OSINT tools directory
Free OSINT tools, organized by target
OSINT tools are websites and programs that collect publicly available information about a person, username, domain, place, aircraft, vessel or company. New to the field? Start with what OSINT is and the OSINT framework workflow. This list groups widely used free resources by what you are investigating, with a pivot tip for each step. Subscribers get 475+ tools inside the Cylect workspace with an AI analyst that picks the right ones.
Search & archives
Start broad: operators, cached pages and archived copies reveal what a target published before.
Usernames & identity (SOCMINT)
Enumerate a handle across platforms, then pivot on reused avatars, bios and linked emails.
Domains & infrastructure
Certificates, DNS history and registration data link domains to shared hosting and owners.
crt.sh
Domain
Certificate transparency logs reveal subdomains.
ICANN Lookup
Domain
Official registration (RDAP/WHOIS) data.
DNSDumpster
Domain
DNS records and host mapping.
Shodan
IP / service
Internet-exposed devices and banners.
URLScan
URL
Safe page scans with requests and screenshots.
PeeringDB
Network / ASN
Internet exchanges and network interconnection.
Geospatial & satellite (GEOINT)
Verify where an image was taken and what changed on the ground over time.
Aircraft, ships & transport
Correlate transponder tracks with time and place to confirm movements.
Hazards & situational awareness
Layer disasters, fires and outages to explain events in a region.
Companies & public records
Officers, filings and sanctions lists connect people to organizations.
See it all on one live map
Cylect puts flights, ships, FAA TFRs, fires, earthquakes, outages and 30,000+ road cameras on one globe, and the AI analyst (or your own local model) chooses tools for each pivot.