OSINT
This page collects fast lookup and enrichment tools that help when you're validating suspicious IP addresses, domains, and malware indicators.
Search and Discovery
Google Search
Still one of the fastest ways to start broad recon, test strings, and pivot through public web results.
google.comGeneral searchBing
A useful second search engine when results differ from Google or when cached/alternate indexing helps.
bing.comPrivacy searchDuckDuckGo
Handy for cleaner search results and quick privacy-friendly lookups during routine investigation work.
duckduckgo.comPrivacy searchBrave Search
Another strong alternate search source when you want different indexing and less personalized results.
search.brave.comPrivate resultsStartpage
Useful when you want Google-style search results without querying Google directly from your browser.
startpage.comMetasearchSearXNG
Open-source metasearch that is great for broad web discovery and privacy-conscious research workflows.
searxng.orgDorksGoogle Hacking Database
A classic reference for search queries that surface exposed files, panels, leaks, and other public artifacts.
exploit-db.comInfrastructure and Reputation
URLVoid
Quick checks for suspicious websites using multiple reputation and blacklist data points.
urlvoid.comIP reputationIPVoid
Fast IP reputation lookups for triaging suspicious hosts and network indicators.
ipvoid.comGeolocationIPLocation
Simple geographic context for IPs when you need quick attribution clues or sanity checks.
iplocation.netAbuse reportsAbuseIPDB
Community-driven abuse reporting that is useful for validating hostile IP activity.
abuseipdb.comBlocklistsSpamhaus Checker
Check whether an IP, domain, or network has been listed in Spamhaus datasets.
spamhaus.orgReputationBitdefender TrafficLight
Web reputation checks for suspicious destinations during quick triage.
bitdefender.comCategory lookupsFortiGuard Web Filter
Useful for seeing how Fortinet classifies a site and whether it is flagged as risky.
fortiguard.comSite checksGridinsoft Checker
Another quick destination reputation source for validating suspicious websites.
gridinsoft.comWebsite healthSucuri SiteCheck
Scan public-facing websites for malware, blacklisting, and basic compromise signals.
sitecheck.sucuri.netReputation and ownershipTalos Intelligence
Useful for domain, IP, and network-owner context when you want another widely used reputation and infrastructure source.
talosintelligence.comDNS, Certificates, and Internet Exposure
MXToolbox SuperTool
One of the quickest ways to inspect DNS, MX, SPF, and related email infrastructure records.
mxtoolbox.comCertificatescrt.sh
Certificate transparency searches that are especially good for finding related domains and hosts.
crt.shExposure searchCensys
Internet-wide search for exposed services, certificates, and infrastructure fingerprints.
search.censys.ioWHOISDomainTools WHOIS
Useful for registration context, passive ownership clues, and domain history lookups.
domaintools.comReconDNSDumpster
Fast DNS recon and mapping when you want a broader sense of a domain's infrastructure.
dnsdumpster.comStorage exposureGrayHat Warfare Buckets
Search exposed cloud storage buckets that may contain leaked files or suspicious artifacts.
grayhatwarfare.comTech stackBuiltWith
Quickly fingerprint the technologies behind a site when you're profiling infrastructure or narrowing pivots.
builtwith.comDNS analysisDNSViz
Useful for visualizing DNS resolution issues, delegations, and trust-chain problems during deeper checks.
dnsviz.netRegistration dataICANN Lookup
Another useful source for domain registration context when you want a second WHOIS-style view.
lookup.icann.orgBrowser isolationBrowserling
Remote browser sessions that are handy for safely checking suspicious pages without using your local browser.
browserling.comSubdomain discoveryMerklemap
Certificate-transparency-driven subdomain discovery that can surface related infrastructure faster.
merklemap.comDNS pivotsRobtex
Strong for reverse DNS, host history, and infrastructure pivoting when you want more than a plain WHOIS view.
robtex.comHistorical DNSSecurityTrails
Useful for historical DNS, related infrastructure, and broader passive domain intelligence.
securitytrails.comTLS inspectionQualys SSL Labs
Quick SSL/TLS configuration checks that can help when you're profiling suspicious or newly observed hosts.
ssllabs.comURL and Threat Enrichment
urlscan.io
Public scans, screenshots, requests, and infrastructure details for suspicious URLs.
urlscan.ioURL sandboxingurlquery
Dynamic URL analysis with request chains and page behavior for investigation work.
urlquery.netThreat intelAlienVault OTX
Community pulses and indicator context that can quickly broaden an investigation.
otx.alienvault.comMalware samplesMalwareBazaar
Sample and hash lookups with family labels, sightings, and related malware context.
abuse.chC2 certificatesSSLBL
Abuse.ch tracking for suspicious SSL certificates and related command-and-control infrastructure.
abuse.chMalicious URLsURLhaus
High-value feed and lookup source for URLs tied to malware delivery and distribution.
abuse.chIOC huntingThreatFox
Search indicators, malware tags, and sightings to enrich a campaign investigation.
abuse.chThreat pivotsThreatMiner
Good for broader pivoting across indicators, reports, hashes, and campaign-linked infrastructure during enrichment.
threatminer.orgYARA matchingYARAify
Open YARA-driven threat intelligence that helps connect suspicious files to matching rules and related samples.
abuse.chInternet noiseGreyNoise
Useful for separating commodity internet background noise from activity that deserves closer attention.
greynoise.ioIOC enrichmentDFIR Platform
Multi-source enrichment and phishing-oriented investigation support when you want extra indicator context.
platform.dfir-lab.chURL forensicsUnfurl
Break apart complex URLs into readable forensic components during pivots and investigation writeups.
dfir.blogIOC enrichmentPulsedive
Useful for fast IOC enrichment, passive context, and tracking how suspicious infrastructure clusters together.
pulsedive.comMulti-check analysisMetaDefender
Another useful enrichment source for suspicious files, URLs, domains, hashes, and certificates.
metadefender.comRedirect tracingRedirect Detective
Quick redirect-chain checks when you want a lightweight view of where a suspicious link ultimately leads.
redirectdetective.comURL scanningTinyScan
Another scan-and-screenshot option for checking page details, location, and visible technology quickly.
tiny-scan.comPhishing and Fraud Tracking
PhishCan
Search phishing URLs and domains when you want extra confirmation during triage.
phishcan.comPhishing campaignsPhishStats
Good for tracking reported phishing activity and browsing related lures.
phishstats.infoCommunity feedPhishTank
A classic phishing verification and lookup source with community reporting.
phishtank.comFraud intelArtists Against 419
Historical fraud and fake banking references that can still be useful for niche checks.
aa419.orgDomain listsSURBL Analysis
Domain-based reputation and blocklist analysis focused on spam and malicious content.
surbl.orgLeak trackingHIBP Ransomed
Useful for checking whether an organization or domain shows up in public ransomware-related leak disclosures.
haveibeenransom.comSecret exposureGitGuardian Public Monitoring
Helpful when you're checking whether credentials or other sensitive strings have leaked into public repositories.
gitguardian.comEmail, Breach, and Contact Research
Have I Been Pwned
Still one of the best-known checks for seeing whether an email address has appeared in known breach datasets.
haveibeenpwned.comEmail reputationEmailRep
Useful for quick risk scoring and context around suspicious email addresses.
emailrep.ioEmail investigationEpieos Tools
Helpful for email-focused OSINT when you are chasing account recovery footprints and related signals.
tools.epieos.comEmail discoveryHunter
Useful for finding organizational email patterns and validating likely contact formats.
hunter.ioLeak searchLeakCheck
Search exposed credentials and breach data when you need broader leak-oriented context.
leakcheck.ioEmail validationEmailHippo
Quick validation checks to see whether an address appears deliverable before you spend time pivoting on it.
tools.verifyemailaddress.ioMulti-source pivotingAutomater
A handy helper for gathering intelligence on URLs, IPs, domains, and hashes from multiple public sources quickly.
github.com/1aN0rmus/TekDefense-AutomaterIdentity and Account Research
WhatsMyName
One of the quickest ways to see whether a handle appears across a wide range of online services.
whatsmyname.appUsername huntingSherlock
CLI-friendly account discovery for checking whether a username exists across many social and public platforms.
github.com/sherlock-project/sherlockHandle availabilityNamechk
Useful for quick username and brand-name checks when you are looking for impersonation or repeated identity use.
namechk.comSocial discoverySocial Searcher
Search public social content and mentions when you need a lightweight first pass before deeper manual review.
social-searcher.comCompany and Organization Research
OpenCorporates
Helpful for checking company registrations, officers, and related legal entities across jurisdictions.
opencorporates.comEntity screeningOpenSanctions
Useful for screening people and organizations against sanctions, watchlists, and politically exposed person datasets.
opensanctions.orgCompany profilesCrunchbase
Good for quick context on startups, funding history, acquisitions, and organization relationships.
crunchbase.comWeb property linksBuiltWith Relationships
Useful when you want to cluster websites by shared technology, tracking IDs, or related operational fingerprints.
builtwith.comBroad Recon and Extra References
OSINT Framework
A starting point for branching into deeper, specialized open-source intelligence workflows.
osintframework.comBroad searchIntelligence X
Search across leaked data, domains, and other sources when a case needs wider coverage.
intelx.ioCMS reconWPScan
WordPress-focused enumeration and vulnerability checking for site investigation work.
github.com/wpscanteam/wpscanAutomationSpiderFoot
Automated recon and enrichment that helps stitch together infrastructure and identity clues.
github.com/smicallef/spiderfootWeb historyWayback Machine
Still one of the best places to confirm what a site looked like before it changed, vanished, or went malicious.
archive.orgSnapshot captureArchive.is
Useful when you want a quick static snapshot of a page that may disappear or change soon.
archive.isReverse image searchTinEye
Fast reverse image checks for reused lures, stolen branding, and recycled scam visuals.
tineye.comImage searchYandex Images
Another strong reverse image source that can surface matches other engines miss.
yandex.comExposure searchShodan
Classic internet exposure search for services, banners, and externally visible infrastructure.
shodan.ioCollectiontheHarvester
Gather emails, hosts, subdomains, and related public-source data when you need a broader initial sweep.
github.com/laramies/theHarvesterUtilityThreatYeti
A handy collection of small threat hunting and investigation helpers.
threatyeti.comExtortion trackingransomware.live
Keep tabs on public ransomware leak sites, claims, and observed victim postings.
ransomware.liveCode searchgrep.app
Fast code search across public repositories when you are tracing strings, IOCs, or tooling reuse.
grep.appRepo searchGitHub Code Search
Native GitHub search for tracing strings, usernames, leaked material, and reused code across public repos.
github.comSource code searchPublicWWW
Search website source code at scale for reused IDs, scripts, tracker snippets, and embedded strings.
publicwww.comCode examplesSearchcode
Helpful when you are tracing code fragments, functions, or public tooling references across indexed repositories.
searchcode.comCode searchSourcegraph
Another strong large-scale code search option for tracking strings, libraries, and implementation reuse.
sourcegraph.comLegacy feedVX Vault
A long-running malware URL reference that can still be useful as an extra point of comparison.
vxvault.netMalware and Adversary Knowledge
Malpedia
Strong reference for malware family overviews, aliases, YARA links, and broader context around named threats.
malpedia.caad.fkie.fraunhofer.deAdversary behaviorMITRE ATT&CK
Useful for mapping observed behavior, campaign tradecraft, and procedure-level details during reporting and enrichment.
attack.mitre.orgLiving-off-the-landLOLBAS
Helpful when you need quick context on abused Windows binaries, known techniques, and common defensive notes.
lolbas-project.github.ioDriver abuseLOLDrivers
Useful for checking whether a suspicious driver is known to be abused for evasion, privilege abuse, or BYOVD scenarios.
loldrivers.ioThreat Intelligence Platforms and Sharing
MISP
A major open-source platform for collecting, organizing, correlating, and sharing indicators and threat intelligence between teams.
misp-project.orgCTI platformOpenCTI
Useful when you want a richer knowledge graph for threats, observables, campaigns, and ATT&CK-aligned intelligence relationships.
opencti.ioIntel aggregationIntel Owl
Great for pulling file, IP, domain, and URL intelligence from multiple analyzers and sources through one workflow or API.
intelowlproject.github.ioWeb History and Visual Search
Google Images
Still useful for reverse image checks on reused lures, logos, screenshots, and scam branding.
images.google.comVisual matchingGoogle Lens
Helpful when you want stronger visual matching or text extraction from screenshots and photos.
lens.google.comSite snapshotsstored.website
Another useful angle for checking whether a site has been archived or previously observed.
stored.website