Passive Recon
Techniques that gather information from existing public sources without directly contacting the target.
Ahmia
Search engine for Tor hidden services (.onion), excluding abuse material.
Aleph
OCCRP's platform for searching and cross-referencing leaked and public documents and data.
AlienVault OTX
Open Threat Exchange sharing community indicators of compromise.
Bellingcat Online Investigation Toolkit
Curated, maintained directory of open-source investigation tools.
Blackbird
Fast username and email search across 600+ platforms.
BreachDirectory
Free lookup to see if an email or username appears in public breaches.
Censys
Search engine for internet-facing hosts, certs, and services.
DNSDumpster
Free domain research tool that maps a domain's subdomains and hosts.
Datashare
ICIJ's tool for indexing, searching and extracting entities from large document sets.
DeHashed
Search engine over billions of breached credentials and personal records.
Epieos
Reverse email lookup and digital-footprint tracing.
ExifTool
Extracts hidden metadata from images, documents, and media.
FOCA
Extracts hidden metadata and info from Office, PDF and image files.
FaceCheck.ID
Facial-recognition search engine that finds where a face appears across the web.
FastPeopleSearch
Free US people lookup by name, phone or address.
FotoForensics
Online error-level analysis and metadata inspection to detect edited images.
GHunt
Investigates Google accounts, extracting data tied to a Gmail address.
Google Hacking Database
Exploit-DB's curated archive of Google search queries ("dorks") that surface exposed data.
Google Lens
Google's visual search to identify objects, places and text in images.
GreyNoise
Labels internet background scan and attack traffic to separate noise from real threats.
Holehe
Checks whether an email is registered on 120+ sites via password-reset flows.
Hunter.io
Finds and verifies professional email addresses associated with a domain.
Instaloader
Downloads Instagram photos, videos, captions and metadata from public profiles.
IntelTechniques
Michael Bazzell's OSINT search tools, books and training resources.
Intelligence X
Search engine over leaks, pastes, darknet and historical web data.
Jimpl
Online EXIF viewer showing a photo's hidden camera, GPS and timestamp data.
Lampyre
Data-analysis and OSINT tool pulling 100+ sources into graphs, maps and tables.
LeakCheck
Data-breach search engine for exposed emails, usernames and passwords.
LittleSis
Free database mapping relationships between powerful people and organizations.
MISP
Open-source platform for sharing and correlating threat intelligence.
Maigret
Builds a dossier from a username, checking thousands of sites for matching accounts.
Max Intel
Browser platform with a large set of free utilities for email, phone, and username pivots.
Metagoofil
Harvests public documents from a domain and extracts their metadata.
Namechk
Checks whether a username or domain is available or already taken across many sites.
Netlas
Internet-wide scanning and attack-surface search platform.
OSINT Framework
Web directory categorizing hundreds of OSINT tools and data sources.
OSINT Industries
Paid platform for reverse email/phone/username lookups across hundreds of services.
OpenCorporates
Largest open database of companies and their officers from official registries.
OpenSanctions
Open database of sanctioned entities, politically exposed persons and other watchlists.
PhoneInfoga
Scans and footprints international phone numbers using OSINT sources.
Picarta
AI tool that predicts where a photo was taken from its visual content.
PimEyes
Facial-recognition search engine that finds where a face appears online.
PublicWWW
Search engine that finds websites by matching source-code snippets, IDs or scripts.
Recon-ng
Modular web-recon framework with a Metasploit-like workflow.
SecurityTrails
Historical DNS, WHOIS and subdomain data for domains and IP addresses.
Sherlock
Hunts a username across hundreds of sites.
Shodan
Search engine for internet-connected devices, servers, and IoT.
Snusbase
Paid breach-search database indexing leaked credentials and personal data.
Social Analyzer
API, CLI and web app that finds a person's profiles across 1000+ social sites.
Social Searcher
Free real-time search engine for public social-media posts and mentions.
SpiderFoot
Automates threat-intel and reconnaissance gathering.
Spokeo
People-search service aggregating public records and social profiles.
Subfinder
Fast passive subdomain discovery tool that enumerates valid subdomains for a domain.
TGStat
Analytics platform for searching and tracking Telegram channels and groups.
Telegago
Google Custom Search engine scoped to indexed Telegram channel content.
ThatsThem
Free people search aggregating names, addresses, emails and phone numbers.
TinEye
Reverse image search that finds where an image appears and its earliest known use.
TruePeopleSearch
Free US people search returning addresses, phone numbers and relatives.
ViewDNS.info
Collection of free DNS, WHOIS, reverse-IP and network lookup tools.
VirusTotal
Scans files and URLs against many engines and aggregates threat intel.
Wappalyzer
Identifies the technology stack (CMS, frameworks, analytics) a website runs.
Wayback Machine
Internet Archive's index of historical snapshots of web pages.
Waymore
Pulls a domain's archived URLs from the Wayback Machine and other sources for recon.
WhatsMyName
Enumerates a username's presence across sites.
Whoxy
WHOIS lookup and reverse-WHOIS history, including registrant-name search.
Yandex Images
Reverse image search noted for strong face and location matching.
ZoomEye
Cyberspace search engine mapping internet-exposed devices, services and components.
archive.today
Web archiving service that saves and serves permanent snapshots of pages on demand.
crt.sh
Searches Certificate Transparency logs to enumerate a domain's certificates and subdomains.
dnstwist
Generates and checks domain permutations to detect typosquatting and phishing lookalikes.
grep.app
Search engine for source code across public GitHub repositories.
h8mail
Email OSINT and breach-hunting tool that pulls exposures for an address.
sn0int
Semi-automatic OSINT framework and package manager for entity recon.
snscrape
Scrapes posts and profiles from Twitter/X, Reddit, Telegram and other networks.
theHarvester
Collects emails, subdomains, and names from public sources.
urlscan.io
Sandboxes and analyzes websites, capturing requests, screenshots and tech.