Open Source Intelligence (OSINT) is the collection and analysis of publicly available information. Security teams and investigators use it for threat assessments, attribution, and cyber reconnaissance. OSINT tools automate this process. Without them, the same research takes weeks across dozens of fragmented sources.
The scale of the problem makes dedicated tooling essential. The OSINT market stood at USD 18.20 billion in 2025 and is projected to reach USD 43.49 billion by 2031. Public data is now one of the most valuable and underutilized intelligence sources. Both investigators and threat actors know it.
Cyber investigators use OSINT tools for a wide range of tasks. Common tasks include mapping exposed infrastructure. Teams also trace threat actor connections across platforms. They identify leaked credentials and understand what technologies a target website runs. Reconstructing digital footprints from public records is another core use case.
In this article, we’ll discuss some OSINT tools that cover the most important use cases in active cyber investigation work.
Censys
Censys describes itself as “the authority for Internet intelligence and insights.” It continuously scans every public IPv4 address and popular domain name and indexes all results to make them searchable through a structured query interface. Its data has been used in hundreds of scientific papers by researchers worldwide.
For cyber investigation, the use case is simple. Find everything connected to a target that is visible on the public internet. Censys surfaces exposed services, open ports, and certificate relationships. It also finds misconfigured infrastructure that the target may not know is publicly discoverable.
It also powers attack surface management (ASM) for enterprises. The same data that investigators use offensively is what security teams use defensively. Censys integrates with SIEM platforms and vulnerability management tools through its API.
Key investigation uses:
- Discovering exposed services tied to a domain or IP range
- Finding subdomains through certificate transparency logs
- Correlating IP infrastructure to identify hosting relationships between domains
- Tracking CVE exposure across an organization’s internet-facing assets
NexVision
NexVision takes a different approach from most tools in this list. Its engine platform monitors the surface web, deep web, and dark web simultaneously in real time and indexes 120,000+ new Tor sites daily. Access works through standard browsers like Chrome and Safari without requiring a Tor browser. That matters for investigators who need dark web visibility without running Tor directly.
The OSINT360 module accepts any digital entity as a starting point, such as an email address, IP, domain, username, phone number, or crypto wallet. It queries 350+ data sources simultaneously. These include passive DNS, breach databases, dark web indexes, social platforms, and blockchain explorers.
NexVision includes natural language processing and steganography-decoding capabilities. These help surface information that threat actors hide using jargon or embedded data in files.
Key investigation uses:
- Dark web monitoring for leaked credentials, threat actor activity, or mentions of target organizations
- Person of interest profiling from fragmented public records and social data
- Financial crime investigation through crypto wallet tracing and sanctions list cross-referencing
- Real-time alerting when target keywords appear across monitored sources
OSINT Framework
OSINT Framework is a resource, not a tool. It is a community-maintained directory of OSINT tools that are organized into different categories. Categories include usernames, email addresses, domain names, IP addresses, images, social networks, geolocation, and more.
If an investigation needs a capability outside your main toolset, OSINT Framework is the place to look first. Each node links to a tool with a brief description of what it does. The depth of coverage is considerable. The categorization makes it far faster to find niche tools than searching generically.
Treat it as a map of the OSINT ecosystem rather than a standalone investigation platform.
Shodan
Shodan calls itself the search engine for the Internet of Things, and the description is accurate. Google indexes web pages, whereas Shodan indexes devices. That includes servers, routers, webcams, industrial control systems, building management systems, and exposed databases. Anything connected to the public internet with an open port is in scope.
For investigators, Shodan answers questions that normal search engines cannot. What version of Apache is running on an IP? Which organizations have Elasticsearch instances open without authentication? Which IP ranges belong to a specific autonomous system? The query language supports filters by country, organization, port, product, version, and operating system.
Key investigation uses:
- Identifying internet-exposed services belonging to a target organization
- Finding misconfigured or unpatched infrastructure by product and version
- Mapping IoT and ICS device exposure by geography or organization
- Pivoting from an IP to related infrastructure using shared service banners
Maltego
Maltego describes itself as the most widely used OSINT investigation platform in the world. Its core capability is visual link analysis. Investigators build graphs that map relationships between people, email addresses, domains, IP addresses, social accounts, and infrastructure.
What separates Maltego from raw data tools is the ability to run Transforms. A Transform is an automated enrichment step that takes an entity such as a domain name, queries connected data sources, and returns related entities, including the IP it resolves to, the certificate it uses, and the registering organization. Investigators chain Transforms together to build investigative graphs without manual lookups.
The platform now includes Maltego Graph (desktop and browser), Maltego Search, Maltego Monitor, and Maltego Evidence. Together, they cover the full lifecycle of digital investigations. Law enforcement agencies, financial crime teams, and corporate security teams use it globally.
Key investigation uses:
- Person of interest investigations linking digital identities across platforms
- Cybercrime investigations mapping threat actor infrastructure
- Corporate due diligence and beneficial ownership research
- Dark web and breach data correlation through integrated data sources
theHarvester
theHarvester is a command-line reconnaissance tool for the early stages of a penetration test or red team engagement. It maps a domain’s external threat landscape. It pulls names, email addresses, IP addresses, subdomains, and URLs from public data sources.
A single run aggregates results from Google, Bing, DuckDuckGo, Brave, LinkedIn, Shodan, Censys, Certificate Transparency logs, and more. API keys extend access to additional sources, such as BeVigil, CriminalIP, ProjectDiscovery, and others.
theHarvester requires Python 3.12 or higher and is actively maintained on GitHub. It is included by default in Kali Linux and ParrotOS. That inclusion reflects how embedded it has become in standard security workflows.
At the start of an engagement, it answers one question: what publicly visible assets belong to this domain? That answer shapes everything that follows.
Key investigation uses:
- Enumerating email addresses associated with a domain for phishing investigation or attribution
- Subdomain discovery to map the attack surface before deeper scanning
- Identifying employee names and roles from public sources
- Cross-referencing discovered infrastructure against threat intelligence feeds
Mitaka
Anyone who has investigated indicators of compromise (IOCs) from threat reports or paste sites knows the friction. Copying hashes, IPs, domains, and URLs into multiple tools one at a time is slow and error-prone. Mitaka removes that friction.
Mitaka is a browser extension for Chrome and Firefox. It adds right-click context menus to any selected text on a webpage. Highlight an IP address, hash, email, domain, or Bitcoin address. Mitaka immediately offers to look it up across 65+ platforms. These include VirusTotal, Shodan, Censys, Urlscan.io, HybridAnalysis, and AlienVault OTX. Each service can be enabled or disabled from the options page.
The extension sits at the intersection of speed and coverage. Spotting an indicator and querying it immediately saves real time. That speed advantage compounds across a long investigation.
Key investigation uses:
- Rapid IOC triage directly from threat reports, paste sites, or malware analysis tools
- Simultaneous lookup of file hashes, IPs, domains, and URLs across multiple threat intel platforms
- Bitcoin address investigation without manual platform navigation
- CVE cross-referencing during vulnerability research
BuiltWith
BuiltWith has profiled website technology stacks since 2007. It now covers 370+ million active domains and tracks 114,000+ web technologies. Every lookup returns a detailed breakdown of what a target is running. That includes CMS platforms, analytics tools, CDN providers, payment processors, and JavaScript frameworks.
For cyber investigation, the value is in the intelligence it reveals about the target infrastructure. Knowing what CMS version a site runs reveals exploitable vulnerabilities. Knowing the CDN or analytics tools in use reveals infrastructure relationships. None of that is visible from the domain alone.
BuiltWith also tracks technology history, which is where the investigative depth becomes significant. You can see what a site looked like six months ago, when it changed, and what replaced it. That historical view reveals infrastructure changes, hosting moves, and technology adoptions that can be pivotal in reconstructing timelines.
The platform processes at least 8.1 billion GET requests per month to maintain current data.
Key investigation uses:
- Identifying attack surface components for a target organization’s web infrastructure
- Tracking hosting and CDN relationships to map infrastructure shared across domains
- Reconstructing technology timelines to identify when specific tools were deployed
- Discovering related infrastructure through shared analytics IDs or advertising tags
Intelligence X
Intelligence X is a search engine and data archive. It indexes data types most OSINT platforms skip. That includes Tor hidden services, I2P networks, paste sites, and data leaks. It also covers web pages deleted from the public web but archived before removal.
The platform describes its mission as quality over quantity. As of the latest published figures from its own blog, it holds over 25 billion indexed records. Searches run against email addresses, domains, IP addresses, CIDR ranges, Bitcoin addresses, and URLs. Results return the actual documents, such as breach records, paste files, PDFs, and dark web content. Not just a confirmation that a record exists.
Key investigation uses:
- Breach data lookup returning full records, including email-password combinations, for incident response and credential exposure assessment
- Dark web content search for threat actor communications, marketplaces, and leaked organizational data
- Historical domain and WHOIS research using records from before privacy shields were applied
- Bitcoin address tracing across leaks and dark web sources for financial crime investigation
Trace Labs
Trace Labs occupies a unique position in the OSINT community. It runs OSINT “Capture The Flag” competitions focused on real missing persons cases. Participants gather publicly available intelligence and submit findings. Those findings go directly to law enforcement.
It is included here because it shows how OSINT skills apply beyond corporate security. Its training resources, including the Trace Labs OSINT VM and public CTF events, are widely used for building practical skills.
For investigators who want real-world practice, Trace Labs provides a structured environment with professional oversight. The community also maintains resources and training materials relevant to person-of-interest investigations.
Final Words
Modern cyber investigation relies heavily on automated OSINT tools to keep pace with threat actors. However, tools are only as powerful as the analytical mind behind them. Platforms like the OSINT Framework offer an incredible map of the landscape, while initiatives like Trace Labs prove that these exact same crowd-sourced intelligence skills have vital, real-world utility beyond corporate networks.
Master a mix of infrastructure scanning, passive DNS mapping, and credential triage to ensure your investigative workflows remain sharp, fast, and comprehensive.
