Maltegomaltego.com
Graph-based link-analysis platform. Run "transforms" against entities (people, domains, emails, companies) to pull data from dozens of integrated sources.
real nameemaildomaincompanyusernameip / asncryptodetails
tools / spiderfoot
SpiderFoot
OSINT automation framework with 200+ modules. Give it a domain, IP, email, name or username and it recursively correlates findings in a web UI.
freeactiveosscliweb
field note
Choose the "Passive" use case when scanning to avoid touching target infrastructure. Add free API keys (Shodan, HIBP and others) for much richer results.
opsec warning
This tool is active: it interacts directly with the target's infrastructure or may otherwise reveal your interest to the target. Use a research environment and weigh the risk before running it.
similar tools
CrossTracecrosstrace.io
One identifier in, one reconciled view out: runs an email, username, phone or domain across the OSINT APIs you hold keys for (OSI, Dehashed, Opsis) and merges results with per-source attribution.
emailusernamephonedomaindetails
DeHasheddehashed.com
Searchable breach database that queries by email, username, name, IP, phone, address, or password hash and returns raw leaked records.
emailusernamereal nameip / asnphonelocationdetails
Intelligence Xintelx.io
Search engine and archive of leaks, pastes, dark-web pages, and historical data. Supports email, domain, IP, CIDR, URL, and crypto address selectors.
emaildomainip / asnurlcryptophonedetails
Leak-Lookupleak-lookup.com
Breach data search engine with a free check of which breaches contain a selector, and paid access to the full records.
emailusernameip / asnphonedomaindetails
recon-nggithub.com
Metasploit-style modular reconnaissance framework in Python, with a marketplace of modules and a built-in workspace database and reporting.
domaincompanyemailip / asndetails