Analysis
Examines existing information for patterns or relationships.
- Aliens EyeFreeA local tool for searching usernames, profile characteristics and possible connections between accounts.
- ArcGIS Map ViewerFreemiumWeb application for interactive maps in ArcGIS Online: view, combine, filter and style map layers.
OPSEC caution
Commenting on an ArcGIS Online item notifies its owner by email. Replies to comments trigger an email to the person who wrote the comment.
- ArcGIS Wayback ImageryUnknownArchive of earlier versions of Esri's World Imagery map since 2014. Compares aerial and satellite imagery and displays its metadata.
- asnFreeLocally installable tool for IP, ASN and BGP research, with traceroute, JSON output and its own API server.
- BackTweetsUnknownTraces links and public mentions of a URL and shows its web archive history and AI visibility.
OPSEC caution
The AI readability check retrieves the entered website live and examines its raw HTML and robots.txt, among other things. The target server receives these requests.
- BuiltWithFreemiumIdentifies website technologies and shows their usage history, as well as websites using matching technologies or keywords.
- CACI DarkBlue Intelligence SuitePrice on requestPlatform for open, deep and dark web research, with searchable datasets and AI-assisted analysis.
- CensysFreemiumSearch platform for internet services, IP addresses, domains and publicly observed TLS certificates.
- Charity NavigatorFreemiumDatabase and ratings of US charities, with information on finances, impact and potential alerts.
- Darkside (District 4 Labs)Price on requestDatabase for people and threat research using compromised data, leaks and other personal information.
- destroylistFreeFree phishing blocklists with domain checks, research reports and an API. Also accessible to AI assistants through MCP.
- DomainIQFreemiumDomain and IP research with WHOIS and DNS history, reverse search, monitoring, an API and its own MCP.
- DomainToolsPrice on requestDomain research with historical registration data, passive DNS, infrastructure connections and risk assessments.
- EchosecPrice on requestA Flashpoint platform for location-based social media research and ongoing monitoring of places and topics.
OPSEC caution
Flashpoint may store inputs to its AI features, use them for model training and share them with integrated service providers. The terms of use explicitly state this processing.
- EOS LandViewerFreemiumBrowser service for finding, comparing and analysing satellite imagery, with free and paid plans.
- FindFace MultiUnknownSelf-hosted video analysis software for faces, bodies and vehicles in users' own image and video sources.
- ForensicallyFreeFree browser-based image analysis with metadata, clone detection, noise and compression analysis. Images remain on the device.
- FotoForensicsFreeFree public image analysis with ELA, metadata and JPEG checks. For personal use; uploaded images are not confidential.
- Free Map ToolsFreemiumFree mapping tools for distances, radii and areas. Results can be shared and exported, depending on the tool.
- GeoIntelFreePython tool that uses Gemini to suggest possible photo locations and coordinates.
- Gökbörü Intelligence (Gokboru_Intel)FreeLocal research program for telephone numbers and usernames, with a web interface, command line and optional Gemini analysis.
OPSEC caution
The optional Gemini case analysis sends the research subject, summary and source results to Google’s Gemini API.
- Google EarthFreemiumDigital globe with satellite and aerial imagery, 3D terrain and Street View. This profile covers Google Earth on the web.
- Google MapsFreeMapping service for place searches, routes and street-level imagery through Street View. Available in a browser and as a mobile app.
- IBM X-Force ExchangeFreemiumResearches threat information about IP addresses, URLs, domains, malware and vulnerabilities and groups it into collections.
OPSEC caution
In the X-Force community, the information in your user profile is accessible to other participants.
- ICP CreditPrice on requestCommissioned company and credit report service, particularly for international markets that are difficult to access.
OPSEC caution
When preparing company reports, ICP Credit conducts interviews with the company being investigated.
- ImportYetiFreemiumTrade and supply chain data platform based on US and Mexican customs data, with company search, suppliers and shipments.
- IntelOwlFreeSelf-hosted analysis platform that examines IP addresses, domains, URLs, file hashes and documents using multiple services.
- InVID Verification PluginFreeBrowser extension for checking images and videos using keyframes, metadata and image forensics.
- LinkookFreeLocal Python tool that finds profiles, linked accounts and email addresses for a username.
- Maltego EvidencePrice on requestPreserves social media data in cases and analyses profiles, posts, media and connections.
- MapCheckingUnknownEstimates the maximum number of people in a marked area. The assumed crowd density can be adjusted.
- MxToolboxFreeOnline tools for email headers, DNS data, mail servers and blacklist entries.
- NexusXplore (OSINT Combine)PaidOSINT platform for searching, connecting and monitoring data from the open web, deep web and darknet.
- OCCRP AlephFreeAn OCCRP research database containing public records, company information, documents and restricted research archives.
OPSEC caution
For copyright or privacy complaints about uploaded materials, OCCRP reserves the right to disclose the uploader’s identity to the complainant.
- Open Threat Exchange (OTX)FreeCollects and links threat information about IP addresses, domains, URLs and files from an open security community.
OPSEC caution
Posts and other activities in the OTX community are associated with your username.
- OpenCTI Community EditionFreeSelf-hosted platform for collecting, linking and searching your own cyber threat intelligence.
- OpenSanctionsFreemiumSearches international sanctions and watchlists, as well as information on politically exposed persons.
- OSINT UIFreemiumWeb platform with 20 OSINT tools, linked research results, reports and optional API and MCP access.
OPSEC caution
OSINT UI sends search values to the connected data providers and makes these queries using your own API keys. The keys are stored in encrypted form in the service.
- PulsediveFreemiumThreat data for domains, IP addresses and URLs, with sources, risk indicators, history and an API.
OPSEC caution
Comments, edits and submissions display your username. This association remains even after the account is deleted.
- QGISFreeCombines and analyses geospatial data on your own computer and creates maps for research.
- Recon-ngFreeA modular Python framework for OSINT research, with workspaces, a database, a web interface and its own API.
OPSEC caution
When a module is loaded, Recon-ng sends a random user identifier, the module name and the program version to its usage analytics. The developer documentation also mentions the IP address. The --no-analytics startup parameter disables this transmission.
- Recorded Future Threat Intelligence Feeds (Risk Lists)Price on requestCommercial threat intelligence feeds for importing risk lists into security software.
- robinFreeSearches darknet search engines and uses a language model to summarise the pages found.
- Satellites.proFreeFree world map with street and satellite views, address search, distance measurements and shareable map links.
- SemrushFreemiumA marketing suite for domain, keyword, backlink and competitor analysis, with API and MCP access.
- SkopenowPrice on requestAn OSINT suite for people and company research, link analysis, situational awareness and PDF reports.
OPSEC caution
For employment checks, Skopenow may notify the person concerned if the report contains adverse public record information. The customer’s name and address may be disclosed in this process.
- Taranis AIFreeA self-hosted OSINT platform for collecting news, AI analysis and report creation.
OPSEC caution
When an external LLM endpoint is configured, the optional AI service sends the content to be analysed to that provider. The endpoint is set in your own installation.
- UbikronPaidBrowser-based research workspace with a web archive, case notes, full-text search and AI support.
- urlscan.ioFreemiumAnalyses web pages in a browser sandbox and searches stored scans by technical characteristics.
- VirusTotalFreemiumSecurity reports and infrastructure relationships for files, hashes, URLs, domains and IP addresses.
- WatcherFreeSelf-hosted platform for cyber news, leak indicators and suspicious domains, with AI summaries.
- web-checkFreeAnalyses websites using DNS, WHOIS, TLS and technology checks. Free in a browser or on your own infrastructure.
- Zoom EarthFreemiumInteractive weather and satellite maps for clouds, precipitation, storms, wildfires and weather forecasts.