OSINT tools are easiest to choose by the job they do: one set for domains and infrastructure, one for social media, one for images and video, one for breach data, and a few for records, archiving and connecting the dots. This guide lists the tools investigators actually use in each category, what they are good for and where their limits are. It also covers the part most tool lists skip: what each lookup reveals about you, and how teams handle that network layer, which is what our page on proxies for OSINT and investigative journalism is about.
If you are new to the field, start with our introduction to what OSINT is, which covers the sources, the method and the legal lines. This article assumes you know the basics and want the toolkit.
Domains and infrastructure
The questions here are who runs a domain or server, what else is connected to it, and how it has changed.
- ICANN Lookup queries registration data over RDAP, the modern replacement for WHOIS. Since the GDPR, most personal details are redacted, but registrar, creation date and name servers are still useful.
- crt.sh searches certificate transparency logs. Every publicly trusted TLS certificate is logged, so a search for a domain often reveals subdomains and related hostnames the owner never linked anywhere.
- SecurityTrails shows historical DNS records, which helps you find where a site was hosted before it moved behind a CDN.
- Shodan and Censys index internet-connected devices and services. They answer questions like which other hosts share this certificate or run this exact server banner.
- urlscan.io loads a URL in a sandbox and records what it requested, which domains it contacted and what it looked like.
- VirusTotal aggregates verdicts from many antivirus engines and URL scanners, and shows relations between domains, IP addresses and files.
Two of these have visibility settings you should know. urlscan.io scans can be public, unlisted or private, and public scans can be seen by others, including the people behind the site you are investigating. Files and URLs submitted to VirusTotal can be seen by its paying users. Never upload a confidential document there, and assume a submission can tip off a careful adversary.
Social media and usernames
The questions here are where a person or account appears, what they posted and when.
- Sherlock is an open source command-line tool that checks one username across hundreds of sites.
- WhatsMyName does the same from a maintained list of sites, with a web interface for people who prefer not to use the command line.
- The platforms’ own search, with advanced operators and date filters, is still the most reliable source, because third-party tools break whenever a platform changes its pages or its API.
That last point matters more each year. Platforms change researcher access often: Meta shut down CrowdTangle in August 2024 and moved approved researchers to the Meta Content Library. Build your method around what the platform allows today, and expect tools in this category to stop working without notice.
Images and video
The questions here are where a picture first appeared, where and when it was taken, and whether it was edited.
- Reverse image search with Google Lens, TinEye, Bing Visual Search and Yandex Images. They index different parts of the web, so run all of them. TinEye can sort results by oldest first, which helps find the original.
- The InVID-WeVerify plugin is a browser extension built for fact-checkers. It splits videos into keyframes for reverse search and bundles several image forensic filters.
- ExifTool reads metadata from image and video files: camera model, timestamps and sometimes GPS coordinates. Most social platforms strip this on upload, so it is most useful on originals.
- SunCalc shows the sun’s position for any place and time, which lets you check a claimed time against shadows in a photo.
- Google Earth Pro has historical imagery, and Copernicus Browser gives free access to recent Sentinel satellite imagery, to confirm a location and see how it changed.
Breach and leak data
The question here is whether an account, email address or organisation appears in a known breach. This is the category with the sharpest legal edges.
- Have I Been Pwned tells you whether an email address appears in known breaches. Its domain search covers every address on a domain, but only after you prove you control that domain, which makes it a good fit for checking your own organisation’s exposure.
- Commercial breach search services let investigators search breach records directly. They are used in fraud and threat intelligence work, but they put large amounts of personal data in front of you.
The rules here are stricter than for the other categories. Breach records are personal data, and under the GDPR and similar laws, searching and storing them is processing that needs a lawful basis and a clear purpose. Using a leaked password to sign in to an account is unauthorised access, whatever the investigative goal. Teams that monitor leaks for their own organisation usually do it within a written policy, which our article on monitoring dark web and paste sites for leaked credentials describes. This is general information, not legal advice.
Records, archiving and link analysis
Three supporting categories make the others usable.
Companies and public records. OpenCorporates aggregates company registries from many countries, and national registries such as UK Companies House or the SEC’s EDGAR database are the primary sources to cite.
Archiving and capture. The Wayback Machine and archive.today show past versions of pages and let you save new ones. Hunchly records every page you visit during an investigation, with timestamps, which is what turns a finding into evidence.
Automation and link analysis. theHarvester collects emails, subdomains and hosts for a domain from public sources. SpiderFoot runs dozens of lookups on a target automatically. Maltego draws the results as a graph, so you can see which domains, people and organisations connect. The OSINT Framework website is a large directory if you need something more specific.
| Category | Start with | Free options |
|---|---|---|
| Domains and infrastructure | crt.sh, ICANN Lookup, urlscan.io | crt.sh, ICANN Lookup, free tiers of the others |
| Social media and usernames | Platform search, Sherlock, WhatsMyName | Sherlock, WhatsMyName |
| Images and video | Reverse image search, InVID-WeVerify, ExifTool | All of them |
| Breach data | Have I Been Pwned | Have I Been Pwned for single addresses |
| Records and archiving | OpenCorporates, Wayback Machine, Hunchly | OpenCorporates search, Wayback Machine |
| Link analysis | SpiderFoot, Maltego | SpiderFoot (open source) |
The layer no tool covers: what the target sees
Every tool above either queries a service on your behalf or sends you to the target directly. The second case is where investigations leak.
When you open a suspect domain, a phishing kit or a counterfeit shop from your office network, the site records your organisation’s IP address. Careful operators watch their logs and react: they block your range, show you a harmless page, or take the site down before you have captured it. Many sites also show different content depending on the visitor’s country, so a page checked from your office may not be what local victims see.
Investigation teams handle this with a few habits:
- Keep collection traffic off your own network. A residential proxy makes the request leave from a home connection in the country or city that matters, so the target sees an ordinary local visitor rather than your company.
- Isolate the browser. Use a separate browser profile, or a virtual machine for anything likely to be malicious, so cookies and sessions from your normal work never reach the target. Security teams that do this at scale are described on our cybersecurity use case page.
- Treat research accounts carefully. Some investigators use separate research accounts, often called sock puppets, to view content that needs a login. Many platforms forbid fake accounts in their terms, so check the terms and your organisation’s policy, record why the account exists, and never use it to deceive or contact the people you investigate.
- Know the limits. A proxy changes the IP address a site sees. It does not hide your browser fingerprint, your logged-in accounts or your behaviour. Our explainer a proxy is not an anonymity tool covers what else gives investigators away.
The bottom line
Choose OSINT tools by the question you are answering: certificate and DNS lookups for infrastructure, username search and platform search for social media, reverse search and metadata for images, notification services for breach exposure, and archiving and link analysis to hold it all together. Check what each tool shares about your searches, keep collection off your own network, and treat breach data and research accounts as the legal and ethical risks they are.
If your team needs to view sites as a local visitor in another country, you can test it with a free trial: 100 MB of Residential Proxies over 3 days, or 1 day of ISP Proxies with up to 10 IPs.