OSINT Tools
This article is a reference catalogue of widely used open-source intelligence tools. The tools listed automate or accelerate one or more phases of the intelligence cycle — chiefly collection and processing — but none of them performs analysis in the human sense. A guiding principle throughout OSINT practice is that tools assist, they do not replace, the analyst's judgement: a collector can find a username on four hundred sites, but only the investigator can decide which matches are the same person and what that means for the case. The catalogue below is organised first as a comparison table and then as prose describing the main categories.
1 Comparison table
| Tool | Category | What it does | URL |
|---|---|---|---|
| Maltego | Link analysis | Graphs relationships between entities (people, domains, emails, companies) using automated "transforms" that pull and connect data. | maltego.com |
| SpiderFoot | Automated recon | Runs automated reconnaissance against a target across 200+ data sources, aggregating results into a single graph. | github.com/smicallef/spiderfoot |
| theHarvester | Domain / email recon | Gathers emails, subdomains, hostnames and names from 40+ public sources. | github.com/laramies/theHarvester |
| Shodan | Infrastructure | Search engine for internet-connected devices and services; finds exposed servers, cameras, industrial systems. | shodan.io |
| Epieos | Email / phone lookup | Silent lookup of an email or phone number, surfacing a linked Google account, Maps reviews and connected services without alerting the target. | epieos.com |
| Sherlock | Username enumeration | Hunts a username across 400+ social and web platforms to map an individual's online footprint. | github.com/sherlock-project/sherlock |
| Google Images | Reverse image | General reverse-image search; broad coverage, good for common objects and web-published photos. | images.google.com |
| Yandex Images | Reverse image | Reverse-image search widely regarded as strongest for faces and places. | yandex.com/images |
| TinEye | Reverse image | Reverse-image search specialised in finding the earliest / original source of an image. | tineye.com |
| Wayback Machine | Archives | Serves historical snapshots of web pages, preserving content that has since changed or been deleted. | web.archive.org |
| Chainalysis | Crypto tracing | Market-leading blockchain analytics (Reactor, KYT). See Cryptocurrency Tracing. | chainalysis.com |
| Elliptic | Crypto tracing | UK-based blockchain analytics and wallet screening. See Cryptocurrency Tracing. | elliptic.co |
| TRM Labs | Crypto tracing | Blockchain intelligence for compliance and investigation. See Cryptocurrency Tracing. | trmlabs.com |
2 People and identity search
People-search tooling maps an individual's presence across the internet from a single seed identifier — a name, email, phone number or username. Sherlock takes a username and checks hundreds of platforms for an account of the same handle, quickly sketching a subject's online footprint; because handle reuse is common but not universal, its output is a set of candidates the analyst must still confirm. Epieos works from an email address or phone number and silently reveals connected services — notably a linked Google account and any Google Maps reviews — without contacting or alerting the target, which keeps the enquiry firmly on the passive side of the passive/active line. In fraud work these tools help attribute anonymous accounts, connect a suspect to a shell company's registration contact, or corroborate a whistleblower's identification of a counterparty during fusion.
3 Domain, IP and infrastructure recon
Infrastructure tooling investigates the technical footprint behind a website, email or online scheme. theHarvester aggregates emails, subdomains and hostnames from dozens of public sources, useful for mapping the reach of an organisation or a fraudulent operation. SpiderFoot automates broad reconnaissance against a target across more than two hundred sources and assembles the results into a single graph, functioning as an orchestration layer over many smaller lookups. Shodan, a search engine for internet-connected devices, surfaces exposed servers and services and can reveal the hosting infrastructure common to a cluster of fraudulent sites. Because some infrastructure probing edges toward active interaction with a target's systems, analysts must keep these tools on the lawful side of passive reconnaissance and obtain authorisation before anything more intrusive.
4 Image and geolocation
Reverse-image search establishes where else a photograph appears, when it first surfaced, and where it was taken. The three principal engines have complementary strengths: Google Images offers broad general coverage; Yandex Images is widely regarded as the strongest for faces and places; and TinEye specialises in finding an image's earliest, original source — decisive when testing whether a "recent" photo is in fact recycled. Running the same image through all three is standard practice because each indexes a different slice of the web. Combined with the geolocation and imagery techniques discussed under GEOINT and IMINT, reverse-image search can place a subject at a location and time, exposing false alibis or confirming the setting of an advertisement in a trafficking enquiry.
5 Social media
Social-media monitoring — the discipline of SOCMINT — draws on both purpose-built collectors and the manual review of public profiles. Maltego is frequently the analytical hub here: its "transforms" pull data about people, accounts, domains and organisations and render the relationships as an explorable graph, turning scattered social traces into a visible network. In occupational-fraud cases, public social media can reveal lifestyle inconsistent with declared income — a behavioural red flag — while in trafficking and organised-fraud cases it can expose the connections between actors. All such collection is bounded by platform terms of service and data-protection law, discussed in OSINT ethics.
6 Archives and preservation
Because online content is mutable, preservation tooling is essential to defensible OSINT. The Wayback Machine serves archived snapshots of web pages, allowing an investigator to demonstrate what a page said on a given date even after it has been edited or removed — a capability that supports the evidentiary chain of custody and protects findings against later deletion. Archiving a source at the moment of collection, rather than relying on a live URL that may vanish, is a basic discipline of the processing phase of the intelligence cycle.
7 Cryptocurrency and blockchain
Public blockchains are themselves open sources, and a dedicated class of analytics tools treats the ledger as data to be traced. Chainalysis (with its Reactor investigation and KYT transaction-monitoring products) is the market leader; Elliptic (UK) and TRM Labs are the other major active platforms. These tools cluster addresses, attribute wallets to services, and follow value across the chain. Notably, CipherTrace — once a leading competitor — was acquired by Mastercard in 2021, and Mastercard shut down its key products (Armada, Inspector, Sentry) in March 2024 after the underlying data was called unverifiable and unauditable, leaving it effectively defunct.[1] The methods, tooling and caveats of this area are covered in depth in Cryptocurrency Tracing, which links back to broader asset tracing and money-laundering investigation.
A recurring theme across every category above is that the commercial and open-source landscape is volatile. Tools are acquired, merged, deprecated or shut down — the CipherTrace episode being a prominent example — and free tools frequently change their access terms, introduce rate limits, or disappear when a maintainer moves on. An investigator who anchors a methodology to a single proprietary tool risks being stranded when it changes; the durable skills are the underlying techniques (link analysis, reverse-image search, infrastructure enumeration, archival preservation), which can be re-implemented across whatever tools happen to be available. This is a further reason the discipline insists that tools serve the method, not the reverse.
Selecting and combining tools
No single tool answers a real investigative question. In practice an enquiry chains several together: a username found through Sherlock is enriched by Epieos, cross-referenced against infrastructure surfaced by theHarvester and SpiderFoot, visualised in Maltego, its images run through reverse-image engines, and every source preserved in the Wayback Machine as it is collected. The analyst's skill lies in sequencing these steps under the intelligence cycle and in judging which outputs are reliable enough to act on. Automated aggregation is a convenience, not a conclusion — the same caution that runs through all of OSINT. Whichever tools are used, their operation remains bounded by the legal and ethical limits set out in OSINT ethics, particularly the line between passive and active reconnaissance that some infrastructure and social-collection tools can silently cross.
8 See also
See also: OSINT, Intelligence Cycle, OSINT Disciplines, OSINT Ethics, Cryptocurrency Tracing, Asset Tracing.
References
- Fortune Crypto (2024). "Mastercard shuts down CipherTrace blockchain analytics products." fortune.com
- Basel Institute on Governance. "Quick guide to open-source intelligence (OSINT)." Quick Guide 17, 2020. baselgovernance.org
- Tool project pages, as linked in the comparison table above (Maltego, SpiderFoot, theHarvester, Shodan, Epieos, Sherlock, TinEye, Internet Archive).