AbuseIPDB
Community-reported abusive IP database with a free lookup API.
ACLED
Armed conflict location and event data, free for research use.
ADS-B Exchange
Unfiltered ADS-B flight tracking, including many military and government aircraft.
ADSB.lol
Open, community-fed ADS-B aggregator with free data and API.
Ahmia
Clearnet search engine for Tor hidden services that filters abuse content.
AlienVault OTX
Open Threat Exchange: community pulses of IOCs and an API for enrichment.
Amass
OWASP project for in-depth attack surface mapping and subdomain enumeration.
ANY.RUN
Interactive malware sandbox where you can click through a live detonation.
archive.today
On-demand web page snapshot service that captures pages the Wayback Machine misses.
ArchiveBox
Self-hosted web archiving tool that saves pages in multiple formats.
Arkham Intelligence
Entity-labeled blockchain analytics platform.
Autopsy
Open-source digital forensics platform built on The Sleuth Kit.
Basel Institute OSINT resources
Anti-corruption and financial investigation training, including free eLearning.
Bellingcat Guides
Free how-to articles on open-source investigation techniques.
Bellingcat Online Investigation Toolkit
Bellingcat's curated, categorized guide to investigation tools.
BGP.tools
Fast BGP and ASN explorer for understanding who routes an IP block.
Bitwarden
Open-source password manager with strong free plan.
BleepingComputer
Fast-moving news on ransomware, breaches and vulnerabilities.
Blockchain.com Explorer
Basic explorer for Bitcoin and Ethereum transactions.
Blue Team Labs Online
Defensive security challenges and investigations.
Brave Browser
Privacy-first browser that blocks trackers by default.
Breadcrumbs
Visual blockchain tracing with a free tier for following funds.
BrowserLeaks
Checks what your browser leaks: IP, WebRTC, fonts, canvas and more.
BuiltWith
Shows the technology stack behind a website; helpful for linking sites.
Censys
Internet-wide scan data for hosts and certificates, with a usable free search tier.
Chainabuse
Community reports of crypto scams and malicious addresses.
Check Phish (Bolster)
Free URL scanner that flags phishing and scam sites.
CISA Cybersecurity Advisories
Official US government advisories on active threats.
CISA Free Cybersecurity Services
CISA's catalog of free services and tools for defenders.
CISA KEV Catalog
CISA's list of vulnerabilities known to be exploited in the wild; a must-watch for patch priority.
Copernicus Browser
ESA's official viewer for Sentinel satellite data.
Counter Extremism Project
Research and reports on extremist groups and leaders.
Cover Your Tracks (EFF)
Tests how unique and trackable your browser fingerprint is.
Critical Threats
AEI project tracking threats from adversary states and terrorist groups.
crt.sh
Certificate Transparency log search; a quick way to find subdomains and newly issued certs.
CVE.org
The official CVE program site and record search.
CyberChef
GCHQ's 'cyber Swiss army knife' for encoding, decoding and data transforms.
Cybrary
Online cybersecurity courses and career paths.
Dark Reading
Enterprise security news and analysis.
DeHashed
Searchable breach data for investigators, with paid access.
DNSDumpster
Free domain research tool that maps DNS records and hosts visually.
DNSTwist
Generates and checks lookalike domains for phishing and typosquat detection.
DocumentCloud
Upload, OCR, annotate and publish primary-source documents.
DomainTools
Enterprise domain and DNS intelligence with deep WHOIS history.
EFF Surveillance Self-Defense
Practical guides to protecting yourself from surveillance.
Epieos
Reverse email and phone lookup that surfaces linked accounts.
Etherscan
The standard Ethereum explorer with labels for known addresses.
ExifTool
The definitive metadata reader and writer for images, video and documents.
Exploit-DB
Archive of public exploits and proof-of-concept code maintained by OffSec.
Feodo Tracker
Tracks botnet command-and-control servers and publishes blocklists.
First Draft / Information Futures Lab
Archive of verification and misinformation research training.
FIRST EPSS
Exploit Prediction Scoring System estimating the chance a CVE will be exploited soon.
Flightradar24
Live and historical flight tracking with a solid free tier.
FOCA
Extracts metadata from public documents to reveal users and software.
FOFA
Asset search engine useful for fingerprinting services and finding related infrastructure.
Forensically
Browser-based image forensics: clone detection, ELA, noise analysis.
FotoForensics
Error level analysis and metadata viewer for spotting image edits.
GDELT Project
Global news event database for large-scale media monitoring.
GeoSpy
AI-assisted photo geolocation; treat results as leads to verify.
Gephi
Open-source network visualization for large relationship graphs.
Ghidra
NSA's open-source reverse engineering suite.
GIJN Resource Center
Global Investigative Journalism Network guides and tipsheets.
GitHub Code Search
Searching public code often reveals leaked keys, emails and infrastructure.
Gitleaks
Scans repositories for hardcoded secrets.
GLEIF LEI Search
Global Legal Entity Identifier lookup showing corporate parent relationships.
Global Fishing Watch
Tracks fishing vessel activity and AIS gaps, useful for dark-shipping research.
Global Terrorism Database
START's database of terrorist incidents since 1970.
Google Dorks (GHDB)
Google Hacking Database of search operators that surface exposed data.
Google Earth
Global imagery with historical layers; the starting point for most geolocation work.
Google Lens
Google's visual search, the go-to first pass for reverse image lookup.
Google Safe Browsing Status
Checks whether Google currently flags a site as unsafe.
Google Threat Intelligence Blog
Mandiant and Google threat research on APTs and campaigns.
GreyNoise
Tells you which IPs are mass-scanning the internet so you can separate background noise from targeted activity.
Hack The Box
Hands-on offensive and defensive security labs and certifications.
Have I Been Pwned
Troy Hunt's breach notification service for emails and passwords.
Holehe
Checks whether an email is registered on 120+ sites without alerting the target.
Hudson Rock Cavalier (free tools)
Free lookups for infostealer-infected credentials tied to emails and domains.
Hunchly
Browser extension that automatically captures and logs every page during an investigation.
Hunter.io
Finds and verifies professional email addresses by domain.
Hurricane Electric BGP Toolkit
Long-standing ASN, prefix and peering lookup service.
Hybrid Analysis
Free malware sandbox powered by CrowdStrike Falcon Sandbox technology.
i2 Analyst's Notebook
Law-enforcement standard link-analysis and visualization tool.
ICIJ Offshore Leaks
Searchable database from the Panama, Paradise and Pandora Papers.
ID Ransomware
Identifies ransomware families from ransom notes or encrypted files.
Instaloader
Downloads public Instagram profiles, posts and metadata for archiving.
Institute for the Study of War
Daily conflict assessments and maps.
Intelligence X
Search engine and archive covering leaks, darknet and historical web data.
IntelTechniques
Michael Bazzell's OSINT and privacy books, podcast and training.
InVID WeVerify Plugin
Browser plugin for video keyframes, reverse search and metadata used by newsrooms.
IPinfo
Accurate IP geolocation, ASN and privacy-detection data with a free tier.
Janes
Defense intelligence data on militaries, equipment and forces.
Jeffrey's Image Metadata Viewer
Online EXIF viewer that shows camera data and embedded GPS.
Joe Sandbox
Deep automated malware analysis with detailed behavioral reports.
KeePassXC
Offline, open-source password manager.
Krebs on Security
Brian Krebs's investigative reporting on cybercrime.
LeakCheck
Breach lookup service by email, username or phone.
LetsDefend
SOC analyst training platform with simulated alerts.
Liveuamap
Live map of conflict events built from open sources.
Maigret
Sherlock-style username search that also parses profile details into a report.
Maltego
Graph-based link analysis platform for mapping relationships between people, domains and infrastructure. Free Community edition available.
MalwareBazaar
abuse.ch repository for sharing malware samples with tags and signatures.
MarineTraffic
AIS ship tracking with vessel details and port calls.
Metagoofil
Finds and downloads public documents from a domain for metadata analysis.
Microsoft Threat Intelligence
Microsoft's threat actor research and campaign reporting.
MISP
Open-source threat intel sharing platform used by CERTs and ISACs worldwide.
MITRE ATT&CK
The standard knowledge base of adversary tactics and techniques.
MITRE D3FEND
Knowledge graph of defensive countermeasures mapped against ATT&CK.
Mullvad VPN
Privacy-focused VPN with anonymous accounts and cash payments.
My OSINT Training
Self-paced OSINT courses from beginner to advanced.
Namechk
Quick username availability check across platforms and domains.
NASA FIRMS
Near-real-time fire and thermal anomaly map, often used to track strikes and conflict events.
NICCS Training Catalog
US government catalog of cybersecurity training and education.
Nmap
The classic network scanner for host discovery and service detection.
No More Ransom
Europol-backed portal of free ransomware decryptors.
Nuclei
Template-based vulnerability scanner with a huge community template set.
NVD
NIST National Vulnerability Database with CVSS scoring for CVEs.
Obsidian
Local-first markdown notebook popular for investigation notes and link graphs.
OCCRP Aleph
Investigative data platform with millions of public records and leaks.
OFAC Sanctions Search
US Treasury's official SDN list search.
OffSec
Creators of OSCP and Kali; rigorous hands-on certification training.
OnionScan
Scans onion services for misconfigurations that leak identity.
OpenCorporates
Largest open database of company registrations worldwide.
OpenCTI
Open-source platform for structuring threat intel on the STIX 2 model.
OpenRailwayMap
Rail infrastructure map built on OpenStreetMap.
OpenSanctions
Consolidated sanctions, PEP and watchlist data, free for non-commercial use.
OpenStreetMap
Open, community-built world map with detail often missing from commercial maps.
Oryx
Visually confirmed equipment loss tracking from open sources.
OSINT Combine
OSINT training courses and free investigation tools.
OSINT Framework
Clickable tree of OSINT resources organized by data type.
OSINT Industries
Real-time email and phone lookup across hundreds of platforms.
Overpass Turbo
Query OpenStreetMap data to find locations matching features seen in imagery.
PeakVisor
Identifies mountain ridgelines, useful for geolocating outdoor imagery.
Phishtank
Community-verified phishing URL database.
Photon
Fast crawler that extracts URLs, emails and files from a site.
PimEyes
Face search engine; powerful and ethically sensitive, so use within legal limits.
Planet
Daily commercial satellite imagery of the whole planet.
Privacy Guides
Community-vetted recommendations for privacy tools and practices.
Proton Mail
Encrypted email with a free tier, based in Switzerland.
Proton VPN
Swiss VPN with a no-logs policy and a free tier.
Pulsedive
Free threat intel platform for enriching and pivoting on IOCs.
Qubes OS
Security-by-compartmentalization desktop OS.
RansomLook
Open-source ransomware leak-site and forum monitor.
Ransomware.live
Tracks ransomware leak-site posts and victims in near real time.
Recon-ng
Modular recon framework with a Metasploit-style console; good for repeatable, scripted investigations.
ReliefWeb
UN OCHA humanitarian reports and crisis updates.
Risky Business
Weekly security podcast and newsletter with expert commentary.
SANS Institute
Industry-leading security training and GIAC certifications, including OSINT (SEC497).
SANS Webcasts
Free webcasts on intel, DFIR and security topics.
SEC EDGAR
Full-text search of US public company filings.
Security Onion
Free Linux distro for threat hunting and network security monitoring.
SecurityTrails
Historical DNS and WHOIS data; great for tracking infrastructure changes over time.
SecurityWeek
Daily cybersecurity and ICS security news.
Sentinel Hub EO Browser
Browse free Sentinel and Landsat satellite imagery by date and band.
Sherlock
Hunts a username across hundreds of social networks.
Shodan
Search engine for internet-connected devices; essential for exposure checks and infrastructure pivots.
Sigma
Generic signature format for SIEM detections, with a large rule library.
Signal
End-to-end encrypted messaging; the default for secure comms.
SingleFile
Browser extension that saves a complete web page into a single HTML file.
Social Blade
Follower and growth statistics for YouTube, X, Instagram and more.
Social-Analyzer
API, CLI and web app for analyzing and finding a person's profiles across sites.
SpiderFoot
Automated OSINT scanner with 200+ modules for footprinting domains, IPs and names. The open-source version runs locally.
Subfinder
Fast passive subdomain discovery tool that pulls from dozens of public sources.
SunCalc
Shows sun position and shadow angles for chronolocation of photos.
Suricata
High-performance open-source IDS/IPS engine.
Tails
Amnesic live operating system that leaves no trace on the host.
Talos Intelligence
Cisco Talos reputation lookups and threat research.
Telegago
Custom Google search for public Telegram channels and groups.
TGStat
Telegram channel analytics and search.
The DFIR Report
Detailed real-world intrusion reports with timelines and IOCs.
The Hacker News
Popular cybersecurity news site covering threats and vulnerabilities.
The Record by Recorded Future
Cybersecurity news desk covering threats, policy and nation-state activity.
theHarvester
Classic command-line tool for gathering emails, subdomains and hosts from public sources during early recon.
ThreatFox
Community IOC sharing platform from abuse.ch, with a free API.
TinEye
Reverse image search that is strong at finding the oldest copy of an image.
Tor Project
Anonymity network and browser; baseline tool for safe dark-web research.
Trace Labs
Crowdsourced OSINT CTFs that help find missing persons.
TruffleHog
Finds leaked secrets and credentials in git repos and other sources.
TryHackMe
Gamified, browser-based security labs for all skill levels.
uBlock Origin
Efficient content blocker that also cuts tracking during research.
UK Companies House
Free UK company, officer and filing search.
Unit 42
Palo Alto Networks threat research and incident reports.
URLhaus
abuse.ch database of malicious URLs used for malware distribution.
URLScan.io
Sandbox that loads a URL and records requests, screenshots and indicators; great for phishing triage.
Velociraptor
Endpoint visibility and DFIR collection tool at scale.
VeraCrypt
Disk and container encryption, successor to TrueCrypt.
VesselFinder
Free AIS vessel position tracking with paid history.
ViewDNS.info
Collection of free DNS, reverse IP and WHOIS lookups in one place.
VirusTotal
Multi-engine scanner for files, URLs, domains and IPs with community comments and relationships.
Volatility
Memory forensics framework for analyzing RAM captures.
Vulners
Aggregated vulnerability search engine with exploit and advisory correlation.
Wappalyzer
Browser extension identifying technologies used on websites.
Wayback Machine
Internet Archive's historical web snapshots, plus on-demand page saving.
Wazuh
Open-source SIEM and XDR platform.
Whonix
VM-based OS that forces all traffic through Tor.
Whoxy
WHOIS and reverse WHOIS search with historical records.
Wikileaks
Archive of leaked government and corporate documents.
Wireshark
The standard packet capture and protocol analyzer.
Yandex Images
Reverse image search known for strong face and landmark matching.
YARA
Pattern-matching rules language for classifying malware.
yt-dlp
Command-line downloader for video from YouTube and hundreds of other sites; vital for preserving evidence.
Yubico YubiKey
Hardware security keys for phishing-resistant multi-factor authentication.
Zeek
Network analysis framework producing rich traffic logs.
ZoomEye
Cyberspace search engine similar to Shodan, with strong coverage of Asian infrastructure.