BGP.tools
Fast BGP and ASN explorer for understanding who routes an IP block.
Censys
Internet-wide scan data for hosts and certificates, with a usable free search tier.
crt.sh
Certificate Transparency log search; a quick way to find subdomains and newly issued certs.
DNSDumpster
Free domain research tool that maps DNS records and hosts visually.
FOFA
Asset search engine useful for fingerprinting services and finding related infrastructure.
Hurricane Electric BGP Toolkit
Long-standing ASN, prefix and peering lookup service.
IPinfo
Accurate IP geolocation, ASN and privacy-detection data with a free tier.
Nmap
The classic network scanner for host discovery and service detection.
Nuclei
Template-based vulnerability scanner with a huge community template set.
SecurityTrails
Historical DNS and WHOIS data; great for tracking infrastructure changes over time.
Shodan
Search engine for internet-connected devices; essential for exposure checks and infrastructure pivots.
ViewDNS.info
Collection of free DNS, reverse IP and WHOIS lookups in one place.
ZoomEye
Cyberspace search engine similar to Shodan, with strong coverage of Asian infrastructure.