Search

Best OSINT Tools for Cyber Threat Intelligence

Cyber Threat Intelligence (CTI) turns open data into actionable defense: enriching indicators of compromise (IOCs), attributing campaigns to threat actors, analyzing malware samples, and monitoring leak sites. These OSINT tools cover IOC and hash lookup, sandboxes, passive DNS, and threat-feed aggregation. Below are the 345 CTI tools in the catalogue, each tagged with the indicators it ingests and the intelligence it returns.

345tools
Browse with filters
Censys icon

Censys

Internet asset and certificate search engine

FreemiumWebAPI
IN
OUT+1
DeHashed icon

DeHashed

Breach intelligence and credential search

PaidWebAPI
IN+2
OUT
DomainTools icon

DomainTools

Enterprise domain and DNS intelligence

PaidWebAPI
IN
OUT
FOFA icon

FOFA

Internet asset search and mapping engine

FreemiumWebAPI
IN
OUT+1
GreyNoise icon

GreyNoise

Internet scanner reputation intelligence

FreemiumWebAPI
IN
OUT
Have I Been Pwned icon

Have I Been Pwned

Check exposure in known data breaches

FreemiumWebAPI
IN
OUT
Intelligence X icon

Intelligence X

Search leaked data and dark web material

FreemiumWebAPI
IN+2
OUT
MITRE ATT&CK icon

MITRE ATT&CK

Adversary tactics and techniques knowledge base

FreeOSSWebAPI
IN
OUT
Maltego icon

Maltego

Visual OSINT link-analysis platform

FreemiumDesktop AppWeb
IN+15
OUT+1
Masscan icon

Masscan

Very fast internet-scale port scanner

FreeOSSCLI
IN
OUT
Nmap icon

Nmap

Network mapping and port scanning tool

FreeOSSCLI
IN
OUT
OWASP Amass icon

OWASP Amass

Attack-surface mapping and DNS enumeration

FreeOSSCLI
IN
OUT+1
Shodan icon

Shodan

Search exposed internet-connected services

FreemiumWebAPI
IN
OUT+2
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
VirusTotal icon

VirusTotal

Analyze files, URLs, domains, and IPs

FreemiumWebAPI
IN+2
OUT+1
Wireshark icon

Wireshark

Network protocol analyzer

FreeOSSDesktop AppCLI
IN
OUT
ZoomEye icon

ZoomEye

Cyberspace search engine for exposed assets

FreemiumWebAPI
IN
OUT+1
urlscan.io icon

urlscan.io

Scan and analyze URLs safely

FreemiumWebAPI
IN
OUT+2
ANY.RUN icon

ANY.RUN

an interactive malware sandbox for analyzing suspicious files, URLs, and netw

FreemiumWeb
IN
OUT
ANY.RUN Threat Intelligence Lookup icon

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

FreemiumWebAPI
IN
OUT
APKLab icon

APKLab

VSCode extension for Android RE workflow

FreeOSSDesktop App
IN
OUT
APKLeaks icon

APKLeaks

Scan an Android APK for hardcoded URLs, endpoints and secrets

FreeOSSCLI
IN
OUT
ATT&CK Navigator icon

ATT&CK Navigator

MITRE ATT&CK matrix annotation tool

FreeOSSWeb
IN
OUT
AbuseIPDB icon

AbuseIPDB

a community IP reputation database for checking and reporting abusive interne

FreemiumWeb
IN+2
OUT
Ahmia icon

Ahmia

Search engine for Tor onion services

FreeOSSWeb
IN
OUT
Alethea icon

Alethea

Investigate online influence operations against a target

PaidWeb
IN
OUT
AlienVault OTX icon

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

FreeWeb
IN+2
OUT
Analyze ID icon

Analyze ID

Link sites sharing Analytics, AdSense, or tracking IDs

FreeWeb
IN
OUT
Androbugs Framework icon

Androbugs Framework

Android vulnerability scanner

FreeOSSCLI
IN
OUT
Anomali ThreatStream icon

Anomali ThreatStream

Anomali TIP and feed management platform

PaidWebAPI
IN
OUT
Apktool icon

Apktool

Android APK reverse-engineering toolkit

FreeOSSCLI
IN
OUT
Atomic Red Team icon

Atomic Red Team

MITRE ATT&CK-aligned detection test library

FreeOSSCLI
IN
OUT
Autopsy icon

Autopsy

a digital forensics platform for investigating disk images, filesystems, and

FreeOSSCLI
IN
OUT
BANG (Binary Analysis Next Generation) icon

BANG (Binary Analysis Next Generation)

Recursive firmware unpacker

FreeOSSCLI
IN
OUT
Bambenek Labs Feeds icon

Bambenek Labs Feeds

Premium DGA and C2 IOC feeds

PaidWebAPI
IN
OUT
BeVigil icon

BeVigil

Mobile-app security search engine surfacing APK secrets, keys and subdomains

FreemiumWebAPI
IN
OUT+1
BeVigil OSINT CLI icon

BeVigil OSINT CLI

Query BeVigil API for hosts, subdomains and S3 buckets from apps and domains

FreemiumOSSCLIAPI
IN
OUT
BinaryEdge icon

BinaryEdge

Paid internet-scan and asset discovery API

FreemiumWebAPI
IN
OUT
Binwalk icon

Binwalk

Firmware blob carving and analysis tool

FreeOSSCLI
IN
OUT
BitSight icon

BitSight

External cyber-risk rating by BitSight

PaidWebAPI
IN
OUT
Bitcoin Who's Who icon

Bitcoin Who's Who

Investigate a Bitcoin address for scams and links

FreemiumWebAPI
IN
OUT
Blacklist Checker icon

Blacklist Checker

Check IPs and domains against 100+ DNS blacklists

FreemiumWebAPI
IN
OUT
Blocklist.de icon

Blocklist.de

Check whether an IP is a reported attack source

FreeWebAPI
IN
OUT
BreachAware icon

BreachAware

Paid breach-credential monitoring service

FreemiumWebAPI
IN
OUT
BreachDirectory icon

BreachDirectory

Search breach exposure by email or user

FreemiumWebAPI
IN
OUT
BreachSense icon

BreachSense

Paid stealer-log and breach monitoring

PaidWebAPI
IN
OUT
Brim icon

Brim

Open desktop tool for PCAP and Zeek search

FreeOSSDesktop App
IN
OUT
Burp Suite icon

Burp Suite

a commercial web security testing platform for proxying, scanning, and analyz

FreemiumWeb
IN+1
OUT
Buzz.im Telegram Search icon

Buzz.im Telegram Search

Search public Telegram channels and messages by keyword

FreeWeb
IN
OUT
C2PA Verify icon

C2PA Verify

Verify C2PA Content Credentials and provenance in media

FreeWeb
IN
OUT
CAPEv2 icon

CAPEv2

CAPE malware sandbox (Cuckoo fork)

FreeOSSCLIWeb
IN
OUT
CIRCL Passive DNS icon

CIRCL Passive DNS

CIRCL passive DNS service for researchers

FreeOSSAPICLI
IN
OUT
CVE Details icon

CVE Details

a searchable vulnerability database for CVEs, vendors, products, versions, an

FreeWeb
IN+1
OUT
Can I Take Over XYZ icon

Can I Take Over XYZ

a community-maintained reference for identifying services vulnerable to subdo

FreeOSSCLI
IN+1
OUT
Canary Tokens icon

Canary Tokens

Honeytoken generator for tripwire alerts

FreeOSSWebAPI
IN
OUT
CapLoader icon

CapLoader

Batch PCAP triage workstation

PaidDesktop App
IN
OUT
Censys Search Pro icon

Censys Search Pro

Censys attack-surface management platform

PaidWebAPI
IN
OUT
Chainabuse icon

Chainabuse

Public crypto abuse reporting platform

FreeWeb
IN
OUT
Chainalysis icon

Chainalysis

Commercial blockchain intelligence platform

PaidWebAPI
IN
OUT
CheckLeaked icon

CheckLeaked

Aggregated breach search across Dehashed, Snusbase and LeakCheck

FreemiumWebAPI
IN+2
OUT+1
Showing 60 of 345 — browse all

Other investigation types

Person Investigation
500 tools
Company / Organization Investigation
280 tools
Attack Surface Mapping
315 tools
Social Media Intelligence (SOCMINT)
322 tools
Geospatial Intelligence (GEOINT)
200 tools
Financial Investigation
120 tools
Fraud Investigation
251 tools