all tools

UK people, business, and address directory built on the electoral roll, directory enquiries, and Companies House data. Detailed records need credits.

Searchable archive of several 4chan boards (/pol/, /x/, /tv/ and others) with images, filterable by text, poster ID, country flag and date.

Crowd-sourced database of IPs reported for abuse (brute force, spam, scanning), with confidence scores, reporter comments, ISP and usage type.

Community-fed flight tracker that publishes ADS-B/MLAT data, including military and government aircraft that commercial trackers often hide. Includes a historical replay.

Search engine for Tor onion services, reachable from the clearnet, with abuse material filtered out. Also publishes lists of online onion sites.

LevelBlue (formerly AT&T) Open Threat Exchange. Community threat pulses, passive DNS and indicator lookups for IPs, domains, hashes and URLs.

Official French government company directory. SIREN/SIRET lookup, executives, beneficial owners, filings and certifications for every French business.

On-demand page archiver (archive.ph / archive.is) that captures a snapshot and screenshot, often working on pages the Wayback Machine can't capture, such as social posts.

Searchable archive of Reddit posts and comments (the successor to Pushshift), filterable by author, subreddit, keyword and date, including deleted content.

On-chain analytics platform that deanonymizes wallets with entity labels and offers a visualizer, alerts and portfolio views of known entities.

Minimal Go tool that finds domains and subdomains related to a given domain from CT logs, passive DNS and other public sources.

Recursive internet scanner that chains 100+ modules for subdomain enumeration, web spidering and email harvesting. Has a passive-only preset.

Paid US background-check service covering contact info, criminal records, assets, vehicles, and social profiles.

Automates archiving of social media posts, videos and web pages from a spreadsheet or CLI, with hashing and timestamping to preserve evidence.

No-code proximity search over OpenStreetMap. Pick features you can see in an image (e.g. a park, a tram stop, a tower) and a distance, and it returns every place where they occur together.

Modern BGP and ASN explorer with live routing data, upstream/downstream graphs, prefix history and DNS data per network.

Microsoft Bing's reverse image search. Upload or paste an image to find similar images, pages containing it, products and recognised entities. Lets you crop to sub-regions.

Bitcoin address lookup that collects web mentions, scam reports and tags for an address across the public internet.

Fast username and email lookup across 600+ sites using the WhatsMyName dataset, with PDF/CSV export and optional AI-generated profile summaries.

Multi-chain block explorer and search engine for Bitcoin, Ethereum, Litecoin, Dogecoin and more, with address, transaction and privacy-score views.

Free breach lookup by email, username, or phone that shows matching breaches and partial password hashes with source names.

Blockchain investigation platform with visual fund-flow tracing graphs, address labels and risk scoring across BTC, ETH, TRON and EVM chains.

Technology profiler for websites that shows the CMS, analytics, ad networks and hosting, plus a relationship tool linking sites by shared tracking IDs.

Free web-based subdomain finder that returns subdomains with their resolved IPs and Cloudflare status. Previous scans are browsable.

Queries the US CNAM (caller name) database to show the name a number displays as on incoming calls.

Community reverse phone lookup with user-submitted names and spam/scam reports for US numbers.

Canadian white- and yellow-pages directory with person, business, and reverse phone lookup.

Crowdsourced map of cellular towers and coverage by carrier and technology (2G-5G), including estimated tower locations, sector bearings and frequency bands.

Internet-wide scan data on hosts, services and certificates, with a powerful query language. Strong for certificate pivoting and finding related infrastructure.

Community reporting platform for scam and fraud crypto addresses, domains and social accounts, run by TRM Labs.

Bluesky lookup showing who blocks a user and who they block, moderation list membership and handle history for an account.

Nameserver change history for domains going back to the early 2000s. Useful for dating ownership and hosting changes.

The official Copernicus Data Space Ecosystem viewer. Free access to the full Sentinel archive with visualisation, comparison, timelapse and download tools.

Free Law Project's search of millions of US court opinions, oral arguments and PACER dockets from the RECAP archive. Supports alerts.

Threat-focused internet asset search engine with IP and domain risk scoring, exposed services, vulnerabilities and screenshot reports.

Enumerates a company's employees from LinkedIn via search-engine scraping (no LinkedIn login) and generates names and likely email addresses in a given format.

One identifier in, one reconciled view out: runs an email, username, phone or domain across the OSINT APIs you hold keys for (OSI, Dehashed, Opsis) and merges results with per-source attribution.

Certificate Transparency log search. Find every TLS certificate issued for a domain, which reveals subdomains, internal hostnames and related organizations.

Startup and private-company intelligence covering funding rounds, investors, acquisitions, key people and employee counts.

German telephone directory with name, address, and reverse phone search (Rückwärtssuche).

Searchable breach database that queries by email, username, name, IP, phone, address, or password hash and returns raw leaked records.

Public directory of Discord servers searchable by tag, language and keyword. Useful for finding communities around a topic or group.

Resolves a Discord user ID (snowflake) to username, avatar, banner and account creation date.

Free domain research tool from HackerTarget that maps DNS records, subdomains, hosts and mail servers from passive sources and draws a network graph.

Multi-purpose DNS toolkit for bulk resolving, record querying, wildcard filtering and subdomain brute-forcing.

MuckRock's platform for uploading, OCR-ing, annotating and searching primary-source documents. Hosts millions of public newsroom documents.

Free WHOIS lookup with hosting history and reverse IP hints. The paid Iris platform adds historical WHOIS, reverse WHOIS and infrastructure pivoting.

Official UK service that returns make, colour, tax and MOT status, engine size and first-registration date for any UK registration number.

Email verification service that checks syntax, domain, mailbox existence, and disposable-provider status. Has a limited free tier.

Recovers partial phone digits from the password-reset pages of services and builds candidate full numbers.

Reputation API for email addresses that reports age, breach exposure, social profiles, disposable/free provider status, and suspicious activity flags.

Web lookup for an email or phone that shows the linked Google account (name, photo, Maps reviews) and registrations on dozens of services.

Free public database of ship safety information by IMO number. Registered owner, ship manager, flag history, classification society and port-state inspection records.

Archive of every published version of Esri's World Imagery basemap since 2014. Compare high-resolution satellite snapshots side by side to see when local changes happened.

The standard Ethereum block explorer for addresses, transactions, tokens, smart contracts and public name tags on labeled wallets.

Interactive map and search of all EU restrictive measures by country regime, with listed persons and entities.

The reference command-line tool for reading, writing and stripping metadata (EXIF, IPTC, XMP, GPS, maker notes) in images, video, audio and documents. Supports hundreds of formats.

TikTok analytics platform showing account growth history, video performance, hashtag trends and audience estimates.

Official US registry lookup by N-number, serial number or owner name. Returns aircraft make/model, registered owner name and address, and the Mode S hex code.

Face search engine focused on social media, news, mugshot and scammer-profile sources. Commonly used to vet romance-scam and catfish profiles.

Free genealogy database of billions of historical records (census, birth, marriage, death, immigration), useful for building family trees and finding relatives.

Free US people finder with reverse phone and address search, address history, associated names, and relatives.

US Federal Election Commission data on individual contributions, PACs, candidates and committee spending. Search donors by name, employer or ZIP.

Full-text search across subtitles of over a billion YouTube videos, linking straight to the timestamp where a phrase is spoken.

Flight tracking with strong flight-history and airport-activity data, tail-number searches and historical route logs.

The most popular live flight tracker. Real-time positions, aircraft details, photos and route history. Paid tiers unlock longer playback history and more data.

Windows tool that finds documents published on a domain, downloads them and extracts metadata such as usernames, software, printers and internal paths.

Cyberspace mapping search engine with rich fingerprinting (icon hash, cert, header, body). Strong coverage of Asian and Chinese hosts.

Free browser-based photo forensics suite. Clone detection, error level analysis, noise analysis, magnifier, luminance gradient and metadata/geotag extraction. Processing happens client-side.

Online image forensics. Error Level Analysis (ELA), metadata, JPEG quality estimation and hidden-pixel checks, with a good set of tutorials on interpreting the results.

Returns the current carrier and mobile/landline/VoIP type for a number, plus the carrier's email-to-SMS gateway address.

Fetches known URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and urlscan in one command.

AI photo geolocation that predicts where an image was taken from its visual content alone (architecture, vegetation, road features) and returns candidate regions or coordinates.

Offensive Google framework that pulls the Gaia ID, profile photo, Maps reviews, public calendar, and linked services from a Gmail or Google Workspace address.

Global Legal Entity Identifier index. Resolves LEIs to legal entities and shows direct and ultimate parent relationships.

Free map of vessel activity built from AIS, satellite radar and night-light detections. Reveals fishing effort, encounters between vessels, loitering and AIS-dark ships.

3D globe with high-resolution satellite imagery, 3D buildings and terrain. The desktop Pro version adds historical imagery, which you need for change-over-time analysis.

Google's visual search. Matches objects, landmarks, text, products and visually similar images across Google's index; also does OCR and translation of text inside images.

Headless-Chrome screenshot tool for large lists of URLs, with a local web UI to triage results and track changes.

Fast regex search across half a million public GitHub repos. Find leaked config, internal hostnames, emails or API endpoints mentioning a target.

Tells you whether an IP is mass-scanning the internet or belongs to a benign service (search engines, researchers), so you can separate background noise from targeted activity.

CLI that hunts for an email's breach exposure across multiple APIs (HIBP, DeHashed, Snusbase, IntelX, etc.) and local breach compilations.

Troy Hunt's free breach-notification service. Lists which known data breaches and pastes include an email address or phone number, but does not show passwords.

Checks whether a phone number or email appears in the 2021 Facebook scrape of 533M users, which links numbers to Facebook IDs and names.

Computes the visible horizon and viewshed from any point using elevation data, and labels the peaks you'd see. Helps confirm what's visible from a claimed location.

Official title register and plans for properties in England and Wales, showing registered owner, price paid and charges. Small fee per document.

Domain data API and lookup showing backlinks, redirects, co-hosted domains, and domains sharing the same analytics or tracking IDs.

HTTP probing toolkit that checks which hosts are live and grabs titles, status codes, tech stack, TLS details and favicon hashes in bulk.

Free tools that check whether an email, username, or domain appears in infostealer-malware logs, with infection date and the compromised machine's details.

Finds professional email addresses for a company domain, infers the address pattern (e.g. first.last@), and verifies deliverability.

BGP and ASN explorer covering prefixes announced by an ASN, peers, upstreams, IRR records and organization search across registries.

Official ICANN registration data lookup for domains, using RDAP with WHOIS fallback. Shows the registrar, key dates, nameservers and status codes.

Searchable entities, officers and intermediaries from the Panama Papers, Paradise Papers, Pandora Papers and other offshore leaks.

Free name and username search that groups matching social media profiles, photos, and websites by person.

International directory of people and business phone listings across many countries, with reverse search where local law allows.

Bellingcat tool that finds Instagram location IDs near a latitude/longitude so you can browse posts geotagged at a place.

Downloads Instagram posts, stories, highlights, captions, comments and geotags for profiles or hashtags, saving metadata as JSON.

Browser-based checker that streams username availability results across 100+ social sites as you type.

Search engine and archive of leaks, pastes, dark-web pages, and historical data. Supports email, domain, IP, CIDR, URL, and crypto address selectors.

Browser extension (the "verification Swiss army knife") for checking images and video. Keyframe extraction, multi-engine reverse search, magnifier, metadata, forensic filters and video context lookups.

IP address intelligence covering geolocation, ASN, company, hosting/VPN/proxy detection and abuse contacts. Also has reverse IP and ranges per ASN.

Free email check from IPQualityScore that returns validity, disposable/abuse flags, leak status, and a fraud score.

Free phone check that returns validity, carrier, line type, VoIP/prepaid flags, and fraud and spam risk scoring.

Free full-text search engine over hundreds of millions of US court case records, including many state and county courts.

Open, crowdsourced street-level imagery (formerly OpenStreetCam). A useful second source when Street View and Mapillary coverage is thin.

Breach data search engine with a free check of which breaches contain a selector, and paid access to the full records.

Breach search by email, username, phone, or domain that shows breach sources and dates. Paid plans include leaked fields such as passwords.

Search engine focused on exposed services and leaks, such as open databases, exposed .git and .env files, and misconfigured services, indexed by IP and domain.

Logs into LinkedIn and scrapes a company's employee list, then writes username lists in common formats (first.last, flast, etc.).

Crowdsourced "who-knows-who" database of power networks linking executives, politicians, lobbyists, donors and organizations.

Finds the numeric Facebook ID of a profile, page or group from its URL, which advanced search tools need.

Sherlock fork covering 3,000+ sites that also parses found profiles for names, links and other usernames, then recursively searches those and builds HTML/PDF reports.

Graph-based link-analysis platform. Run "transforms" against entities (people, domains, emails, companies) to pull data from dozens of integrated sources.

Crowd size estimator. Draw the area a crowd occupies on a map, set a density per square metre, and get a defensible estimate of attendance.

Crowdsourced street-level imagery platform with billions of images, often covering roads, trails and countries that Google Street View doesn't reach. Filterable by capture date.

The best-known AIS ship-tracking platform. Live vessel positions, port calls, vessel particulars and photos. Historical tracks require a paid plan.

Open-source Bitcoin explorer and mempool visualizer. Look up addresses, transactions and blocks, or self-host to avoid leaking queries.

Official searchable archive of ads running on Facebook, Instagram and Messenger, with page transparency data (admin countries, name changes) and political ad spend.

CLI that uses Google dorks to find public documents (pdf, doc, xls, ppt) on a target domain and downloads them for metadata analysis.

Nonprofit platform to file, track and share public-records (FOIA) requests, with a searchable archive of released documents.

Web-based username availability checker across dozens of social networks plus domain names. A quick browser-only first look.

Fire Information for Resource Management System. Near-real-time active fire and thermal anomaly detections from MODIS and VIIRS satellites, with an archive going back years.

Hosting history, netblock owner, nameserver, SSL and technology report for any site. Netcraft has tracked hosting since the 1990s.

Internet scan search engine covering hosts, DNS, WHOIS and certificates, with an attack surface discovery graph and a generous free tier.

Lightweight Python tool that finds profiles by username across 350+ sites in a few seconds using async requests.

Official US government VIN decoder. Returns manufacturer, model, year, body type, engine and plant information for a 17-character VIN. Free API available.

European company search built on registry publications. Officers, financials, ownership history and network graphs, strongest for DE, AT, CH and neighbors.

Free US reverse phone lookup that returns the owner name, carrier, and line type when available.

OCCRP's searchable archive of leaks, company registries, court records and gazettes used in cross-border investigative journalism.

US Treasury search of the SDN and consolidated sanctions lists, including listed digital currency addresses and vessel identifiers.

Python CLI that queries many onion search engines at once and exports the deduplicated .onion URLs to CSV.

Map of the world's power lines, substations, power plants, telecoms towers, pipelines and water infrastructure, built from OpenStreetMap data.

The largest open database of cell tower locations. Look up a tower by MCC/MNC/LAC/Cell ID to get its approximate coordinates and coverage area.

Largest open database of companies, with 200M+ entities from 140+ jurisdictions. Search by company name, registration number or officer name.

Consolidated database of sanctioned entities, politically exposed persons (PEPs) and criminal-interest targets, merged from hundreds of official sources.

Non-profit research network collecting ADS-B and Mode S data. Free live map plus historical flight data access for researchers through its API and database.

Browser-based OSINT search across 700+ modules. 400+ username platform checks, 330+ email enrichment modules, plus WHOIS, DNS and reverse-WHOIS for domains.

Commercial real-time lookup of an email, phone, or username across hundreds of modules, with linked accounts, names, photos, and a timeline view.

Web IDE for querying OpenStreetMap data. Find every place matching a feature combination (e.g. a church next to a rail line within 200 m of a river) to narrow down where a photo was taken.

In-depth attack surface mapping and subdomain discovery. Combines passive sources with optional DNS brute-forcing, permutations and ASN or netblock expansion.

Official US federal court electronic records for district, bankruptcy and appellate cases. Paid per page, with fees waived under $30 per quarter.

French phone directory covering businesses and private listings (PagesBlanches), with reverse number search.

3D mountain panoramas that label peaks for any viewpoint. Match a skyline in a photo to rendered terrain to geolocate outdoor images.

People search that links names and usernames to social media profiles, websites, and basic contact info.

Community database of networks, data centers and internet exchanges. Shows where an ASN physically peers and who operates it.

Free US people search by name, phone, or address, with age, addresses, and relatives.

Intelligence X-powered search that lists email addresses, subdomains, and URLs seen for a given domain.

Phone-number recon framework that parses country, carrier, and line type, then runs Google dorks and checks number-reputation sources. Comes with a web UI.

Anonymous Instagram viewer for browsing public profiles, posts, stories and tags without logging in or alerting the account.

Facial recognition search engine that finds other photos of the same face across the open web. Free searches show blurred results; a subscription unlocks source links.

Enterprise identity-resolution search that links emails, phones, usernames, and names into person profiles from deep-web sources. Business accounts only.

Planet Labs' imagery platform, with near-daily 3-5 m PlanetScope coverage of the whole Earth and high-res SkySat tasking. Access is commercial, though research and NGO programs exist.

Crowdsourced database of photographed licence plates from dozens of countries. Search a plate to find photos of the vehicle, often with a location and date.

Public directory of Bluesky/AT Protocol DIDs with a full audit log of each account's handle changes, PDS hosts and creation date.

Search US tax-exempt organizations and read their IRS Form 990 filings, including executive pay, revenue and full-text search of filings.

Source code search engine for web pages. Find every site containing a given snippet, analytics ID, script, or keyword in its HTML, JS or CSS.

Free Pushshift-compatible API and search interface for historical Reddit submissions and comments.

Free threat intel platform that enriches IPs, domains and URLs with risk scores, linked threats, feeds and WHOIS/DNS context.

People and property aggregator with profiles combining addresses, phones, employment, court records, and social links. US focus, with some international coverage.

RDAP bootstrap redirector that sends a query for any domain, IP or ASN to the authoritative registry's RDAP server and returns structured JSON.

Metasploit-style modular reconnaissance framework in Python, with a marketplace of modules and a built-in workspace database and reporting.

Profiles a Reddit user's activity, showing top subreddits, posting times by hour and day, word clouds and self-disclosed facts pulled from their comments.

Free US/Canada reverse phone lookup that shows the registered name and carrier details.

Shows removed and deleted Reddit comments and posts for a user, subreddit or thread by comparing live data with archives.

RIPE NCC's analysis platform for IPs, prefixes, ASNs and countries, covering routing history, registration, reverse DNS and geolocation, with a full data API.

AI-assisted dark web OSINT tool. It refines your query with an LLM, searches multiple onion engines, scrapes results and writes a summary report.

DNS and IP relationship lookup covering forward and reverse DNS, shared nameservers and mail servers, ASN data and graphs of related hosts.

Global database of reported scammer emails, phones, usernames, and crypto addresses submitted by victims and researchers.

Source code search engine indexing code from GitHub, GitLab, Bitbucket and other forges. It complements grep.app with broader coverage beyond GitHub.

Free US people search with address history, phones, emails, and relatives. Useful for cross-checking other broker sites.

Full-text search of US SEC filings (10-K, 8-K, S-1, Form 4 insider trades, 13F) since 2001 for all public companies and many funds.

Historical DNS records, subdomains, associated domains and reverse lookups by IP, nameserver or mail server, from a very large passive DNS dataset.

Browse free Sentinel-1/2/3/5P, Landsat and MODIS imagery by date. False-colour, NDVI and SAR visualisations, timelapses and comparison tools.

Bellingcat tool that takes an object's height, its shadow length and a date/time, and plots every location on Earth where that shadow ratio was possible.

CLI that checks a username across 400+ social networks and sites and outputs the URLs where an account with that name exists.

Open-source desktop toolkit for digital image forensics. Bundles ELA, noise and JPEG ghost analysis, clone detection, PCA, metadata and many other analyses in one GUI.

Search engine for internet-connected devices. Query banners, open ports, SSL certs, favicons and vulnerabilities across the IPv4 space.

Search engine of email addresses indexed from the web. Enter a domain to list addresses and the pages where they appeared.

Public map of Snapchat stories submitted by location, viewable in a browser without an account. Good for live, on-the-ground footage of events.

Paid breach search engine with a large indexed corpus, searchable by email, username, name, IP, password, or hash, with hash lookup.

Searches a username across 1,000+ sites and scores each hit with a detection rating, extracting profile metadata. Available as CLI, web UI and Python/Node library.

Historical follower, view and upload statistics for YouTube, TikTok, Instagram, X and Twitch accounts, including daily growth charts.

Paid identity-verification search by name, email, phone, username, or image, aimed at romance-scam and catfish investigations.

Real-time social mention search across Reddit, YouTube, Tumblr, the web and more, with sentiment and per-network breakdowns.

Checks whether a username or email is registered on major platforms (Instagram, X, GitHub, Snapchat, etc.) using signup/reset endpoints for accurate results.

Solana block explorer for accounts, token transfers, NFTs, DeFi activity and program interactions.

OSINT automation framework with 200+ modules. Give it a domain, IP, email, name or username and it recursively correlates findings in a web UI.

Paid US people search with strong email and username to person matching and social profile aggregation.

Free US reverse lookup for phone numbers, names, addresses, and emails. Historically it could also play a number's voicemail greeting.

Converts Steam vanity URLs, profile links and IDs to all SteamID formats (SteamID, SteamID3, SteamID64) and shows profile status and creation date.

Fast passive subdomain enumeration CLI that aggregates dozens of sources (CT logs, passive DNS, search engines) without touching the target.

Shows the sun's position, azimuth, elevation and shadow length for any location, date and time on a map. A core tool for chronolocating photos and video.

Caller-ID and spam-blocking service with a web reverse phone search that returns crowdsourced names and sometimes profile photos.

Python tool that downloads messages and metadata from Telegram channels and builds a network of connected channels from forwards for graph analysis.

Telegram analytics and search engine covering millions of channels, with post search, audience growth, ad mentions and channel lookups.

CLI that archives Telegram chats and channels, collects member lists, maps forwards between channels and finds users near a location.

Telegram channel and chat catalog with subscriber growth, post search, citation and mention tracking. Strongest coverage of Russian- and CIS-language channels.

Free US lookup by name, address, phone, email, IP, or VIN that returns linked identities and contact details.

Collects emails, subdomains, hosts, employee names and IPs for a domain from search engines, PGP servers, certificate logs and APIs.

abuse.ch database of malware IOCs (C2 IPs, domains, URLs, hashes) tagged by malware family, free to search and export.

OSINT Combine tool that searches TikTok by username, hashtag or keyword and builds direct links for profiles and videos without the app.

Exact-match reverse image search engine. Finds copies, crops and edits of an image, and can sort results by oldest first to trace an image back to its earliest appearance.

Open-source dark web crawler that maps links from an onion site, gathers page info and can save results as JSON or a tree.

Extracts details from a Telegram bot token and chat ID, such as bot name, owner, chats and invite links. Useful for investigating phishing kits and malware that exfiltrate data to Telegram.

Extracts Instagram account details such as user ID, full name, bio and obfuscated email/phone hints from a username using a session ID.

Official TRON block explorer. Essential for tracing USDT-TRC20 flows, which are common in scams and illicit finance.

Crowdsourced caller-ID database that often returns the name a number is saved under in other people's contacts. Strong coverage in India, MENA, and Africa.

Free US people search by name, phone, or address. Returns age, current and past addresses, phone numbers, emails, and possible relatives.

Paid US background reports that aggregate public records, contact details, criminal history, and social media.

Converts an X/Twitter handle to its permanent numeric user ID and back.

Twitch channel statistics including stream history with dates, durations, games played, viewer counts and follower growth.

Python library and CLI that scrapes X search results, profiles, followers and tweets through the GraphQL API using a pool of logged-in accounts.

Official UK company register. Free filings, accounts, officers, persons with significant control (PSC) and charges for every UK company.

UK people and address search using the electoral roll, with free previews and paid full records.

abuse.ch database of URLs used for malware distribution, searchable by URL, host, hash or tag, with downloadable feeds.

Sandbox that loads a URL and records the requests, IPs, domains, screenshots and DOM. Its search across millions of past scans is a pivot goldmine.

Official source for US federal spending. Search contracts, grants and loans by recipient, agency or location.

US Geological Survey portal for searching and downloading Landsat imagery back to 1972, declassified spy-satellite photos (CORONA), aerial photography and elevation data.

Free US reverse phone and people lookup that returns owner names, addresses, and related numbers.

Free SMTP-level check of whether a mailbox exists, without sending an email.

Free AIS vessel tracker with ship search by name, IMO or MMSI, plus vessel particulars, photos and recent port calls. A good alternative to MarineTraffic.

Swiss-army collection of DNS tools including reverse IP, reverse WHOIS, IP history, DNS records, reverse MX/NS and port checks.

Scans files, URLs, domains and IPs against 70+ engines. The relations graph shows passive DNS, communicating files, subdomains and historical WHOIS.

Guesses and verifies a person's work email from their name and company domain.

Bitcoin explorer that clusters addresses into wallets with common-input heuristics and labels many exchanges, services and darknet markets.

Browser extension and lookup service that identifies technologies on websites, such as frameworks, CMS, analytics, CDNs and e-commerce platforms.

Internet Archive's archive of 900B+ web page captures since 1996. View past versions of sites, list every archived URL for a domain, and save pages on demand.

Retrieves archived tweets for a handle from the Wayback Machine CDX API, including deleted posts, with CSV/JSON/HTML export and a web app.

Pulls every URL the Wayback Machine knows for a domain into stdout. Good for finding old endpoints, files and parameters.

Name search that gathers a person's web presence from news, social networks, and websites into one page, with a web-visibility score.

Web app and community-maintained JSON dataset of 600+ site checks for username enumeration; the dataset powers many other tools.

Major US directory for name, phone, and address lookups. Free previews, with full reports and background checks behind a paywall.

Quick, ad-light WHOIS and DNS record lookup for domains, with raw registry output.

Builds Facebook keyword searches filtered by date range and a profile's numeric ID, recovering search options Facebook removed from its UI.

WHOIS lookup with cheap historical WHOIS and reverse WHOIS by registrant name, email, company or keyword.

Crowdsourced database of hundreds of millions of geolocated Wi-Fi networks, Bluetooth devices and cell towers. Search by SSID or BSSID to map where a network has been seen.

Collaborative map where users outline and describe places, including military sites, factories and buildings that are often unlabeled on mainstream maps. Strong coverage of the former USSR.

Native X search form supporting from:, to:, since:/until:, min_faves:, filter:media and geocode operators to find specific posts.

Looks up an Xbox gamertag and shows its avatar, gamerscore, recently played games and gaming history.

Yandex reverse image search. Historically the strongest engine for matching faces, buildings and scenery, especially for content from Russia, Eastern Europe and Central Asia.

Searches YouTube for videos geotagged within a radius of a location, filterable by date and keyword, with map view and CSV export.

Shows a YouTube video's or channel's exact upload time, tags, geolocation, licensing and thumbnails, plus links for reverse-searching the thumbnails.

Command-line downloader for video and audio from YouTube and over a thousand other sites. Preserves metadata, subtitles, thumbnails and comments for archiving and evidence.

Long-running free US people search that shows name, partial address history, and birth year, with paid upsells.

Official Swiss central business name index. Search all companies entered in cantonal commercial registers and their SOGC publications.

Chinese cyberspace search engine (Knownsec) that indexes devices and web services. Often has coverage of Asian infrastructure that Shodan misses.