◎ I have a domain

LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.

On-demand page archiver (archive.ph / archive.is) that captures a snapshot and screenshot, often working on pages the Wayback Machine can't capture, such as social posts.

Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.

Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.

Technology profiler for websites that shows the CMS, analytics, ad networks and hosting, plus a relationship tool linking sites by shared tracking IDs.

Free web-based subdomain finder that returns subdomains with their resolved IPs and Cloudflare status. Previous scans are browsable.

Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.

Community reporting platform for scam and fraud crypto addresses, domains and social accounts, run by TRM Labs.

Nameserver change history for domains going back to the early 2000s. Useful for dating ownership and hosting changes.

Threat-focused internet asset search engine with IP and domain risk scoring, exposed services, vulnerabilities and screenshot reports.

One identifier in, one reconciled view out: runs an email, username, phone or domain across the OSINT APIs you hold keys for (OSI, Dehashed, Opsis) and merges results with per-source attribution.

Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.

Free domain research tool from HackerTarget that maps DNS records, subdomains, hosts and mail servers from passive sources and draws a network graph.

Multi-purpose DNS toolkit for bulk resolving, record querying, wildcard filtering and subdomain brute-forcing.

Free WHOIS lookup with hosting history and reverse IP hints. The paid Iris platform adds historical WHOIS, reverse WHOIS and infrastructure pivoting.

Windows tool that finds documents published on a domain, downloads them and extracts metadata such as usernames, software, printers and internal paths.

Cyberspace mapping search engine with rich fingerprinting (icon hash, cert, header, body). Strong coverage of Asian and Chinese hosts.

Fetches known URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and urlscan in one command.

Headless-Chrome screenshot tool for large lists of URLs, with a local web UI to triage results and track changes.

Fast regex search across half a million public GitHub repos. Find leaked config, internal hostnames, emails or API endpoints mentioning a target.

Domain data API and lookup showing backlinks, redirects, co-hosted domains, and domains sharing the same analytics or tracking IDs.

HTTP probing toolkit that checks which hosts are live and grabs titles, status codes, tech stack, TLS details and favicon hashes in bulk.

Free tools that check whether an email, username, or domain appears in infostealer-malware logs, with infection date and the compromised machine's details.

Finds professional email addresses for a company domain, infers the address pattern (e.g. first.last@), and verifies deliverability.

Official ICANN registration data lookup for domains, using RDAP with WHOIS fallback. Shows the registrar, key dates, nameservers and status codes.

Search engine and archive of leaks, pastes, dark-web pages, and historical data. Supports email, domain, IP, CIDR, URL, and crypto address selectors.

Breach data search engine with a free check of which breaches contain a selector, and paid access to the full records.

Breach search by email, username, phone, or domain that shows breach sources and dates. Paid plans include leaked fields such as passwords.

Search engine focused on exposed services and leaks, such as open databases, exposed .git and .env files, and misconfigured services, indexed by IP and domain.

Graph-based link-analysis platform. Run "transforms" against entities (people, domains, emails, companies) to pull data from dozens of integrated sources.

CLI that uses Google dorks to find public documents (pdf, doc, xls, ppt) on a target domain and downloads them for metadata analysis.

Hosting history, netblock owner, nameserver, SSL and technology report for any site. Netcraft has tracked hosting since the 1990s.

Internet scan search engine covering hosts, DNS, WHOIS and certificates, with an attack surface discovery graph and a generous free tier.

Browser-based OSINT search across 700+ modules. 400+ username platform checks, 330+ email enrichment modules, plus WHOIS, DNS and reverse-WHOIS for domains.

In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.

Intelligence X-powered search that lists email addresses, subdomains, and URLs seen for a given domain.

Source code search engine for web pages. Find every site containing a given snippet, analytics ID, script, or keyword in its HTML, JS or CSS.

Free threat intel platform that enriches IPs, domains and URLs with risk scores, linked threats, feeds and WHOIS/DNS context.

RDAP bootstrap redirector that sends a query for any domain, IP or ASN to the authoritative registry's RDAP server and returns structured JSON.

Metasploit-style modular reconnaissance framework in Python, with a marketplace of modules and a built-in workspace database and reporting.

DNS and IP relationship lookup covering forward and reverse DNS, shared nameservers and mail servers, ASN data and graphs of related hosts.

Source code search engine indexing code from GitHub, GitLab, Bitbucket and other forges. It complements grep.app with broader coverage beyond GitHub.

Historical DNS records, subdomains, associated domains and reverse lookups by IP, nameserver or mail server, from a very large passive DNS dataset.

Search engine for internet-connected devices. Query banners, open ports, SSL certs, favicons and vulnerabilities across the IPv4 space.

Search engine of email addresses indexed from the web. Enter a domain to list addresses and the pages where they appeared.

OSINT automation framework with 200+ modules. Give it a domain, IP, email, name or username and it recursively correlates findings in a web UI.

Fast passive subdomain enumeration CLI that aggregates dozens of sources (CT logs, passive DNS, search engines) without touching the target.

Collects emails, subdomains, hosts, employee names and IPs for a domain from search engines, PGP servers, certificate logs and APIs.

abuse.ch database of malware IOCs (C2 IPs, domains, URLs, hashes) tagged by malware family, free to search and export.

abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.

Sandbox that loads a URL and records the requests, IPs, domains, screenshots and DOM. Its search across millions of past scans is a pivot goldmine.

Swiss-army collection of DNS tools including reverse IP, reverse WHOIS, IP history, DNS records, reverse MX/NS and port checks.

Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.

Browser extension and lookup service that identifies technologies on websites, such as frameworks, CMS, analytics, CDNs and e-commerce platforms.

Internet Archive's archive of 900B+ web page captures since 1996. View past versions of sites, list every archived URL for a domain, and save pages on demand.

Pulls every URL the Wayback Machine knows for a domain into stdout. Good for finding old endpoints, files and parameters.

Quick, ad-light WHOIS and DNS record lookup for domains, with raw registry output.

WHOIS lookup with cheap historical WHOIS and reverse WHOIS by registrant name, email, company or keyword.

Chinese cyberspace search engine (Knownsec) that indexes devices and web services. Often has coverage of Asian infrastructure that Shodan misses.