OSINT Sources

OSINT Sources#

Reference catalog of open-source intelligence (OSINT) tools and feeds, organized by collection category. Pairs with the operator side at Reconnaissance, this is the what to use; that is the what / why / how.

The OSINT toolkit is huge and changes fast. The categories below are stable; the specific tools are recent-as-of-2026 picks. For an exhaustive list, follow the references at the end (Bellingcat toolkit, OSINT Framework, awesome-osint).

Search and discovery#

Tool

What it covers

Google dorks

Site / filetype / inurl operators; the bedrock.

Google Scholar

Academic literature.

DuckDuckGo, Brave Search

Search alternatives; less personalised.

Yandex

Russian-language and reverse-image strong.

Baidu

Chinese-language sources.

Naver

Korean-language sources.

Searx, Whoogle

Self-hosted meta-search.

OSINT Framework

Categorized link directory.

Bellingcat Toolkit

Curated OSINT toolkit (Airtable).

SpiderFoot

OSINT automation framework (free + HX).

Maltego

Link-analysis transforms; free CE + paid.

Recon-ng

Modular CLI reconnaissance.

theHarvester

Email / subdomain harvesting.

Photon, Nuclei

Web crawling / templated checks.

People (PERSINT)#

Tool

Notes

PimEyes, FaceCheck.id

Facial reverse search (commercial, contested).

Sherlock

Username enumeration across sites.

WhatsMyName

Username enumeration (web app).

Maigret

Username + dossier compilation.

Holehe

Email -> registered services.

EpiOS

Email enrichment pivots.

Hunter.io

Email finder (commercial).

Lampyre, Skopenow

Commercial dossier platforms.

Pipl

Commercial people search.

Spokeo, BeenVerified, TruePeopleSea rch

US data brokers.

411.com / Whitepages / Truecaller

Phone reverse lookup.

NumLookupAPI

Carrier / line-type enrichment.

SOCMINT.info

Social-media intel index.

Domains and infrastructure#

Tool

Notes

WHOIS / RDAP

Registration metadata; whois.domaintools.com, rdap.iana.org.

DomainTools Iris

Pivot graph (commercial).

SecurityTrails

Historical DNS, certificates.

PassiveTotal / Microsoft DTI

Passive DNS, infrastructure.

URLscan.io

URL submission + sandbox view.

crt.sh

Certificate Transparency log search.

Censys

Internet-asset search.

Shodan

Internet-asset search; banner-rich.

ZoomEye

Chinese counterpart.

FOFA

Chinese internet-asset search.

BinaryEdge, Onyphe

Asset / scan data.

DNSTwister, dnstwist

Lookalike-domain discovery.

HackerTarget, ViewDNS

Free DNS / WHOIS web tools.

PassiveDNS feeds

Farsight DNSDB (commercial), Mnemonic, RiskIQ.

Public web and social#

Tool

Notes

trafilatura, newspaper3k

Article main-text extraction.

snscrape

Social-media scraping (X, Telegram, Reddit).

Twint (legacy)

Pre-API Twitter scraping; broken since 2023.

Telegram CLIs (telethon, gramJS)

Public-channel scraping.

RSS / Atom (feedparser)

Aggregation.

Wayback Machine, archive.today

Historical snapshots.

Common Crawl

Petabytes of crawled web.

Wikidata + Wikipedia API

Structured + unstructured.

Google Trends, GDELT

Search / news event signals.

Pushshift (limited 2024)

Reddit historical archive.

Geospatial (GEOINT)#

Tool

Notes

Google Earth Pro / Google Maps

Imagery + Street View.

Bing Maps, Yandex Maps

Alternative imagery; sometimes higher-res.

Mapillary

Crowdsourced street-level photos.

KartaView (formerly OpenStreetCam)

OSM-aligned street imagery.

Sentinel Hub Playground

Free Sentinel-2 imagery.

Sentinel Hub EO Browser

Search Sentinel-1/2/3 + Landsat archive.

USGS EarthExplorer

Landsat archive.

NASA Worldview

MODIS daily imagery.

Planet Labs

Daily commercial imagery (paid).

Maxar SecureWatch

High-res commercial.

SkyFi, Up42

Imagery-on-demand markets.

SunCalc, ShadowCalc

Solar / shadow geolocation.

PeakVisor

Mountain peak identification.

Suncalc.org

Sun-position helper.

GeoGuessr

Training tool for visual geolocation.

OpenStreetMap, Overpass

Vector / POI search.

nominatim

OSM geocoder.

Imagery analysis#

Tool

Notes

ExifTool

EXIF / IPTC / XMP metadata.

ImgOps

Web-based reverse search portal.

TinEye, Yandex, Google Lens, Bing

Reverse image search.

FotoForensics

ELA + tamper analysis.

Forensically

Tamper analysis suite.

InVID-WeVerify

Browser plugin for video analysis.

DroneSec, Aeroscope

UAV / drone detection.

Stable Diffusion / Midjourney detec

tors AI-image classifiers.

Documents / leaks#

Tool

Notes

Aleph (OCCRP)

Cross-jurisdictional documents.

DocumentCloud

Public document hosting.

ICIJ Offshore Leaks Database

Panama / Pandora / Paradise Papers.

DDoSecrets

Hacked / leaked datasets (sensitive license).

WikiLeaks (historical)

Older leaks archive.

EDGAR (SEC)

US public company filings.

OpenCorporates

Cross-jurisdictional corporate registry.

Sayari

Commercial corporate / sanctions graph.

companies-house.gov.uk

UK corporate registry (free).

RegInfo / Federal Register

US regulatory filings.

Maritime / aviation / signals#

Tool

Notes

MarineTraffic, VesselFinder

AIS-based ship tracking.

ShipFinder.co

Alt AIS tracker.

ADS-B Exchange, FlightAware

Flight tracking (some military filtered).

ADS-B Hub, OpenSky Network

Open ADS-B archive.

Globe.adsbexchange.com

Real-time map.

LiveATC.net

Air-traffic control audio.

RadioReference

Public-safety radio frequencies.

SDR.hu, KiwiSDR

Crowdsourced SDR receivers.

Sat-NOGS

Crowdsourced satellite ground network.

N2YO, Heavens-Above

Satellite tracking.

Celestrak

TLE catalog.

Code / dev#

Tool

Notes

GitHub / GitLab / Codeberg

Code search, history, secrets.

GitGuardian, gitleaks, trufflehog

Leaked-secrets scanning.

sourcegraph C

ross-repo code search.

Public Docker Hub, ghcr

Container search.

NPM / PyPI / RubyGems / crates

Package metadata.

Snyk Vulnerability DB

Open vuln intel.

LibrariesIO

Cross-ecosystem package lookup.

Finance / crypto#

Tool

Notes

Etherscan, Blockchair, Blockchain.c

om Ethereum / multi-chain explorers.

Mempool.space, btc.com

Bitcoin explorer.

Chainalysis, TRM, Elliptic

Commercial blockchain analytics.

Breadcrumbs.app, Arkham

Open-front-end blockchain analytics.

GraphSense

OSS blockchain analytics.

Whale Alert (X)

Large-transaction notifications.

Crypto sanction lists (OFAC)

Treasury list of sanctioned addresses.

Ofac.treas.gov

SDN / SDGT consolidated lists.

Academic / paper / patent#

Tool

Notes

Google Scholar, Semantic Scholar

Paper search.

arXiv, SSRN, bioRxiv P

reprints.

Connected Papers, ResearchRabbit P

aper graph.

ORCID A

uthor identifiers.

Espacenet, Google Patents P

atent search.

USPTO, EPO, JPO, KIPO N

ational patent offices.

Ethics and authorization#

OSINT collection law and ethics differ by jurisdiction. The enabling discipline at Web Scraping and the authorization guidance at OPSEC should be read before running tools at scale. Personal data (PII) is governed by GDPR in the EU, CCPA in California, similar regimes elsewhere, “publicly available” does not mean “free to collect, store, and share.”

References#

Contents