Search

Domain Name OSINT Tools

A domain name unlocks a wealth of infrastructure intelligence: registration (WHOIS), DNS records, subdomains, hosting, certificates, historical snapshots, and related domains. Analysts use these tools to map an organization's external footprint or trace malicious infrastructure. Below are the 321 OSINT tools that take a domain as input.

321tools
Browse with filters
Apollo.io icon

Apollo.io

B2B contact and company intelligence

FreemiumWebAPI
IN
OUT+1
BuiltWith icon

BuiltWith

Website technology profiling platform

FreemiumWebAPI
IN
OUT
Censys icon

Censys

Internet asset and certificate search engine

FreemiumWebAPI
IN
OUT+1
DeHashed icon

DeHashed

Breach intelligence and credential search

PaidWebAPI
IN+2
OUT
DomainTools icon

DomainTools

Enterprise domain and DNS intelligence

PaidWebAPI
IN
OUT
FOFA icon

FOFA

Internet asset search and mapping engine

FreemiumWebAPI
IN
OUT+1
Have I Been Pwned icon

Have I Been Pwned

Check exposure in known data breaches

FreemiumWebAPI
IN
OUT
Hunter.io icon

Hunter.io

Find and verify professional emails

FreemiumWebAPI
IN
OUT
Maltego icon

Maltego

Visual OSINT link-analysis platform

FreemiumDesktop AppWeb
IN+15
OUT+1
Nmap icon

Nmap

Network mapping and port scanning tool

FreeOSSCLI
IN
OUT
OWASP Amass icon

OWASP Amass

Attack-surface mapping and DNS enumeration

FreeOSSCLI
IN
OUT+1
Recon-ng icon

Recon-ng

Modular web reconnaissance framework

FreeOSSCLI
IN+5
OUT+1
SpiderFoot icon

SpiderFoot

Automated OSINT reconnaissance framework

FreeOSSWebCLI
IN+13
OUT+3
VirusTotal icon

VirusTotal

Analyze files, URLs, domains, and IPs

FreemiumWebAPI
IN+2
OUT+1
Wappalyzer icon

Wappalyzer

Detect technologies used by websites

FreemiumWebAPI
IN
OUT
Wayback Machine icon

Wayback Machine

View archived versions of web pages

FreeWebAPI
IN
OUT
Wireshark icon

Wireshark

Network protocol analyzer

FreeOSSDesktop AppCLI
IN
OUT
ZoomEye icon

ZoomEye

Cyberspace search engine for exposed assets

FreemiumWebAPI
IN
OUT+1
theHarvester icon

theHarvester

Collect emails and subdomains from public sources

FreeOSSCLI
IN
OUT+1
urlscan.io icon

urlscan.io

Scan and analyze URLs safely

FreemiumWebAPI
IN
OUT+2
AADInternals icon

AADInternals

Recon Azure AD / M365 tenant info from a domain

FreeOSSCLI
IN
OUT
ALterX icon

ALterX

Subdomain permutation generator by ProjectDiscovery

FreeOSSCLI
IN
OUT
ANY.RUN Threat Intelligence Lookup icon

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

FreemiumWebAPI
IN
OUT
AeroLeads icon

AeroLeads

a prospecting platform for finding business emails, phone numbers, and compan

FreemiumWebBrowser Extension
IN
OUT
AlienVault OTX icon

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

FreeWeb
IN+2
OUT
Altdns icon

Altdns

a subdomain permutation tool that generates altered hostnames for DNS brute f

FreeOSSCLI
IN
OUT
Anomali ThreatStream icon

Anomali ThreatStream

Anomali TIP and feed management platform

PaidWebAPI
IN
OUT
Anymail Finder icon

Anymail Finder

an email discovery and verification platform for finding deliverable professi

FreemiumWebAPI
IN
OUT
Aquatone icon

Aquatone

HTTP host screenshotting and clustering

FreeOSSCLI
IN
OUT
ArchiveBox icon

ArchiveBox

a self-hosted web archiving system for saving pages, media, PDFs, and browser

FreeOSSWebCLI
IN
OUT
Arjun icon

Arjun

an HTTP parameter discovery tool for finding hidden inputs accepted by web ap

FreeOSSCLI
IN
OUT
Assetfinder icon

Assetfinder

a command-line tool for finding domains and subdomains related to a target or

FreeOSSCLI
IN
OUT
AttackSurfaceMapper icon

AttackSurfaceMapper

Recon CLI chaining LinkedIn, Shodan, screenshots

FreeOSSCLI
IN
OUT
BBOT icon

BBOT

Recursive multi-source recon scanner

FreeOSSCLI
IN
OUT
Babel Street icon

Babel Street

Multilingual OSINT and PAI platform

PaidWebAPI
IN
OUT
BeVigil icon

BeVigil

Mobile-app security search engine surfacing APK secrets, keys and subdomains

FreemiumWebAPI
IN
OUT+1
BeVigil OSINT CLI icon

BeVigil OSINT CLI

Query BeVigil API for hosts, subdomains and S3 buckets from apps and domains

FreemiumOSSCLIAPI
IN
OUT
BinaryEdge icon

BinaryEdge

Paid internet-scan and asset discovery API

FreemiumWebAPI
IN
OUT
BitSight icon

BitSight

External cyber-risk rating by BitSight

PaidWebAPI
IN
OUT
Blacklist Checker icon

Blacklist Checker

Check IPs and domains against 100+ DNS blacklists

FreemiumWebAPI
IN
OUT
BreachAware icon

BreachAware

Paid breach-credential monitoring service

FreemiumWebAPI
IN
OUT
BreachSense icon

BreachSense

Paid stealer-log and breach monitoring

PaidWebAPI
IN
OUT
Burner Email Providers icon

Burner Email Providers

Maintained list of burner / temporary email domains

FreeOSSAPI
IN
OUT
CIRCL Passive DNS icon

CIRCL Passive DNS

CIRCL passive DNS service for researchers

FreeOSSAPICLI
IN
OUT
CMSeeK icon

CMSeeK

a CMS detection and exploitation-aid tool for identifying website platforms a

FreeOSSCLI
IN
OUT
Can I Take Over XYZ icon

Can I Take Over XYZ

a community-maintained reference for identifying services vulnerable to subdo

FreeOSSCLI
IN+1
OUT
Censys Search Pro icon

Censys Search Pro

Censys attack-surface management platform

PaidWebAPI
IN
OUT
CentralOps icon

CentralOps

Web toolkit for WHOIS, DNS, and IP network lookups

FreemiumWeb
IN
OUT
CertKit CT Log Search icon

CertKit CT Log Search

Search Certificate Transparency logs by domain for subdomains

FreemiumWeb
IN
OUT
Certspotter icon

Certspotter

Certificate Transparency monitoring service

FreemiumOSSCLIWeb
IN
OUT
Chaos icon

Chaos

Curated bug-bounty subdomain dataset

FreemiumOSSWebAPI
IN
OUT
Cisco Talos Intelligence icon

Cisco Talos Intelligence

a threat reputation portal for IPs, domains, malware, vulnerabilities, and sp

FreeWeb
IN+2
OUT
Cisco Umbrella Investigate icon

Cisco Umbrella Investigate

Cisco DNS-resolver threat intel

PaidWebAPI
IN
OUT
Cloud Custodian icon

Cloud Custodian

Query cloud accounts for policy-violating resources

FreeOSSCLI
IN
OUT
CloudFail icon

CloudFail

Find the origin IP of a Cloudflare-protected domain

FreeOSSCLI
IN
OUT
Cloudflare Radar icon

Cloudflare Radar

Internet trends and DDoS data from Cloudflare

FreeWebAPI
IN
OUT
Common Crawl icon

Common Crawl

a public web crawl archive used to research historical web content and large-

FreeWebAPI
IN
OUT
Companies House icon

Companies House

the UK company register for searching companies, officers, filings, and corpo

FreeWebAPI
IN
OUT+1
CompleteDNS icon

CompleteDNS

Historical nameserver records and reverse-NS lookup

FreemiumWebAPI
IN
OUT
Conifer icon

Conifer

a web archiving service for capturing interactive pages and preserving browsi

FreemiumWeb
IN
OUT
Showing 60 of 321 — browse all

Find specific data from domain name

Report / Summary103IOC (Indicator of Compromise)96DNS Records64URL60Subdomain57Technology Stack43Website38CVE / Vulnerability34Email Address31WHOIS Data30Employee List29SSL Certificate29

Investigate by other data types

Email AddressPhone NumberUsernameReal NameIP AddressCryptocurrency WalletImage / PhotoURLHash (MD5/SHA)Company NameMalware Sample