. This is the normal state for most domains today rather than a sign that something is being hidden.

**Q: Is a newly registered domain automatically suspicious?**

A: No. A recent registration date is only a mild, contextual signal, and plenty of legitimate new sites are registered every day. It only becomes more meaningful alongside other signals, such as the domain’s content, hosting, and how it is being promoted or linked to you.

**Q: What is a certificate transparency log?**

A: It is a public, append-only record of TLS certificates issued for domains, which certificate authorities are required to submit to. Searching it for a domain can reveal subdomains that were never linked from the main site.

**Q: Does a subdomain showing up in a certificate log mean it is still live?**

A: Not necessarily. It only means a certificate was issued for that name at some point; the subdomain may no longer resolve to anything or may have been decommissioned since.

**Q: Can domain investigation techniques identify a specific person?**

A: Sometimes, when registrant details are not redacted, but often the most they reveal is a registrar, hosting provider, and infrastructure pattern rather than a named individual. Treat what any single lookup shows as a starting point, not a conclusion.

Sources:

- https://certificate.transparency.dev/
- https://www.icann.org/resources/pages/gtld-registration-data-specs-en
- https://www.icann.org/resources/pages/rdds-labeling-2019-05-17-en

### Google Dorks Cheat Sheet: Advanced Search Operators for OSINT

- Page: https://osintyourself.com/learn/google-dorks-cheat-sheet
- Reviewed: 2026-09-02

"Google dorking" is the practice of using search engines' own advanced operators to find specific, narrowly targeted results that an ordinary keyword search would bury or miss entirely — a login page left publicly indexed, a spreadsheet accidentally left exposed, or every mention of a name on a particular type of site. None of it involves hacking; it uses search syntax that is publicly documented and available to anyone.

#### What dorking actually is

A search engine crawls and indexes an enormous amount of the public web, including plenty of pages that were never meant to be found by a normal search — a misconfigured directory listing, an internal document uploaded without access controls, or a test page that was supposed to be temporary. A "dork" is simply a search query built with operators precise enough to surface that kind of content on purpose, instead of stumbling across it by accident.

The operators themselves are ordinary, documented search syntax — the same features a search engine offers anyone to narrow down results. What makes a query a "dork" is how deliberately it's aimed, not any special access or exploit.

#### The core operators

site: restricts results to a single domain or subdomain, so `site:example.com` shows only pages the search engine has indexed on that domain — useful for mapping what a specific organization or person has published.

filetype: restricts results to a specific file extension, so `site:example.com filetype:pdf` finds only PDF documents on that domain, which is one of the most common ways to turn up reports, resumes, or spreadsheets that were uploaded but never linked from a normal page.

intitle: restricts results to pages whose <title> tag contains the given word, so `intitle:"index of"` is a classic pattern for finding open, unlisted directory listings that a web server is exposing by default.

inurl: restricts results to pages whose URL contains a given string, so `inurl:admin site:example.com` looks for administrative or login pages on a domain rather than its regular content pages.

Quotation marks force an exact-phrase match, so `"jane smith" "acme corp"` only returns pages containing that exact combination of words rather than pages that merely mention both separately anywhere on the page.

A minus sign excludes a term, so `"jane smith" -linkedin` returns mentions of that exact name while filtering out a source you already know about and don't need to see again.

before: and after: restrict results to a date range around when a page was indexed, so `site:example.com after:2024-01-01` helps focus on more recent content when a domain has years of accumulated pages.

The wildcard operator (usually written as an asterisk) acts as a placeholder for an unknown word, so `"jane * smith"` matches an exact phrase with one unknown word in the middle — useful when you know the surrounding wording of a phrase but not every word in it. An OR search lets you check several alternatives in one query, so `intitle:resume OR intitle:cv "jane smith"` looks for either title wording rather than requiring a separate search for each.

#### Combining operators

Operators are additive, and most real queries stack several of them together. `site:example.com filetype:xlsx intitle:budget` narrows a search to spreadsheet files on one domain whose title mentions "budget" — three separate filters working together to cut an enormous index down to a handful of candidates.

Building queries like this is mostly a matter of thinking about what an accidentally exposed file tends to look like — its likely extension, a word likely to appear in its title or URL — rather than memorizing operator syntax from scratch. A dedicated dork-builder tool can help assemble these combinations without needing to recall the exact syntax for each operator every time.

Order and spacing matter less than people expect — most operators can be placed anywhere in the query and combined freely — but each operator narrows the result set further, so stacking too many at once can return nothing even when a looser version of the same query would have worked. If a heavily combined query comes back empty, it's usually worth dropping one operator at a time rather than assuming the target simply isn't indexed.

#### Using dorks defensively

The same operators that find someone else's exposed files also work on your own name, your own domain, or your own organization, which makes dorking a genuinely useful self-check rather than only an offensive technique. Running `site:yourdomain.com filetype:pdf` or `"your full name"` against your own footprint can surface a document, an old profile, or a mention you had forgotten was public.

Because a search engine's index is a snapshot that changes over time, a page that turns up in a dork today may already be gone by the time you look, and a page that was removed can still sometimes be checked in the Internet Archive's Wayback Machine, which keeps historical snapshots of pages independent of whether the live page still exists. Broader OSINT directories like the OSINT Framework are also useful alongside dorking, since they categorize other tools and data sources that complement a plain search-engine query.

If a self-check does turn up something exposed that shouldn't be — an old resume with your address on it, an internal document, a spreadsheet with contact details — the practical next step is usually a takedown or removal request to whoever hosts the file, plus a request to the search engine to remove the cached copy once the source is gone, since a de-indexed page can otherwise keep surfacing in searches for a while after it's actually been deleted.

#### Where the ethical line sits

Dorking only touches what a search engine has already indexed from public pages — it does not bypass a login, break an access control, or exploit a system. That said, finding a file someone clearly did not intend to expose still raises a judgment call about what to do next: downloading, publishing, or acting on sensitive information you find this way is a separate decision from simply locating it, and laws and norms vary by jurisdiction and by what the data actually is. See our guide to ethics and the law before using dorking on a target other than yourself.

FAQ:

**Q: Is Google dorking illegal?**

A: Search operators only surface pages a search engine has already crawled from the open web — you are refining a normal search, not bypassing any access control. Whether a particular use is lawful still depends on what you do with what you find and whether you have a legitimate reason to be looking, and laws vary by jurisdiction. See our ethics and law guide for more.

**Q: Do these operators only work on Google?**

A: The exact syntax and operator names vary by search engine, but most mainstream search engines support similar concepts — restricting results to a site, a file type, or an exact phrase. This cheat sheet uses the commonly documented Google operator syntax, which is also the version most widely referenced in OSINT guides.

**Q: Why do some dork queries return nothing?**

A: A query can return nothing because the content genuinely doesn't exist, because it was never indexed by that search engine in the first place, or because it existed once but has since been removed or blocked from indexing. A zero-result search is not proof that the information doesn't exist somewhere.

**Q: What's the fastest way to check my own exposure with dorks?**

A: Start with `site:yourdomain.com filetype:pdf` and an exact-phrase search on your own full name, then review what comes back. Our dork-builder tool can help you assemble more targeted combinations without memorizing operator syntax.

**Q: Can I find a page with a dork after it has been deleted from the live site?**

A: A search engine's cached snapshot of a page is usually short-lived, but the Wayback Machine keeps its own long-term historical archive of many pages independent of whether the live version still exists, so it's worth checking there once a page a dork found is no longer live.

Sources:

- https://osintframework.com
- https://web.archive.org
- https://support.google.com/websearch/answer/2466433

### What Is Shodan Used For? Infrastructure & Attack-Surface Recon

- Page: https://osintyourself.com/learn/attack-surface-recon
- Reviewed: 2026-09-02

Every internet-connected device that answers a connection — a server, a camera, a router, an industrial controller — announces something about itself when it responds: a banner, a certificate, a version string. Device search engines exist because someone else is already asking every address on the internet that question and keeping the answers. Understanding what that means is more useful, and less dramatic, than the reputation suggests.

#### What internet-wide scanning actually does

A device search engine works by continuously scanning large swathes of the public internet, connecting to open ports the way any ordinary client would, and recording whatever the device sends back — a service banner, a software version, a TLS certificate, sometimes a login page. Nothing about this step requires bypassing a password or exploiting a flaw: it is the same handshake your browser or mail client performs every day, just run against a huge number of addresses instead of one, and archived rather than discarded.

The result is a searchable index of what is sitting on the internet right now — which IP addresses are running a particular kind of server software, which are exposing a database port that should not be public, which organisation a given block of addresses belongs to. None of that is secret information; it is what those services already publish to anyone who connects. The value of the index is that someone did the connecting at scale so you do not have to.

#### Why researchers and defenders use it legitimately

The dominant legitimate use of this kind of tool is defensive: a security team searches for their own organisation’s IP ranges or domains to see what is actually reachable from the outside world, which is often a different and larger list than what they believe they have deployed. Forgotten test servers, unpatched software still listening on a public port, or a misconfigured service that was never meant to face the internet routinely show up this way before anyone inside the organisation notices.

Researchers use the same indexes to study the internet at a macro level — how widely a piece of vulnerable software is still deployed after a patch is released, how many devices of a given type exist, how infrastructure for a particular kind of service is distributed geographically. That research depends on the index being a passive record of what is already publicly reachable, not on actively breaking into anything found in it.

#### Active scanning vs. passive lookup

It helps to separate two different activities that get lumped together under "recon". Active scanning means sending traffic to a target yourself and observing the response — this is what a device search engine’s own crawler does continuously, and it is also what a command-line network scanner does when you point it at a specific host or range on demand. Passive lookup means querying a dataset someone else already collected — searching an existing index of banners, certificates, or DNS records — without sending anything to the target yourself at that moment.

The practical difference matters because active scanning touches the target directly, right now, while passive lookup only touches an index that may be hours, days, or weeks old. Passive lookup is quieter and lower-friction for a first pass; a live, targeted scan gives you a current answer but is a more direct interaction with whatever you point it at.

#### What shows up about you or an organisation

For most individuals, very little turns up in these indexes beyond what your home router or ISP already exposes at your public IP address — and that address usually changes periodically anyway. The more relevant case is small businesses and self-hosted setups: a home lab, a personal server, a small company’s admin panel, or an IoT device left with a public-facing management interface. Any of these can be picked up the same way as anything else answering on a public port, whether or not the person running it realises it is reachable from outside their own network.

What a search typically reveals is limited to what the service itself announces — an open port, a software name and version, a certificate, sometimes a login screen. It is not a window into the contents of a database or the files behind a login; reaching those would require actually authenticating or exploiting something, which is a different act entirely from appearing in a passive index.

#### Reducing your own exposed surface

The defensive use of these tools is also the most actionable one for anyone running their own infrastructure. Search for your own domains and IP ranges periodically and treat anything unexpected as worth investigating: a service you did not know was public, a port left open after a test deployment, software running an old version you thought was patched. Closing or firewalling ports that do not need to be public, keeping software up to date, and putting administrative interfaces behind authentication or a VPN rather than leaving them open to the world removes most of what shows up this way.

This is also where the line between researcher and intruder actually sits: looking at what is already publicly reachable and indexed is fundamentally different from using that information to log in, exploit, or disrupt a system you do not have permission to touch. Rules around what is permitted vary by jurisdiction and by the terms of the tool you are using, and consent from whoever controls a system matters regardless of what a search engine happened to index.

FAQ:

**Q: Is it legal to search a device search engine for information about a server?**

A: Searching an existing index of publicly reachable devices is a different act from breaking into one, but rules vary by jurisdiction and by what you do with what you find. Consent from whoever controls a system matters regardless of how you found it — see the ethics and law guide for the general framing this site uses.

**Q: Does using a tool like this mean I am hacking something?**

A: No. Looking at an index of banners and open ports that a service already announces to any connecting client is not the same as exploiting, authenticating without permission, or disrupting a system. Those are separate acts that go well beyond a passive search.

**Q: What is the difference between a device search engine and running a scanner myself?**

A: A device search engine queries an index that its own crawler already built by scanning the internet continuously, so your search does not touch the target directly. Running a network scanner yourself sends traffic to a specific host or range right now and gets a live, current answer instead of whatever was last recorded.

**Q: How do I find out what is exposed about my own network?**

A: Search your own domains and IP ranges on a device search engine to see what an outside observer already sees, then close or firewall anything that does not need to be public, keep software patched, and put administrative interfaces behind authentication rather than leaving them open to the internet.

Sources:

- https://www.shodan.io/
- https://censys.io/
- https://nmap.org/
- https://www.greynoise.io/
- https://en.wikipedia.org/wiki/Attack_surface

### How the Dark Web Is Searched (Safely and Legally)

- Page: https://osintyourself.com/learn/dark-web-search
- Reviewed: 2026-09-02

The phrase "dark web" gets used to describe everything from a vague sense of digital danger to a specific, technical part of the internet. Most people who want to know whether their own information has "ended up on the dark web" do not actually need to open Tor, find a .onion address, or browse anything themselves. This guide separates what the dark web is from what it is usually confused with, explains why researchers monitor it at all, and walks through how indexing and threat-intelligence services let you check your exposure at a safe distance.

#### What the "dark web" actually is

The dark web refers specifically to networks that require special software to reach — most commonly Tor, which routes traffic through multiple relays to anonymize both the visitor and, for hidden services, the site itself. Addresses on this network end in .onion rather than a normal domain suffix, and they are not reachable with an ordinary browser or found through an ordinary search engine.

This is different from the "deep web," a much larger and far more mundane category that simply means anything not indexed by conventional search engines: your email inbox, your online banking dashboard, a company intranet, a paywalled article. Almost everyone uses the deep web constantly without thinking about it. The dark web, by contrast, is a small, specific slice of the internet that most people never have a reason to visit directly.

#### Why researchers monitor it

Stolen credentials, leaked databases, and stolen-data marketplaces circulate through dark web forums and Tor hidden services, often before that data becomes visible anywhere else. Security teams, journalists, and independent researchers monitor these spaces for mentions of an organization, a domain, or specific people, treating it as one more source of early warning about a breach or an active scam.

The same infrastructure is also used for entirely legitimate purposes — whistleblowing platforms, censorship-resistant publishing, and privacy-conscious communication in places where the open internet is monitored or restricted. Like a lot of OSINT-adjacent infrastructure, it is dual-use: the same anonymity that protects a journalist’s source also protects a criminal marketplace, and neither the network nor the fact that something sits on it tells you which one you are looking at.

#### The safety and legal risks of going there yourself

Browsing hidden services directly carries real, practical risks that most people underestimate. Phishing clones of well-known marketplaces and forums are common. Malware distributed through hidden services does not announce itself. There is no customer support, no reporting mechanism, and often no way to tell a clone from the real thing before it is too late. Stumbling across genuinely illegal or disturbing material by accident is also a real possibility on an unmoderated, loosely indexed network.

Whether accessing Tor or a hidden service is lawful where you live is a separate question from whether it is safe, and laws vary by jurisdiction — see the ethics-and-law guide before assuming anything about what is or is not permitted. For the specific, narrow goal of checking your own exposure, direct browsing is rarely necessary and rarely worth the risk.

#### How indexing and threat-intel services surface results without you going there

A category of onion-indexing search engines crawls a portion of active hidden services the same way an ordinary search engine crawls the open web, and lets you run a search from an ordinary browser. You see indexed titles and snippets without your own connection ever touching Tor for the search itself — though opening an actual result would still require it.

A separate category of leak-aggregation and paste-indexing search engines makes stolen or leaked data searchable in a structured way: by email address, username, or domain, rather than by scrolling through raw forum posts. And a category of URL and file scanning services checks a specific link, file, or indicator against many detection engines at once, which is how researchers confirm whether something circulating on the dark web is actually malicious without opening it themselves. None of these require you to install Tor or navigate a hidden service.

#### Checking whether your own data has surfaced

The practical version of "checking the dark web" for most people is checking whether your own email address or other identifiers appear in known breach and leak data — which is exactly what breach-notification and leak-index services are built for. If a search returns a hit, treat it as a prompt to change the affected password, stop reusing it anywhere else, and turn on multi-factor authentication where it is available, rather than as a reason to go looking for the source data yourself.

You can run this check for your own accounts using this site’s breach exposure checker, which is the safer, practical substitute for browsing dark web forums directly.

FAQ:

**Q: Is it illegal to access the dark web?**

A: Using Tor or visiting a hidden service is not inherently illegal in most places, but laws vary by jurisdiction, and what you do once there can be illegal regardless of the network. See the ethics-and-law guide rather than assuming either way.

**Q: What is the difference between the "deep web" and the "dark web"?**

A: The deep web is anything not indexed by ordinary search engines — a huge, mostly mundane category that includes your email inbox and online banking. The dark web is a specific, much smaller set of networks, most commonly Tor, that require special software to reach at all.

**Q: Do I need to install Tor to check if my data has leaked?**

A: No. Breach-notification and leak-index services let you search by email address or username from an ordinary browser, without connecting to Tor yourself.

**Q: Can visiting a dark web site harm my device?**

A: Yes — phishing clones and malware distributed through hidden services are a real, practical risk, and there is no support desk or reporting mechanism if something goes wrong. Most people checking their own exposure do not need to take that risk on directly.

**Q: Do dark web search engines index everything?**

A: No. Onion-indexing search engines and leak aggregators only cover a portion of active hidden services, by design and by policy — some explicitly exclude abuse material rather than indexing it.

Sources:

- https://www.torproject.org/about/history/
- https://ahmia.fi/
- https://haveibeenpwned.com/
- https://www.cisa.gov/topics/cyber-threats-and-advisories

### Link Analysis: Mapping Connections in an Investigation

- Page: https://osintyourself.com/learn/link-analysis
- Reviewed: 2026-09-02

A single fact rarely tells you much on its own. A phone number reused across two usernames, a domain registered with the same email as a company filing, a photo geotagged near an address that also shows up in a court record — none of these mean much in isolation, but put together they form a shape. Link analysis is the practice of deliberately building that shape instead of leaving it scattered across a dozen browser tabs and notes.

#### What link analysis actually is

Link analysis represents an investigation as a graph: entities become nodes — a person, an email address, a domain, a company, a phone number, a photo — and the relationships between them become edges — "registered by", "appeared in the same breach as", "shares a phone number with", "photographed at". Drawn out, a graph like this makes indirect connections visible in a way a flat list of facts never does: two people who never appear together in any single source can turn out to be one hop apart once their individual data points are connected through a shared node.

None of this requires special data — it is a way of organising facts you already found through ordinary OSINT techniques (username searches, breach data, public records, image metadata, infrastructure lookups). The graph does not generate new evidence; it makes the relationships between existing evidence visible and queryable.

#### Why investigators reach for it

Most real investigations do not fail because there is too little data — they fail because there is too much, spread across too many disconnected sources, for a person to hold the whole picture in their head at once. A graph externalises that picture. Patterns that are invisible in a spreadsheet — a small cluster of accounts that all reference the same obscure email, a company structure where the same handful of addresses reappear across supposedly unrelated entities — become visually obvious once the same data is laid out as nodes and edges.

It also makes gaps visible, which is just as useful as making connections visible. A node with very few edges is a thread worth pulling; a cluster with no path back to your original subject is a sign you have wandered off the actual investigation. Both are hard to notice in a list of notes and easy to notice in a graph.

#### The workflow: collect, normalise, connect, visualise

Link analysis tools generally follow the same rough sequence regardless of which one you use. First, you collect: gather facts from whatever OSINT techniques apply — searches, public records, breach data, metadata, infrastructure lookups — and capture them somewhere durable rather than trusting memory or open tabs. Second, you normalise: the same email address or phone number often appears written differently across sources, and a graph is only useful if those variants are recognised as the same entity rather than treated as separate, disconnected nodes.

Third, you connect: define the relationships between the entities you have collected, explicitly stating what kind of link each edge represents rather than just clustering things that seem related. Fourth, you visualise: lay the graph out so the structure — clusters, hubs, isolated nodes, chains — is readable at a glance, and can be filtered or expanded as the investigation grows. Skipping normalisation is the most common mistake: a graph full of near-duplicate nodes for the same entity looks busy but tells you less than a clean, smaller one would.

#### Graph databases vs. transform-based tools

Two different kinds of tool sit under the "link analysis" label, and they solve different problems. Transform-based tools start from a seed entity and offer to automatically run a set of lookups — "transforms" — against it, adding whatever they find as new connected nodes. They are built for exploratory, entity-by-entity investigation, where you keep expanding outward from a starting point one query at a time.

Graph databases instead store a large set of nodes and edges you have already collected — from any source — and let you query and traverse that data directly: find every path between two entities, find every node within two hops of a subject, and so on. They suit investigations that already have a lot of structured data and need it queried and analysed rather than expanded outward query by query. General-purpose graph-visualisation tools sit in between: you feed them a dataset you assembled elsewhere and use them mainly to lay it out and explore it visually.

#### Keeping your evidence organised

A graph is only as trustworthy as the evidence behind each node and edge, so the discipline that matters most is keeping a record of where each fact came from and when you found it — a screenshot, a URL, a timestamp — attached to the node or edge it supports, not filed away separately. Without that, a graph that looked solid when you built it becomes impossible to defend or even re-verify later, especially once a source page has changed or disappeared.

It is also worth periodically pruning: remove or clearly flag low-confidence connections rather than letting speculation sit visually identical to verified fact. A graph that mixes the two without distinction is the fastest way to convince yourself of a connection that was never actually there.

FAQ:

**Q: What is the difference between a node and an edge?**

A: A node is an entity in your investigation — a person, an email address, a domain, a company. An edge is the relationship connecting two nodes, such as "registered by" or "appeared in the same breach as". The nodes are what you know about; the edges are how it connects.

**Q: Do I need a graph database for a small personal investigation?**

A: Not usually. Graph databases suit large, already-structured datasets that need querying. For a smaller investigation, a general graph-visualisation tool, or even a well-organised spreadsheet paired with a diagram, can capture the same relationships without the overhead.

**Q: What is a "transform" in an OSINT link analysis tool?**

A: A transform is an automated lookup a tool runs against an entity you already have — for example, taking a domain and finding its registration details, or taking an email and checking it against other data — and adding whatever it finds as new connected nodes on your graph.

**Q: How do I avoid drawing false connections in a graph?**

A: Normalise entities carefully so you are not connecting two different things that merely look similar, attach a source and timestamp to every node and edge, and distinguish verified facts from speculation visually rather than letting them look the same on the graph.

Sources:

- https://en.wikipedia.org/wiki/Link_analysis
- https://en.wikipedia.org/wiki/Graph_theory
- https://neo4j.com/developer/graph-database/
- https://gephi.org/

## Glossary

Also at https://osintyourself.com/learn/glossary.

- **Active reconnaissance**: Gathering information by directly interacting with a target’s systems or accounts, such as sending a request to a server or visiting a tracked link. Unlike passive reconnaissance, it carries a chance of being detected.
- **ADS-B (Automatic Dependent Surveillance–Broadcast)**: A system that aircraft use to broadcast their identity, position, altitude, and speed. Ground receivers pick up these broadcasts and aggregate them into public flight-tracking sites.
- **AIS (Automatic Identification System)**: A system that ships use to broadcast their identity, position, course, and speed, originally intended for collision avoidance. Receivers around the world pick up these broadcasts and feed them into public vessel-tracking sites.
- **Alt account**: A secondary account run by the same person as their main account, usually to compartmentalize activity or preserve some privacy. This is distinct from a sock puppet, which is built to impersonate a separate, fictitious identity.
- **ASN (Autonomous System Number)**: A unique identifier assigned to a network operator, such as an internet service provider, hosting company, or large organization, that controls a block of IP addresses and routes traffic for them on the internet.
- **Attack surface**: The complete set of points where an unauthorized party could try to gain access to a system or extract data from it. Applied to a person, it means every account, device, and piece of exposed information that could be used against them.
- **Banner grabbing**: Connecting to a networked service, such as a web or mail server, and reading the identifying information it returns — typically the software name and version — to fingerprint what it is running.
- **Canary token**: A unique, trackable piece of data, such as a fake file, link, or credential, planted so that an alert fires the moment it is accessed. It reveals that an unauthorized access or breach happened, without needing to detect the intrusion itself.
- **Canvas fingerprinting**: A browser fingerprinting technique that draws a hidden image or text using the HTML5 canvas element. Because the result renders with tiny differences depending on the device’s graphics hardware and software, it can help distinguish one browser from another without using cookies.
- **CCPA (California Consumer Privacy Act)**: A California state law that grants residents rights over the personal information businesses collect about them, including the right to know what has been collected, to request its deletion, and to opt out of its sale.
- **Certificate transparency**: A public log system that records every publicly trusted TLS/SSL certificate issued for a domain. These logs can be searched to discover subdomains or infrastructure that a site owner never intended to publicize.
- **Chain of custody**: A documented, unbroken record of who has handled a piece of evidence and how, used to establish that it has not been altered or tampered with since it was collected.
- **Chronolocation**: Estimating when a photo or video was taken, as opposed to where, using visual clues such as shadow angles, weather, foliage, or a visible clock or event.
- **Credential stuffing**: An automated attack that tries username and password pairs stolen from one data breach against other, unrelated services, exploiting the fact that many people reuse the same password across sites.
- **Cross-referencing**: Comparing information found in one source against another to confirm it is accurate, find inconsistencies, or link two records together as referring to the same person or thing.
- **Dark web**: The part of the internet that is only reachable through specific software, most commonly Tor, and is not indexed by conventional search engines.
- **Data breach**: An incident in which data held by an organization is accessed, copied, or removed by someone who was not authorized to do so.
- **Data broker**: A company that collects personal information from public records, purchases, and other sources, then compiles and sells profiles or contact information about individuals.
- **Data leak**: Data that becomes exposed or publicly accessible, often through a misconfiguration or accidental publication, without necessarily involving an attacker breaking in.
- **Deep web**: The much larger part of the internet that is simply not indexed by search engines, including content behind logins, private databases, and paywalled pages. It is distinct from the dark web, which requires special software to reach.
- **Deepfake**: Synthetic media, generated or altered using machine learning, that depicts a person saying or doing something they did not actually say or do.
- **Digital footprint**: The total trail of data a person leaves behind through their online activity, including things they posted deliberately and things recorded about them by other people or systems without their direct involvement.
- **DNS (Domain Name System)**: The system that translates human-readable domain names into IP addresses. Its records, such as A, MX, TXT, and NS records, can reveal hosting providers, mail services, and other infrastructure relationships behind a domain.
- **Doxxing**: Publishing someone’s private or identifying information, such as a home address, workplace, or phone number, publicly — usually to harass, intimidate, or enable others to target them.
- **Email verification / account existence check**: Determining whether an email address is registered with a given service, often by exploiting sign-up or password-reset forms that respond differently depending on whether the account exists.
- **Entity resolution**: The process of determining whether different records, possibly from different sources or with slightly different details, refer to the same real-world person, organization, or thing.
- **Entropy (password)**: A measure, usually expressed in bits, of how unpredictable a password or piece of information is. Higher entropy means more possible combinations an attacker would need to try before guessing it.
- **EXIF data**: Exchangeable Image File Format metadata embedded in photos by cameras and phones, which can include the device model, timestamp, camera settings, and sometimes GPS coordinates of where the photo was taken.
- **Fingerprinting (browser/device)**: Identifying or tracking a specific browser or device based on the unique combination of its settings and characteristics, such as screen size, fonts, and installed plugins, rather than through cookies.
- **Footprinting**: The process of systematically collecting information about a target, whether a person or an organization, to build a picture of their infrastructure, accounts, or public presence.
- **GDPR (General Data Protection Regulation)**: An EU law that governs how organizations collect, use, and store the personal data of people in the EU, and grants individuals rights such as access to and deletion of the data held about them.
- **Geofencing**: Defining a virtual geographic boundary so that an action, such as an alert or a data request, is triggered when a device enters or leaves that area.
- **Geo-IP**: The practice of estimating a device’s physical location based on its IP address. It is typically accurate to a city or region, not a precise street address.
- **Geolocation**: Determining or estimating the physical location associated with a piece of data, such as a photo’s visible background, a device’s IP address, or coordinates embedded directly in a file.
- **Google dork / dorking**: Using a search engine’s advanced operators, such as site:, filetype:, or intitle:, to find pages or files that are indexed but not easily surfaced by an ordinary search.
- **Hash / hashing**: Running data through a one-way mathematical function that produces a fixed-length string, the hash. The same input always produces the same hash, but the original data cannot practically be recovered from it. Hashing is used to store passwords and verify file integrity.
- **Have I Been Pwned (HIBP)**: A widely used free service that lets people check whether their email address or phone number appears in known, publicly circulated data breaches.
- **Honeypot**: A decoy system, account, or piece of data set up to attract and detect unauthorized access attempts, without holding any real value of its own.
- **IMSI (International Mobile Subscriber Identity)**: A unique number that identifies a SIM card’s subscriber on a mobile network. It is distinct from the phone number, and from the IMEI (which identifies the physical handset) — swap the SIM into another phone and the IMSI stays the same. It is used by carriers, and by interception equipment known as IMSI catchers, to identify a specific SIM/subscriber.
- **IOC (indicator of compromise)**: A piece of forensic data, such as a file hash, IP address, or domain name, that suggests a system has been compromised or is associated with known malicious activity.
- **IP address**: A numerical label assigned to a device on a network. It can be used to approximate a device’s geographic location and identify the internet service provider it connects through.
- **k-anonymity**: A property of a dataset in which each record is indistinguishable from at least k-1 other records on the attributes that could identify someone. It is one way to measure how well a supposedly anonymized dataset actually protects individuals.
- **Link analysis**: A technique for visualizing and analyzing relationships between people, organizations, or pieces of data, typically represented as a network of connected nodes and edges.
- **MAC address**: A unique hardware identifier assigned to a network interface, such as a Wi-Fi or Bluetooth chip. Because it does not normally change, it can be used to track a specific device across networks unless the address is randomized.
- **Metadata**: Data about data: information describing a file or record, such as its author, creation date, originating device, or location, rather than its visible content.
- **Metadata scrubbing**: Removing hidden metadata, such as EXIF data, author names, or document revision history, from a file before sharing it, to prevent that information from being exposed.
- **Node and edge**: In a link-analysis graph, a node represents an entity, such as a person, account, or organization, and an edge represents a relationship or connection between two nodes.
- **Onion service**: A website or service reachable only through the Tor network, using a .onion address rather than a conventional domain, which conceals the server’s real location.
- **OPSEC (operations security)**: The practice of controlling what information about your activities, identity, or plans is exposed, so it cannot be used against you. Originally a military discipline, it is now applied to personal privacy and investigative work alike.
- **OSINT (open-source intelligence)**: Information gathered from sources that are publicly available, rather than obtained through hacking, deception, or insider access. The techniques originate in intelligence and journalism work but are now widely used at a much smaller, personal scale.
- **Passive reconnaissance**: Gathering information about a target without directly interacting with their systems or accounts, such as reading public records or archived pages, so the target has no way of detecting that it happened.
- **Password manager**: Software that generates and stores unique, complex passwords for each account, so a person only needs to remember one master password, or use a device-level unlock, to access them all.
- **Password spraying**: An attack that tries one or a few common passwords against many different accounts, rather than trying many passwords against a single account, to avoid triggering account-lockout defenses.
- **People-search site**: A website that aggregates public records, data-broker feeds, and other sources into searchable profiles of individuals, typically including addresses, relatives, and phone numbers. Most offer an opt-out process to have a listing removed.
- **PII (personally identifiable information)**: Any information that can be used, alone or combined with other data, to identify a specific individual, such as a full name, home address, national ID number, or biometric data.
- **Phishing**: Sending fraudulent messages, typically emails or texts, that impersonate a trusted sender to trick a person into revealing credentials, clicking a malicious link, or sending money.
- **Pivot / pivoting**: Moving from one piece of known information to a new one by following a connection between them — for example, going from a username to the email address tied to the same account.
- **Provenance**: The origin and subsequent history of a piece of content or data: where it first appeared, who created it, and how it has been copied or altered since.
- **Proxy server**: An intermediary server that relays requests between a client and the internet. It can be used to hide the origin IP address of a request, bypass geographic restrictions, or filter traffic.
- **Redaction**: Permanently removing or obscuring sensitive information from a document or image before it is shared, so that it cannot be recovered — distinct from simply covering it, which can sometimes be reversed.
- **Reverse DNS**: Looking up the domain name associated with a given IP address, the inverse of an ordinary DNS lookup. It can reveal what server or organization operates that IP address.
- **Reverse image search**: Searching using an image instead of text, to find where else that image, or a similar one, appears online. It is often used to identify a person, location, or the original source of a photo.
- **Right to be forgotten**: A legal right, most firmly established under EU law through the GDPR, allowing individuals to request that certain personal information about them be removed from search results or a data holder’s records under specific conditions.
- **Robots.txt**: A text file that a website can publish to tell web crawlers which parts of the site they are permitted, or asked not, to index. It is a request that well-behaved crawlers honor, not an enforced restriction.
- **Salt (cryptography)**: Random data added to a password before it is hashed, so that identical passwords produce different hashes. This defeats precomputed lookup-table attacks against stored password hashes.
- **Selector**: A specific piece of identifying information, such as a username, email address, phone number, or photo, used as a starting point or search term in an investigation.
- **Sextortion**: A form of extortion in which someone threatens to release sexual images or information about a victim unless they are paid or otherwise coerced.
- **SHA-1**: A cryptographic hash function that produces a 160-bit hash. It was once widely used for passwords and file integrity, but is now considered broken for security purposes because researchers have demonstrated practical collision attacks against it.
- **SIM swapping**: An attack in which someone tricks or bribes a mobile carrier into transferring a victim’s phone number onto a SIM card the attacker controls, letting them intercept calls and SMS-based verification codes.
- **Social engineering**: Manipulating a person, rather than a system, into divulging information or taking an action that undermines their own security, such as revealing a password or granting access.
- **Sock puppet**: A fake online identity, typically with its own name, photos, and history, created to interact with a target or platform without revealing the real person behind it.
- **Subdomain enumeration**: Systematically discovering the subdomains that exist under a given domain, often revealing test environments, internal tools, or forgotten services.
- **Suppression / opt-out**: The process of requesting that a data broker or people-search site remove your information from its public listings and, ideally, from its underlying database as well.
- **Threat intelligence**: Collected and analyzed information about existing or emerging threats, such as attackers, malware, or tactics, used to inform security decisions.
- **Threat model / threat modeling**: An analysis of who might want to target a specific person or organization, what resources they have, and what the most likely and most damaging attack paths are, used to prioritize which defenses actually matter.
- **TLS/SSL certificate**: A digital certificate that verifies a website’s identity and enables encrypted, HTTPS connections. Its issuance is recorded in certificate transparency logs.
- **Tor**: Free software and a volunteer-run network that routes internet traffic through multiple relays to conceal a user’s location and identity. It is also used to access .onion, dark-web, services.
- **Two-factor authentication (2FA)**: A login process that requires two different types of proof of identity, typically something you know (a password) and something you have (a code from an app or a physical key). It makes an account harder to access even if the password is stolen.
- **Username enumeration**: Checking whether a given username is registered on a platform, often by observing subtle differences in the site’s response, which can be used to find every platform a person uses the same handle on.
- **Verification (fact-checking)**: The process of independently confirming that a piece of information, image, or claim is accurate and correctly attributed before relying on it or publishing it.
- **VPN (virtual private network)**: A service that routes a device’s internet traffic through an intermediary server and encrypts it, hiding the user’s real IP address from the sites they visit and hiding their traffic from their local network or ISP.
- **Wayback Machine / web archive**: A service, most notably the Internet Archive’s Wayback Machine, that stores snapshots of web pages over time, allowing someone to view a site’s earlier content even after it has changed or been taken down.
- **WHOIS**: A public lookup protocol and database that shows registration information for a domain name, such as the registrar and registration dates, and, unless redacted by a privacy service, the registrant’s contact details.

## Alternatives

### 5 Maltego Alternatives (Open-Source & Freemium)

- Page: https://osintyourself.com/alternatives/maltego-alternatives
- Reviewed: 2026-09-14

Maltego is a visual link-analysis tool: it maps relationships between data points — domains, emails, people, infrastructure — as a graph you can explore and expand node by node. It's freemium, so a free community edition exists alongside paid tiers with higher transform limits.

Whether it's the right tool for you depends on what you're mapping and how you want to work. Some alternatives are graph-visualization or graph-database platforms you feed data into yourself; others are OSINT frameworks that both collect and structure the data, closer to what Maltego's transforms do out of the box.

Before picking one, weigh the same handful of things: is it free or does it need a paid tier to be useful, is it open-source (so you can self-host or inspect it) or a hosted product, does it require an account, and is it a general-purpose graph tool versus a purpose-built recon framework. The five below cover different points on that spread — not a ranking, just different tools for different parts of the same job.

- [Gephi](https://osintyourself.com/tools/gephi): Open-source and free, if you want a graph-visualization tool you can run yourself instead of a hosted or licensed product.
- [Neo4j](https://osintyourself.com/tools/neo4j): A graph database for storing and querying connected data, useful if you want to model the relationships yourself rather than rely on built-in transforms.
- [Lampyre](https://osintyourself.com/tools/lampyre): Also pulls data from 100+ sources into graphs, maps and tables, making it a closer like-for-like to Maltego's all-in-one workflow.
- [sn0int](https://osintyourself.com/tools/sn0int): Open-source and free, a semi-automatic OSINT framework for building up entity recon if you'd rather script and self-host the collection side.
- [Recon-ng](https://osintyourself.com/tools/recon-ng): Open-source and free, a modular web-recon framework with a Metasploit-like workflow for those who prefer a command-line, module-based approach over a graphical canvas.

FAQ:

**Q: Is there a free alternative to Maltego?**

A: Gephi, sn0int and recon-ng are all open-source and free to run yourself. Lampyre and Neo4j are freemium — usable for free at a smaller scale, with paid tiers for more.

**Q: Do I need an account to use these?**

A: It varies by tool — self-hosted, open-source options like Gephi, sn0int and recon-ng run locally without an account, while hosted or licensed products may require sign-up. Check each one's own site before assuming either way.

**Q: What's the difference between a graph tool and an OSINT framework?**

A: A graph-visualization or graph-database tool like Gephi or Neo4j expects you to bring the data and models the relationships you give it. An OSINT framework like Maltego, Lampyre, sn0int or Recon-ng also does some of the collecting, pulling from external sources via built-in transforms or modules.

**Q: Are any of these tools risky to use?**

A: Recon-ng, sn0int and Lampyre are dual-use — the same capabilities that map your own footprint can be pointed at someone else. (Gephi and Neo4j are general graph software and aren't flagged dual-use.) Laws on collecting and using information about other people vary by jurisdiction, and consent matters; see /learn/ethics-and-law before using any recon tool on anyone other than yourself.

### 5 Shodan Alternatives (Freemium & Open-Source)

- Page: https://osintyourself.com/alternatives/shodan-alternatives
- Reviewed: 2026-09-14

Shodan is a search engine for internet-connected devices — servers, IoT, cameras and other hardware exposed to the open internet. It's freemium, with a free tier for basic lookups and paid plans for deeper search. Because it indexes devices whether or not their owner realised they were reachable, it's dual-use: the same lookup that helps you check your own exposure can be used to find someone else's.

Other tools in this space split roughly two ways. Some are hosted search engines like Shodan itself, indexing the internet continuously so you can query it. Others are scanners you run yourself, sweeping ranges of addresses on demand rather than searching a pre-built index.

What matters when choosing between them is similar either way: is it free or does useful search depth sit behind a paid tier, is it a hosted product or something you self-host, and does it require an account to query. The five below span both approaches.

- [Censys](https://osintyourself.com/tools/censys): Also a freemium search engine for internet-facing hosts, certificates and services, making it the closest like-for-like to Shodan's hosted-index approach.
- [ZoomEye](https://osintyourself.com/tools/zoomeye): A freemium cyberspace search engine mapping internet-exposed devices, services and components — another hosted index to query instead of Shodan's.
- [Netlas](https://osintyourself.com/tools/netlas): A freemium internet-wide scanning and attack-surface search platform, offering a similar hosted-search route.
- [GreyNoise](https://osintyourself.com/tools/greynoise): Freemium and focused specifically on labelling internet background scan and attack traffic, useful if what you need is to separate noise from real threats rather than a general device index.
- [Masscan](https://osintyourself.com/tools/masscan): Open-source and free, if you would rather run your own internet-scale TCP port scanner over a chosen address range instead of querying someone else's index.

FAQ:

**Q: Is there a free alternative to Shodan?**

A: Masscan is open-source and free to run yourself. Censys, ZoomEye, Netlas and GreyNoise are all freemium, like Shodan — usable at a smaller scale for free, with paid tiers for deeper search.

**Q: Do these tools need an account?**

A: Hosted search engines like Censys, ZoomEye and Netlas typically require sign-up, similar to Shodan. Masscan is a self-run scanner and does not require an account.

**Q: What's the difference between a search engine and a scanner?**

A: Shodan, Censys, ZoomEye and Netlas continuously index the internet so you can query a pre-built database. Masscan instead sweeps address ranges you point it at on demand, and GreyNoise focuses on classifying scan traffic rather than indexing devices.

**Q: Can these tools expose my own devices?**

A: Yes — indexes like Shodan, ZoomEye and Netlas can surface internet-facing devices you run (routers, cameras, NAS) even if you did not realise they were reachable. Checking your own exposure is a reasonable use; scanning or querying devices belonging to someone else raises legal and ethical questions covered at /learn/ethics-and-law.

### 5 PimEyes Alternatives for Reverse Face & Image Search

- Page: https://osintyourself.com/alternatives/pimeyes-alternatives
- Reviewed: 2026-09-14

PimEyes is a facial-recognition search engine: upload a photo of a face and it finds other places online where that same face appears. It's freemium — a limited free search with paid tiers for full results. Used on your own photo, it's a way to see how much of your face is findable across the web, and PimEyes itself offers a removal request process if you find matches you didn't expect.

Facial-recognition search is dual-use: a tool built to match faces can be pointed at anyone, not just yourself, which is where the risk of stalking or harassment comes in. FaceCheck.ID is a dedicated face search like PimEyes. The general reverse-image engines below vary: Yandex Images, Google Lens and Picarta can still match a photo to identify the person, place or location in it (all flagged dual-use), so they aren't risk-free; TinEye is the exception — it matches a whole image to find where it has appeared, without identifying who is in it, which is the lower-risk way to check where a photo has spread.

Before picking one, weigh: does it match faces specifically or images generally, is it free or freemium, does it need an account, and — for any face-search tool — what its own policy says about acceptable use. None of this is legal advice: laws on facial recognition and biometric data vary by jurisdiction, and consent matters. Only run a face search on your own photo, or with the clear consent of the person in it.

- [FaceCheck.ID](https://osintyourself.com/tools/facecheck-id): Also a freemium facial-recognition search engine finding where a face appears across the web — the closest like-for-like to PimEyes, and its own listing carries the same stalking/harassment caution.
- [TinEye](https://osintyourself.com/tools/tineye): A freemium reverse-image search that matches the whole image and finds its earliest known use online, rather than matching faces specifically — a lower-risk way to check where a photo has spread.
- [Yandex Images](https://osintyourself.com/tools/yandex-images): Free, and noted for strong face and location matching within its general reverse-image search, if you want a no-cost way to check where your own photos surface.
- [Google Lens](https://osintyourself.com/tools/google-lens): Free and needs no account, using Google's visual search to identify objects, places and text in an image — useful for checking a photo generally rather than matching a face.
- [Picarta](https://osintyourself.com/tools/picarta): A freemium AI tool that predicts where a photo was taken from its visual content, useful if what you want to check is location clues in your own photos rather than face matches.

FAQ:

**Q: Is it legal to run a face search on someone else's photo?**

A: It depends on where you are and what you do with the result — facial-recognition and biometric-data laws vary by jurisdiction, and consent matters. Treat face-search tools like PimEyes and FaceCheck.ID as ones to run on your own face to check what's findable, not on strangers.

**Q: Can these tools be used for stalking?**

A: A search built from a photo of a stranger can enable stalking or harassment. That's why PimEyes and FaceCheck.ID (dedicated face search) are flagged dual-use — and so are Yandex Images, Google Lens and Picarta, because they can match a photo to identify the person, place or location in it. Only TinEye is content-match only. Using any of them on your own photo to see your own exposure is a different use case from running it on someone else without their knowledge.

**Q: Do I need an account to use these?**

A: Google Lens and Yandex Images are free and do not require an account for basic use. PimEyes, FaceCheck.ID, TinEye and Picarta are freemium and typically need sign-up for full results.

**Q: What should I do if a face search finds photos I did not expect?**

A: PimEyes and similar services generally offer a removal-request process for photos matched to your face — check the specific tool's own site for how to submit one. See /learn/ethics-and-law for more on the legal side of facial-recognition search.

### 5 Sherlock Alternatives for Username Search

- Page: https://osintyourself.com/alternatives/sherlock-alternatives
- Reviewed: 2026-09-14

Sherlock is an open-source, free command-line tool that hunts a single username across hundreds of sites, showing you where an account with that name exists. Run against your own usernames, it's a practical demonstration of how far a name you reuse everywhere can be traced back to you.

The other tools below do a similar job with different trade-offs: some check a fixed list of sites for matching accounts, others also check whether a username is still available to register, and coverage and output format (CLI dossier, web app, API) differ between them.

What to weigh when choosing: is it open-source and self-run, free versus freemium, and does the tool build a dossier of matches versus simply reporting availability. All of these are dual-use — the same lookup that shows you your own footprint can be pointed at anyone whose username you know.

- [WhatsMyName](https://osintyourself.com/tools/whatsmyname): Also open-source, enumerating a username's presence across sites — a close like-for-like to Sherlock's own approach.
- [Maigret](https://osintyourself.com/tools/maigret): Open-source and free, building a fuller dossier from a username by checking thousands of sites for matching accounts.
- [Blackbird](https://osintyourself.com/tools/blackbird): Open-source and free, a fast username and email search across 600+ platforms if you want email coverage alongside usernames.
- [Social Analyzer](https://osintyourself.com/tools/social-analyzer): Open-source and free, available as an API, CLI or web app, and checks 1000+ social sites if you want more coverage or a non-CLI interface than Sherlock's.
- [Namechk](https://osintyourself.com/tools/namechk): Freemium, and checks whether a username or domain is available or already taken — useful if what you actually need is availability rather than a list of existing accounts.

FAQ:

**Q: Is there a free alternative to Sherlock?**

A: WhatsMyName, Maigret, Blackbird and Social Analyzer are all open-source and free. Namechk is freemium.

**Q: Do these tools require an account?**

A: No — Sherlock, WhatsMyName, Maigret, Blackbird and Social Analyzer are open-source tools you run yourself without signing up. Namechk's freemium tiers may require an account for extended use; check its own site for current terms.

**Q: What's the difference between a dossier tool and an availability checker?**

A: Sherlock, WhatsMyName, Maigret, Blackbird and Social Analyzer report where an existing account with a given username was found. Namechk instead checks whether a username or domain is still available to register.

**Q: Is it okay to run these on someone else's username?**

A: Reusing one username lets tools like these link accounts together, which is exactly why running one on your own usernames is useful — it shows your own exposure. Running the same lookup on someone else's username without their knowledge is a different matter; see /learn/ethics-and-law.

### 5 Have I Been Pwned Alternatives (Free & Paid Breach Search)

- Page: https://osintyourself.com/alternatives/haveibeenpwned-alternatives
- Reviewed: 2026-09-14

Have I Been Pwned is a free tool that checks whether an email or account appears in known data breaches. It's the defensive counterpart to breach-hunting tools generally — built for checking your own exposure rather than searching for someone else's.

Other breach-search tools go further than a simple "were you breached" check: some index the actual leaked credentials and personal records themselves, which makes them more powerful but also paid or account-gated, and it means they can just as easily be used to look up someone else as yourself.

What to weigh when choosing: is it a free yes/no lookup or a paid database of the actual leaked data, does it require an account, and how it's described in terms of dual use. If a tool lets you search leaked passwords or personal records rather than just flagging a breach occurred, treat it more carefully — it's built for looking up your own exposure, not someone else's.

- [DeHashed](https://osintyourself.com/tools/dehashed): A paid search engine over billions of breached credentials and personal records, going further than a yes/no check by surfacing the leaked data itself — useful for checking your own exposure in more depth.
- [LeakCheck](https://osintyourself.com/tools/leakcheck): Freemium, a data-breach search engine for exposed emails, usernames and passwords, if you want a lower-cost step up from a free lookup.
- [BreachDirectory](https://osintyourself.com/tools/breachdirectory): Free, offering a lookup to see if an email or username appears in public breaches — the closest free like-for-like to Have I Been Pwned.
- [Intelligence X](https://osintyourself.com/tools/intelx): Freemium, a broader search engine over leaks, pastes, darknet and historical web data if breach records alone are not enough.
- [Snusbase](https://osintyourself.com/tools/snusbase): A paid breach-search database indexing leaked credentials and personal data, for a deeper paid alternative to a free breach check.

FAQ:

**Q: Is there a free alternative to Have I Been Pwned?**

A: BreachDirectory is free. LeakCheck and Intelligence X (intelx) are freemium, usable at a smaller scale for free. DeHashed and Snusbase are paid.

**Q: What's the difference between a breach checker and a breach-data search engine?**

A: Have I Been Pwned and BreachDirectory tell you whether an email or username appears in a known breach. DeHashed and Snusbase go further, indexing the actual leaked credentials and personal records so you can search the data itself.

**Q: Do I need an account to check my own exposure?**

A: Have I Been Pwned and BreachDirectory can be checked without deep sign-up for a basic lookup. DeHashed, LeakCheck, Intelligence X and Snusbase are account- or subscription-gated for full access — check each one's own site for current terms.

**Q: What should I do if my email or password turns up in a breach?**

A: Assume any password in a past breach is public — rotate it, and any other accounts reusing it, and turn on two-factor authentication where available. See /learn/ethics-and-law for the broader context on handling your own exposed data.

### 4 ExifTool Alternatives (Free and Open-Source)

- Page: https://osintyourself.com/alternatives/exiftool-alternatives
- Reviewed: 2026-09-14

ExifTool is a free, open-source command-line tool that extracts hidden metadata from images, documents and other media — things like embedded GPS coordinates, device IDs and edit history that ride along inside a file. It runs locally on your own machine, which matters if the files you are inspecting are sensitive: nothing is uploaded to a third party.

The alternatives below cover a different part of the same job: some are online viewers you can use without installing anything, one focuses on detecting image tampering rather than just reading tags, and two are OSINT tools that start from a domain rather than a file: they find the documents it publishes, which FOCA then analyses itself and Metagoofil downloads for a tool like ExifTool to read. When picking one, weigh whether you need a local command-line tool or a quick browser check, whether uploading a file to a hosted service is acceptable for what you are inspecting, and whether you actually need to search for documents first or already have the file in hand.

All four listed here are free to use, and two of them (Metagoofil and FOCA) are open source like ExifTool itself.

- [Jimpl](https://osintyourself.com/tools/jimpl): Jimpl is a free online EXIF viewer that shows a photo's hidden camera, GPS and timestamp data without needing to install anything, which is useful if you just want a quick browser-based check rather than ExifTool's command line.
- [FotoForensics](https://osintyourself.com/tools/fotoforensics): FotoForensics is a free online tool that goes further than reading tags — it runs error-level analysis alongside metadata inspection to help detect whether an image has been edited.
- [Metagoofil](https://osintyourself.com/tools/metagoofil): Metagoofil is open source like ExifTool and works one step earlier: it searches Google for public documents of chosen file types on a domain and can download them. Its README says it deliberately leaves metadata analysis to tools like ExifTool, so the two are used together when looking at an organisation rather than a single file.
- [FOCA](https://osintyourself.com/tools/foca): FOCA is another free, open-source tool for extracting hidden metadata and information from Office, PDF and image files.

FAQ:

**Q: Is ExifTool free?**

A: Yes — ExifTool is free and open source, and it runs entirely on your own machine rather than uploading files to a server.

**Q: Should I upload sensitive files to an online metadata viewer?**

A: Think about what is in the file first. A tool like Jimpl or FotoForensics runs in your browser and uploads the file to their server, whereas ExifTool, Metagoofil and FOCA can be run locally. For anything sensitive, a local tool avoids sending the file to a third party at all.

**Q: Is it legal to extract metadata from someone else's documents or photos?**

A: Laws vary by jurisdiction and consent matters — reading metadata from files someone has published publicly is different from targeting an individual without their knowledge. See our guide on ethics and law before using any of these tools on data that isn't your own.

**Q: How do I stop my own photos from leaking metadata?**

A: Run your own photos through ExifTool, Jimpl or FotoForensics before posting them publicly, and strip GPS and device metadata first — many phones and social platforms include this data by default.

### 4 Spokeo Alternatives (People Search and Public Records)

- Page: https://osintyourself.com/alternatives/spokeo-alternatives
- Reviewed: 2026-09-14

Spokeo is a paid people-search service that aggregates public records and social profiles into a single searchable listing. It is worth being clear about which side of the search you're on: Spokeo is also a data broker, meaning it compiles and sells profiles on ordinary people, not just a lookup tool you use on others.

If you're searching for someone else, the alternatives below give you a mix of free US people-search sites and an open company-registry database, so you can compare what a paid aggregator surfaces against what is freely available. If instead you found your own listing and want it taken down, searching harder isn't the goal — see the opt-out route below instead.

Three of the four alternatives here are free, US-focused people-search tools; the fourth, OpenCorporates, is a free-to-search open database limited to company officers rather than general public records.

- [TruePeopleSearch](https://osintyourself.com/tools/truepeoplesearch): TruePeopleSearch is a free US people-search site returning addresses, phone numbers and relatives, covering similar ground to Spokeo without a paid tier.
- [FastPeopleSearch](https://osintyourself.com/tools/fastpeoplesearch): FastPeopleSearch is a free US people lookup by name, phone or address, offering the same kind of aggregated public-record search as Spokeo at no cost.
- [ThatsThem](https://osintyourself.com/tools/thatsthem): ThatsThem is a free people-search site aggregating names, addresses, emails and phone numbers, another no-cost alternative to Spokeo's paid listings.
- [OpenCorporates](https://osintyourself.com/tools/opencorporates): OpenCorporates is the largest open database of companies and their officers sourced from official registries, useful when what you actually need is a person's company directorships rather than a home address.

FAQ:

**Q: How do I remove myself from Spokeo?**

A: Spokeo offers an opt-out process for removing your own listing. See our step-by-step guide at /protect/data-removal/spokeo.

**Q: Are the free alternatives to Spokeo as accurate?**

A: Each site pulls from its own mix of public records, so results and coverage vary between them and against Spokeo. Check more than one if you need to confirm a detail.

**Q: Is it legal to look someone up on a people-search site?**

A: Laws vary by jurisdiction and consent matters, especially if you plan to act on what you find or contact someone. See our guide on ethics and law before searching for another person.

**Q: Do these free people-search sites also sell my data like Spokeo?**

A: TruePeopleSearch, FastPeopleSearch and ThatsThem are also data brokers that aggregate and publish public records on ordinary people, so if you find your own listing on one of them, look for its opt-out process the same way you would on Spokeo.

### 5 SecurityTrails Alternatives (DNS, WHOIS and Subdomain Lookups)

- Page: https://osintyourself.com/alternatives/securitytrails-alternatives
- Reviewed: 2026-09-14

SecurityTrails is a freemium platform providing historical DNS, WHOIS and subdomain data for domains and IP addresses. Its historical archive is the main thing you're paying for beyond the free tier — the ability to look back at how a domain's records changed over time.

The alternatives below are mostly free, single-purpose tools rather than one platform that does everything: some map subdomains and hosts, one searches Certificate Transparency logs, one is a general free toolbox of DNS/WHOIS/reverse-IP lookups, one specializes in reverse-WHOIS by registrant name, and one is a broader internet-wide scanning platform. Deciding between them mostly comes down to whether you need current-state lookups (most of these are free) or the kind of historical record and account-based workflow SecurityTrails charges for.

Three of the five alternatives here are free with no account required (DNSDumpster, crt.sh and ViewDNS.info); Whoxy and Netlas are both freemium, like SecurityTrails itself.

- [DNSDumpster](https://osintyourself.com/tools/dnsdumpster): DNSDumpster is a free domain research tool that maps a domain's subdomains and hosts, covering the core subdomain-mapping use case of SecurityTrails at no cost.
- [crt.sh](https://osintyourself.com/tools/crt-sh): crt.sh searches Certificate Transparency logs to enumerate a domain's certificates and subdomains, a free way to surface subdomains that SecurityTrails would otherwise show from its own index.
- [ViewDNS.info](https://osintyourself.com/tools/viewdns): ViewDNS.info is a free collection of DNS, WHOIS, reverse-IP and network lookup tools, giving a broader free toolbox to pair with the others.
- [Whoxy](https://osintyourself.com/tools/whoxy): Whoxy is freemium like SecurityTrails and specializes in WHOIS lookup and reverse-WHOIS history, including registrant-name search, which is a more targeted alternative if what you need is historical ownership records.
- [Netlas](https://osintyourself.com/tools/netlas): Netlas is a freemium internet-wide scanning and attack-surface search platform, a broader alternative if you want to search exposed infrastructure rather than just DNS and WHOIS records.

FAQ:

**Q: Do I need an account to use these SecurityTrails alternatives?**

A: DNSDumpster, crt.sh and ViewDNS.info are free to use without an account. Whoxy and Netlas are freemium, so deeper lookups or higher volume may require a paid account, the same as SecurityTrails.

**Q: Which alternative is closest to SecurityTrails's historical DNS data?**

A: None of the free tools listed here reproduce SecurityTrails's full historical archive on their own; Whoxy comes closest for historical WHOIS/registrant records specifically.

**Q: Is it legal to look up who owns a domain?**

A: Laws vary by jurisdiction and consent matters, particularly around what you do with registrant information once you find it. See our guide on ethics and law for more.

**Q: Can I use these tools to check my own domain's exposure?**

A: Yes — running your own domain through DNSDumpster, crt.sh or Netlas is a reasonable way to see what subdomains, certificates or exposed services are publicly discoverable about infrastructure you control.

### 4 Hunter.io Alternatives (Email OSINT and Verification)

- Page: https://osintyourself.com/alternatives/hunter-io-alternatives
- Reviewed: 2026-09-14

Hunter.io is a freemium tool that finds and verifies professional email addresses associated with a domain — useful when you have an organisation and want to find the email format or a specific person's work address.

The alternatives below solve a related but different problem: rather than finding a domain's email addresses, they take a single email address you already have and investigate it — checking which sites it's registered on, whether it appears in breaches, or what it reveals about a linked Google account. Three of them (Holehe, GHunt, h8mail) are open source and run locally, which matters if you'd rather not send the address you're investigating to a third-party server; Epieos is freemium and hosted, closer to Hunter.io's account-based model.

Weigh whether you're starting from a domain (Hunter.io's use case) or from a single email address (what these four are built for), and whether running a local open-source tool versus a hosted account-based service fits how you work.

- [Epieos](https://osintyourself.com/tools/epieos): Epieos is a freemium reverse email lookup and digital-footprint tracing tool, the closest match to Hunter.io's account-based model but working from a single address rather than a domain.
- [Holehe](https://osintyourself.com/tools/holehe): Holehe is open source and checks whether an email is registered on 120+ sites via password-reset flows, giving a free, local way to see where a single address is registered.
- [GHunt](https://osintyourself.com/tools/ghunt): GHunt is open source and investigates Google accounts, extracting data tied to a Gmail address, which suits digging into a specific Gmail address rather than finding a company's email format.
- [h8mail](https://osintyourself.com/tools/h8mail): h8mail is an open-source email OSINT and breach-hunting tool that pulls exposures for an address, useful if what you need is breach exposure rather than domain email discovery.

FAQ:

**Q: Is Hunter.io free?**

A: Hunter.io is freemium — it has a free tier with limited searches and paid plans for higher volume.

**Q: Do these Hunter.io alternatives require an account?**

A: Epieos is freemium like Hunter.io, while Holehe, GHunt and h8mail are open-source command-line tools you run yourself without signing up for an account.

**Q: Is it legal to check whether an email is registered on other sites?**

A: Laws vary by jurisdiction and consent matters — checking your own email's exposure is different from investigating someone else without their knowledge. See our guide on ethics and law before using any of these on an address that isn't yours.

**Q: Can I use these tools to check my own email exposure?**

A: Yes — running Holehe or h8mail against your own address is a reasonable way to see which sites it's registered on and whether it has appeared in known breaches.

### 4 Hunchly Alternatives for Organizing OSINT Research

- Page: https://osintyourself.com/alternatives/hunchly-alternatives
- Reviewed: 2026-09-14

Hunchly is a paid browser capture tool that automatically logs and timestamps webpages visited during research, building a running record of an investigation as you browse. None of the tools below capture and timestamp webpages the way Hunchly does — that specific job is Hunchly's own niche.

What they do instead is cover the adjacent parts of an investigator's workflow that Hunchly doesn't: organizing and linking case notes, building a forensic timeline, cross-referencing a large set of documents, or visually mapping relationships between data points. Depending on what "organizing research" means for your case, one of these may replace part of what you'd otherwise track manually alongside Hunchly, rather than being a drop-in substitute for its capture-and-timestamp function.

Cost varies more here than on most comparison pages: Obsidian and Maltego are freemium, while Timesketch and Aleph are open source and free, against Hunchly's paid, browser-capture-only license.

- [Obsidian](https://osintyourself.com/tools/obsidian): Obsidian is a freemium, local markdown note-taking app used by investigators to organize and link case notes, covering the note-organization side of a Hunchly-style workflow even though it doesn't capture webpages itself.
- [Timesketch](https://osintyourself.com/tools/timesketch): Timesketch is an open-source collaborative forensic timeline analysis tool, useful for building the kind of chronological record of an investigation that Hunchly's timestamped log otherwise provides.
- [Aleph](https://osintyourself.com/tools/aleph): Aleph is OCCRP's open-source platform for searching and cross-referencing leaked and public documents and data, suited to investigations built around a large document set rather than a browsing session.
- [Maltego](https://osintyourself.com/tools/maltego): Maltego is a freemium visual link-analysis tool for mapping relationships between data points, useful for visualizing connections uncovered during research rather than logging the pages you visited.

FAQ:

**Q: Do any of these replace Hunchly's webpage capture and timestamping?**

A: No — none of the four tools here automatically log and timestamp webpages as you browse the way Hunchly does. They cover adjacent parts of an investigation, like note-taking, timelines, document search or link mapping.

**Q: Are these Hunchly alternatives free?**

A: Timesketch and Aleph are open source and free. Obsidian and Maltego are freemium, with paid tiers for extra features, compared to Hunchly's paid-only license.

**Q: Can I use more than one of these together?**

A: Yes — investigators commonly combine a note-taking tool like Obsidian with a link-analysis tool like Maltego, since they cover different parts of organizing a case rather than overlapping.

**Q: Is it legal to compile a case file on someone using these tools?**

A: Laws vary by jurisdiction and consent matters, particularly around retaining personal data you've gathered on someone. See our guide on ethics and law before starting an investigation into another person.

## Data-removal guides

### Spokeo

- Page: https://osintyourself.com/protect/data-removal/spokeo
- Opt-out page: https://www.spokeo.com/optout
- Time estimate: 24–48 hours after you confirm by email
- Requires: The URL of your Spokeo profile listing; An email address (Spokeo emails you a confirmation link)
- Verified: 2026-08-31

Steps:

1. **Find your profile and copy its URL** Search Spokeo for yourself and open the listing that shows your details. Copy the full profile URL from your browser — it looks like spokeo.com/Name/City/State/p… You may have more than one listing; each one has its own URL and has to be opted out separately.
2. **Submit the opt-out form** Go to spokeo.com/optout, paste your profile URL into the URL field, enter your email address, and click Opt Out.
3. **Confirm by email** Spokeo sends a confirmation email. Open it and click the link to complete the removal. Spokeo states requests are processed within 24–48 hours after this confirmation.

Relisting: Spokeo says it continually receives new and updated records from public sources, so your information can reappear later without notice. Treat this as a recurring check, not a one-time fix, and opt out any new listings that show up.

Sources:

- https://www.spokeo.com/optout
- https://www.spokeo.com/privacy-policy

### Whitepages

- Page: https://osintyourself.com/protect/data-removal/whitepages
- Opt-out page: https://www.whitepages.com/suppression-requests
- Time estimate: not stated by Whitepages on the form
- Requires: The URL of your Whitepages profile listing
- Verified: 2026-08-31

Steps:

1. **Find your listing and copy its URL** Search Whitepages for yourself, open your listing, and copy its profile URL from your browser.
2. **Start the suppression request** Go to whitepages.com/suppression-requests and paste your profile URL into the first step of the form. This is a separate suppression flow from the normal site search, and it ran as a five-step form when we checked it.
3. **Work through the remaining steps as prompted** Continue through the rest of the form as Whitepages prompts you, and submit. We were not able to capture what steps 2–5 ask for, so follow the on-screen instructions — don’t rely on us for the exact fields.

Sources:

- https://www.whitepages.com/suppression-requests

### MyLife

- Page: https://osintyourself.com/protect/data-removal/mylife
- Opt-out page: https://www.mylife.com/privacyrequest
- Time estimate: around 5 days, per MyLife’s own reported median
- Requires: An email address (for contact and identity verification); Enough detail to verify your identity — MyLife may confirm an email or home address
- Verified: 2026-08-31

Steps:

1. **Open MyLife’s privacy request page** Go to mylife.com/privacyrequest and submit a request to opt out of the sale/sharing of your personal information, or to have it deleted. (This is the working request page — the general privacy policy links to it.)
2. **Or email your request directly** Alternatively, email membersupport@mylife.com and state that you want to opt out of the sale and sharing of your personal information, and/or request deletion of your profile.
3. **Complete identity verification** MyLife verifies who you are before acting — typically by confirming information such as your email or home address. Respond to any verification request they send.

Relisting: MyLife’s deletion applies to information you gave them, not necessarily to public records or data purchased from third parties, and the company notes that small discrepancies in data can make complete removal difficult. Check back periodically.

Sources:

- https://www.mylife.com/privacyrequest
- https://www.mylife.com/privacy-policy/

### US Search

- Page: https://osintyourself.com/protect/data-removal/ussearch
- Opt-out page: https://www.ussearch.com/opt-out/
- Time estimate: not stated by US Search on the suppression tool
- Requires: The name and details that match your public listing; Likely an email address for verification
- Verified: 2026-08-31

Steps:

1. **Open the suppression center** Go to ussearch.com/opt-out/ and use the suppression tool. From the navigation, choose the identity / suppression settings option to begin locating your listing.
2. **Identify your listing and follow the guided removal** Enter the name and information that matches your public listing and follow the guided suppression flow to remove your background report from name-search results.

Relisting: US Search warns that because of public records and third-party data, small discrepancies can make complete removal difficult, and your details may still surface in phone, address or email reports even after you suppress your background report. Contact them if data reappears.

Sources:

- https://www.ussearch.com/opt-out/

### LexisNexis

- Page: https://osintyourself.com/protect/data-removal/lexisnexis
- Opt-out page: https://consumer.risk.lexisnexis.com/request
- Time estimate: not stated by LexisNexis on the form
- Requires: Your full name, street address, city, state, ZIP, and date of birth; Optionally an SSN or driver’s licence number + state (improves verification); No email is strictly required — a phone option is offered
- Verified: 2026-08-31

Steps:

1. **Open the consumer request form** Go to consumer.risk.lexisnexis.com/request. This is LexisNexis’s own consumer portal for accessing and requesting suppression of your data.
2. **Fill in the required identity fields** Enter your first and last name, street address, city, state, ZIP and date of birth. Optionally add an SSN or driver’s licence number and state — LexisNexis recommends one of these for faster, more reliable verification.
3. **Select the request type and submit** Choose the appropriate request (for example, your consumer disclosure), add a delivery address if it differs from your residence, and submit the form. If they can’t process it online, LexisNexis follows up by U.S. Mail.

Sources:

- https://consumer.risk.lexisnexis.com/request
- https://consumer.risk.lexisnexis.com/help

### Acxiom

- Page: https://osintyourself.com/protect/data-removal/acxiom
- Opt-out page: https://www.acxiom.com/optout/
- Time estimate: about two weeks after you confirm by email
- Requires: A valid email address (Acxiom emails a confirmation you must action); Your name and contact details for the form; Or a phone: (877) 774-2094 if you have no email
- Verified: 2026-08-31

Steps:

1. **Open Acxiom’s opt-out page** Go to acxiom.com/optout and choose the option for a US individual (or someone acting on another’s behalf) opting out.
2. **Complete the opt-out form** Provide a valid email address and your details. Acxiom is a marketing-data broker rather than a public search site, so this suppresses your profile from the data it sells to advertisers.
3. **Confirm by email** Acxiom emails you a confirmation. Action it (click the link or reply as instructed) to validate the request. They state it is processed within about two weeks of that confirmation. No email? Call (877) 774-2094 to opt out by phone.

Relisting: Acxiom states the opt-out does not remove data already provided to marketers before your request — it stops future sharing rather than clawing back what was already sold.

Sources:

- https://www.acxiom.com/optout/

### Google "Results about you"

- Page: https://osintyourself.com/protect/data-removal/google-results
- Opt-out page: https://myactivity.google.com/results-about-you
- Time estimate: Google reviews each request; no fixed time is stated
- Requires: A personal Google account (you must sign in)
- Verified: 2026-08-31

Steps:

1. **Open “Results about you” and sign in** Go to myactivity.google.com/results-about-you and sign in with your personal Google account.
2. **Find results that expose your contact details** Search your name and other details to surface search results that show your personal contact information (phone, home address, email).
3. **Request removal** On a result that contains your personal information, choose Request removal, confirm it meets Google’s policy (it must expose contact-type personal info), and submit. Google reviews the request and removes qualifying results from Search. You can also add details to be notified if they appear in future.

Relisting: This removes the result from Google Search only — not the underlying page. The source site still has your information, and if that page is re-crawled the result can return. Removing the data at the source (the broker itself) is the durable fix; this hides the Google result.

Sources:

- https://myactivity.google.com/results-about-you

### BeenVerified

- Page: https://osintyourself.com/protect/data-removal/beenverified
- Opt-out page: https://www.beenverified.com/app/optout/search
- Time estimate: a few minutes (BeenVerified describes the process as easy)
- Requires: An email address (BeenVerified’s FAQ references it in the opt-out flow); Enough detail to identify the record as yours
- Verified: 2026-08-31

Steps:

1. **Open the BeenVerified opt-out page** Go to the BeenVerified opt-out page (linked above). Its FAQ points you here and describes the removal as straightforward.
2. **Find your record and follow the removal steps** Locate the listing that matches you and follow the on-screen steps to remove it. The form is JavaScript-rendered, so follow BeenVerified’s own prompts for the exact fields.

Relisting: BeenVerified’s FAQ notes that different information about you can still appear later when it “can’t conclusively be associated” with what you already opted out — and says you can opt that out too. Treat this as a recurring check.

Sources:

- https://www.beenverified.com/faq

### Intelius

- Page: https://osintyourself.com/protect/data-removal/intelius
- Opt-out page: https://www.intelius.com/opt-out/
- Time estimate: roughly 10–15 minutes
- Requires: Your full name, to locate your record; Likely an email address for confirmation; Possibly identity verification (PeopleConnect sites sometimes ask for this)
- Verified: 2026-08-31

Steps:

1. **Open the Intelius Suppression Center** Go to intelius.com/opt-out/ to load the PeopleConnect Suppression Center, and choose Start Here (or the guided mode) to begin.
2. **Locate the records attributed to you** Provide the identifying information the tool asks for so it can find the records listed under your name.
3. **Suppress the matching records** Go to Suppression Settings and confirm suppression of the public-data records that are yours. The pages are JavaScript-rendered, so follow the on-screen prompts for exact fields.

Relisting: Intelius states that suppressing your background report does not affect the same data at its third-party sources, and that your details may still appear in phone, address or email reports searched by those criteria — so information can resurface through other queries.

Sources:

- https://www.intelius.com/opt-out/
- https://peopleconnect.us/privacy-policy

### Instant Checkmate

- Page: https://osintyourself.com/protect/data-removal/instantcheckmate
- Opt-out page: https://www.instantcheckmate.com/opt-out/
- Time estimate: roughly 10–15 minutes
- Requires: Your full name, to locate your record; Likely an email address for confirmation; Possibly identity verification (PeopleConnect sites sometimes ask for this)
- Verified: 2026-08-31

Steps:

1. **Open the Instant Checkmate Suppression Center** Go to instantcheckmate.com/opt-out/ to load the PeopleConnect Suppression Center, and choose Start Here (or the guided mode) to begin.
2. **Locate the records attributed to you** Provide the identifying information the tool asks for so it can find the records listed under your name.
3. **Suppress the matching records** Go to Suppression Settings and confirm suppression of the public-data records that are yours. The pages are JavaScript-rendered, so follow the on-screen prompts for exact fields.

Relisting: Instant Checkmate states that suppressing your background report does not affect the same data at its third-party sources, and that your details may still appear in phone, address or email reports searched by those criteria — so information can resurface through other queries.

Sources:

- https://www.instantcheckmate.com/opt-out/
- https://peopleconnect.us/privacy-policy

### TruthFinder

- Page: https://osintyourself.com/protect/data-removal/truthfinder
- Opt-out page: https://www.truthfinder.com/opt-out/
- Time estimate: a few minutes, plus an email verification step
- Requires: An email address (you must click a verification link it emails you); Enough detail to identify your own listing
- Verified: 2026-09-15

Steps:

1. **Open the TruthFinder suppression center** Go to the TruthFinder opt-out page (linked above). It loads the PeopleConnect Suppression Center, which manages the display of your background report across PeopleConnect’s people-search sites. Choose the free "Start Here" option.
2. **Enter your email and verify it** Enter your email address and submit. TruthFinder emails you a verification link; open it to continue — your email is used to process the suppression request.
3. **Find your listing and confirm suppression** After verifying, follow the prompts to locate the record that matches you and confirm the suppression. Follow the on-screen steps for the exact fields.

Relisting: The tool manages the display of your background report rather than deleting the underlying public records, so your details can resurface over time. Treat this as a recurring check.

Sources:

- https://www.truthfinder.com/opt-out/

## Other pages

These pages are not reproduced here; follow the links.

- [Home](https://osintyourself.com/): What OSINT Yourself is: teach, warn, and the tools directory.
- [Tools directory](https://osintyourself.com/tools): Filterable index of OSINT tools by category, cost and open-source status.
- [Learn](https://osintyourself.com/learn): Teach: how OSINT techniques work, and the ethics and limits of using them.
- [What is OSINT?](https://osintyourself.com/learn/what-is-osint): A plain-language introduction to open-source intelligence.
- [How OSINT techniques work](https://osintyourself.com/learn/how-osint-works): Recon, username and email pivoting, metadata, and breach data explained.
- [Ethics and the line you don’t cross](https://osintyourself.com/learn/ethics-and-law): Consent, dual-use tools, and why laws differ by jurisdiction.
- [Getting started responsibly](https://osintyourself.com/learn/getting-started): First steps for learning OSINT ethically — starting with yourself.
- [Protect yourself](https://osintyourself.com/protect): Warn: how findable you are, and the concrete steps that reduce it.
- [How findable are you?](https://osintyourself.com/protect/how-findable-are-you): A self-audit checklist for your own digital footprint.
- [Breach check](https://osintyourself.com/protect/breach-check): Check password exposure privately (k-anonymity) without sending it anywhere.
- [Data removal](https://osintyourself.com/protect/data-removal): A directory of data brokers and their opt-out links.
- [Browse tools by tag](https://osintyourself.com/tags): Cross-cutting index of the tools directory by capability, interface and subject.
- [OSINT tool alternatives](https://osintyourself.com/alternatives): Side-by-side alternatives to popular OSINT tools — free, open-source and paid options for the same job.
- [OSINT & privacy glossary](https://osintyourself.com/learn/glossary): Plain-language definitions of OSINT tradecraft and privacy/security terms.
- [EXIF & photo metadata viewer](https://osintyourself.com/tools/exif-viewer): Read the hidden metadata in a photo — GPS, device, timestamps — entirely in your browser.
- [Google dork builder](https://osintyourself.com/tools/dork-builder): Construct advanced search-engine queries with site:, filetype:, intitle: and more.
- [Exposure score](https://osintyourself.com/protect/exposure-score): A quick self-assessment of how findable and exposed you are online.
- [Newsletter](https://osintyourself.com/newsletter): An occasional privacy-first email: new tools, new opt-out guides, one practical tip.
- [Changelog](https://osintyourself.com/changelog): What has recently changed: new tools, new guides, and site updates.
- [About](https://osintyourself.com/about): What this site is and who it is for.
- [Methodology](https://osintyourself.com/methodology): How tools are added and checked, what Last verified means, how AI drafts are labelled, and where to send corrections.
- [Privacy](https://osintyourself.com/privacy): How this site handles data, and how it treats dual-use tool listings.

## Licence

Site text and tool write-ups: CC BY 4.0 with attribution to osintyourself.com. Tool names, logos and descriptions of third-party products remain the property of their respective owners.

[AI usage policy](https://osintyourself.com/ai.txt)