IP Address OSINT Tools

Censys

Internet asset and certificate search engine

DeHashed

Breach intelligence and credential search

DomainTools

Enterprise domain and DNS intelligence

FOFA

Internet asset search and mapping engine

GreyNoise

Internet scanner reputation intelligence

Intelligence X

Search leaked data and dark web material

Maltego

Visual OSINT link-analysis platform

Masscan

Very fast internet-scale port scanner

Nmap

Network mapping and port scanning tool

SecurityTrails

DNS history and domain intelligence platform

Shodan

Search exposed internet-connected services

SpiderFoot

Automated OSINT reconnaissance framework

VirusTotal

Analyze files, URLs, domains, and IPs

Wireshark

Network protocol analyzer

ZoomEye

Cyberspace search engine for exposed assets

urlscan.io

Scan and analyze URLs safely

ADS-B Exchange

an unfiltered flight tracking network using ADS-B data from aircraft and comm

AFRINIC Whois

AFRINIC regional WHOIS service

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

APNIC Whois

APNIC regional WHOIS service

ARIN Whois-RWS

ARIN regional WHOIS API

ASNLookup

Free ASN to prefix lookup

ASNmap

ASN to CIDR resolver by ProjectDiscovery

ASlookup

Look up ASN, owner and announced prefixes for an IP

AbuseIPDB

a community IP reputation database for checking and reporting abusive interne

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

Anomali ThreatStream

Anomali TIP and feed management platform

BGP.tools

Real-time BGP routing visibility platform

BGPView

Free BGP routing data REST API

BinaryEdge

Paid internet-scan and asset discovery API

Blacklist Checker

Check IPs and domains against 100+ DNS blacklists

Blocklist.de

Check whether an IP is a reported attack source

Burp Suite

a commercial web security testing platform for proxying, scanning, and analyz

CIRCL Passive DNS

CIRCL passive DNS service for researchers

CVE Details

a searchable vulnerability database for CVEs, vendors, products, versions, an

Can I Take Over XYZ

a community-maintained reference for identifying services vulnerable to subdo

CentralOps

Web toolkit for WHOIS, DNS, and IP network lookups

CheckLeaked

Aggregated breach search across Dehashed, Snusbase and LeakCheck

Cisco Talos Intelligence

a threat reputation portal for IPs, domains, malware, vulnerabilities, and sp

Cisco Umbrella Investigate

Cisco DNS-resolver threat intel

Cloudflare Radar

Internet trends and DDoS data from Cloudflare

Cortex

an observable analysis and active response engine used with TheHive and secur

Criminal IP

CTI search engine scoring IPs and domains for threats

CrowdSec CTI

Crowdsourced IP reputation and threat intelligence platform

CrowdSec Console

Community-driven IPS and IP reputation

CyberChef

a browser-based data transformation workbench for decoding, parsing, hashing,

Cyberbro

Extract IOCs from raw text and enrich them across reputation services

DB-IP

Geolocate an IP address to country, city, ISP and ASN

DFIR Platform

API toolkit for phishing triage, IOC enrichment and BEC investigation

DMNS

Domain reconnaissance and DNS lookup tool

DNSChecker Malicious

Cisco Talos free reputation lookup

DNSLytics

Reverse-DNS and SSL pivoting platform

DNSstuff

Online DNS, reverse-DNS and blocklist lookup suite

DShield

Query attack reports and targeted ports for an IP

DeHashed API Tool

CLI for querying the DeHashed breach API by email, username or domain

Driftnet

Internet-scan intelligence for domains and IPs

Elasticsearch Crawler

Crawls open Elasticsearch for breach data

ExoneraTor

Historical Tor relay/exit checker

Exploit-DB

a public exploit archive maintained by Offensive Security for vulnerability r

Farsight DNSDB

Commercial passive DNS by DomainTools