Domain Name OSINT Tools

Apollo.io

B2B contact and company intelligence

BuiltWith

Website technology profiling platform

Censys

Internet asset and certificate search engine

DeHashed

Breach intelligence and credential search

DomainTools

Enterprise domain and DNS intelligence

FOFA

Internet asset search and mapping engine

Have I Been Pwned

Check exposure in known data breaches

Hunter.io

Find and verify professional emails

Intelligence X

Search leaked data and dark web material

Maltego

Visual OSINT link-analysis platform

Nmap

Network mapping and port scanning tool

OWASP Amass

Attack-surface mapping and DNS enumeration

Recon-ng

Modular web reconnaissance framework

SecurityTrails

DNS history and domain intelligence platform

Shodan

Search exposed internet-connected services

SpiderFoot

Automated OSINT reconnaissance framework

VirusTotal

Analyze files, URLs, domains, and IPs

Wappalyzer

Detect technologies used by websites

Wayback Machine

View archived versions of web pages

Wireshark

Network protocol analyzer

ZoomEye

Cyberspace search engine for exposed assets

theHarvester

Collect emails and subdomains from public sources

urlscan.io

Scan and analyze URLs safely

AADInternals

Recon Azure AD / M365 tenant info from a domain

ALterX

Subdomain permutation generator by ProjectDiscovery

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

AbuseIPDB

a community IP reputation database for checking and reporting abusive interne

Advangle

Visual advanced-search query builder for Google and Bing

AeroLeads

a prospecting platform for finding business emails, phone numbers, and compan

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

Altdns

a subdomain permutation tool that generates altered hostnames for DNS brute f

Analyze ID

Link sites sharing Analytics, AdSense, or tracking IDs

Anomali ThreatStream

Anomali TIP and feed management platform

Anymail Finder

an email discovery and verification platform for finding deliverable professi

Aquatone

HTTP host screenshotting and clustering

ArchiveBox

a self-hosted web archiving system for saving pages, media, PDFs, and browser

Arjun

an HTTP parameter discovery tool for finding hidden inputs accepted by web ap

Assetfinder

a command-line tool for finding domains and subdomains related to a target or

AttackSurfaceMapper

Recon CLI chaining LinkedIn, Shodan, screenshots

BBOT

Recursive multi-source recon scanner

Babel Street

Multilingual OSINT and PAI platform

Bambenek Labs Feeds

Premium DGA and C2 IOC feeds

BeVigil

Mobile-app security search engine surfacing APK secrets, keys and subdomains

BeVigil OSINT CLI

Query BeVigil API for hosts, subdomains and S3 buckets from apps and domains

BinaryEdge

Paid internet-scan and asset discovery API

BitSight

External cyber-risk rating by BitSight

Blacklist Checker

Check IPs and domains against 100+ DNS blacklists

BreachAware

Paid breach-credential monitoring service

BreachDirectory

Search breach exposure by email or user

BreachSense

Paid stealer-log and breach monitoring

Burner Email Providers

Maintained list of burner / temporary email domains

Burp Suite

a commercial web security testing platform for proxying, scanning, and analyz

CIRCL Passive DNS

CIRCL passive DNS service for researchers

CMSeeK

a CMS detection and exploitation-aid tool for identifying website platforms a

CVE Details

a searchable vulnerability database for CVEs, vendors, products, versions, an

Can I Take Over XYZ

a community-maintained reference for identifying services vulnerable to subdo

Censys Search Pro

Censys attack-surface management platform

CentralOps

Web toolkit for WHOIS, DNS, and IP network lookups

CertKit CT Log Search

Search Certificate Transparency logs by domain for subdomains

Certspotter

Certificate Transparency monitoring service