IP Address OSINT Tools

Censys

Internet asset and certificate search engine

DeHashed

Breach intelligence and credential search

DomainTools

Enterprise domain and DNS intelligence

FOFA

Internet asset search and mapping engine

GreyNoise

Internet scanner reputation intelligence

Maltego

Visual OSINT link-analysis platform

Masscan

Very fast internet-scale port scanner

Nmap

Network mapping and port scanning tool

SpiderFoot

Automated OSINT reconnaissance framework

VirusTotal

Analyze files, URLs, domains, and IPs

Wireshark

Network protocol analyzer

ZoomEye

Cyberspace search engine for exposed assets

urlscan.io

Scan and analyze URLs safely

ADS-B Exchange

an unfiltered flight tracking network using ADS-B data from aircraft and comm

AFRINIC Whois

AFRINIC regional WHOIS service

ANY.RUN Threat Intelligence Lookup

ANY.RUN sandboxed runs IOC lookup

APNIC Whois

APNIC regional WHOIS service

ASNmap

ASN to CIDR resolver by ProjectDiscovery

AlienVault OTX

a community threat intelligence exchange for pulses, indicators, malware, and

Anomali ThreatStream

Anomali TIP and feed management platform

BGP.tools

Real-time BGP routing visibility platform

BinaryEdge

Paid internet-scan and asset discovery API

Blacklist Checker

Check IPs and domains against 100+ DNS blacklists

Blocklist.de

Check whether an IP is a reported attack source

CIRCL Passive DNS

CIRCL passive DNS service for researchers

Can I Take Over XYZ

a community-maintained reference for identifying services vulnerable to subdo

CentralOps

Web toolkit for WHOIS, DNS, and IP network lookups

CheckLeaked

Aggregated breach search across Dehashed, Snusbase and LeakCheck

Cisco Talos Intelligence

a threat reputation portal for IPs, domains, malware, vulnerabilities, and sp

Cisco Umbrella Investigate

Cisco DNS-resolver threat intel

Cloudflare Radar

Internet trends and DDoS data from Cloudflare

Cortex

an observable analysis and active response engine used with TheHive and secur

Criminal IP

CTI search engine scoring IPs and domains for threats

CrowdSec CTI

Crowdsourced IP reputation and threat intelligence platform

CrowdSec Console

Community-driven IPS and IP reputation

CyberChef

a browser-based data transformation workbench for decoding, parsing, hashing,

Cyberbro

Extract IOCs from raw text and enrich them across reputation services

DB-IP

Geolocate an IP address to country, city, ISP and ASN

DFIR Platform

API toolkit for phishing triage, IOC enrichment and BEC investigation

DMNS

Domain reconnaissance and DNS lookup tool

DNSChecker Malicious

Cisco Talos free reputation lookup

DNSLytics

Reverse-DNS and SSL pivoting platform

DNSstuff

Online DNS, reverse-DNS and blocklist lookup suite

DShield

Query attack reports and targeted ports for an IP

DeHashed API Tool

CLI for querying the DeHashed breach API by email, username or domain

Driftnet

Internet-scan intelligence for domains and IPs

Elasticsearch Crawler

Crawls open Elasticsearch for breach data

ExoneraTor

Historical Tor relay/exit checker

Exploit-DB

a public exploit archive maintained by Offensive Security for vulnerability r

Farsight DNSDB

Commercial passive DNS by DomainTools

Feodo Tracker

an abuse.ch tracker for botnet command-and-control indicators associated with

FireHOL IP Lists

Aggregated IP blocklists and threat feeds with history

FlightAware

a flight tracking and aviation data service for aircraft, route, airport, and

Flightradar24

a live flight tracking platform for aircraft positions, routes, histories, an

Focsec

IP API flagging VPN, proxy, Tor and bot traffic

FortiGuard Web Filter Lookup

Look up a URL, domain or IP reputation and category

FraudGuard.io

IP reputation and VPN/TOR detection API

GeoLite2

Free MaxMind IP geolocation data

Google Earth

a global geospatial visualization platform with satellite imagery, 3D terrain

Google Safe Browsing

a Google service and API for checking URLs against unsafe web resource lists