OSINT Tools for Domain Analysis
Deeply analyze a domain name: WHOIS registration, DNS history, subdomains, SSL certificates and associated infrastructure. Essential for identifying fraudulent domains or mapping a target.
141 tools · Version française
- aa419 Fake Sites DatabaseVolunteer-maintained database of fraudulent sites, especially fake banks and bogus payment services, with the registration details behind them.free
- AhrefsBacklink and organic traffic analysis. Its free tools estimate a domain's audience and expose the sites that reference it.paid
- AlienVault Open Threat Exchangealso written Alien Vault Open Threat ExchangeCommunity-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.free
- AltDNS (T)also written AltDNS, Alt DNSPermutation-based DNS tool that generates and resolves alternative subdomains from known names.free
- AnalyzeIDalso written Analyze IDReverse lookup service for tracking IDs such as Google Analytics, AdSense, and affiliate identifiers.free
- Aquatone (T)also written AquatoneGo-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.free
- AVG Threat LabsWebsite security analysis tool providing instant safety assessment of sites. Merges quantitative threat detection from 100M AVG users with LinkScanner technology in graphical reports.free
- Azure Tenant ResolutionReveals the Microsoft tenant behind a domain and the other domains attached to it. Exposes an organisation's full perimeter from a single name.free
- Belati (T)also written BelatiOpen-source OSINT data collection and automation framework for gathering information from multiple sources.free
- BeVigilalso written Be VigilSearch engine over mobile applications: extracts the endpoints, subdomains and keys left inside published APKs. Surfaces infrastructure no web scan finds.freemium
- BlackwebOpen-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.free
- BlueCoat WebPulsealso written Blue Coat Web Pulse, BlueCoatWebPulseWeb reputation filtering service rating URLs with 50+ language support. Processes 180+ million rating requests daily with Dynamic Link Analysis for attack injection detection.free
- Bluto (T)also written BlutoRecon utility for domain intelligence including DNS records, email patterns, and infrastructure clues.free
- BuiltWithalso written Built WithTechnology profiling platform that identifies web stacks, frameworks, analytics, and hosting signals.freemium
- Burp Suite (T)also written Burp Suite, BurpSuiteIndustry-standard web application security testing platform for manual and automated vulnerability assessment.freemium
- C99.nlalso written C99Multi-purpose web-based recon toolset covering subdomain finder, reverse IP, whois, phone lookup, port scanner, malware scanner and more — 20+ tools in one.freemium
- Catphish (T)also written CatphishRed team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.free
- CensysInternet-wide scanner and search engine for hosts, certificates, and services.freemium
- certgraph (T)also written certgraphCLI tool that crawls SSL certificates via Certificate Transparency logs to create a directed graph of domain relationships. Supports multiple drivers including crt.sh, Censys, HTTPS, and SMTP.free
- CertKit - Certificate Transparency Log Searchalso written Cert Kit - Certificate Transparency Log Search, CertKit Certificate Transparency Log SearchFast Certificate Transparency log search tool using Clickhouse for sub-second queries. Discover all certificates issued to a domain, including Subject Alternative Names, to reveal hidden infrastructure.free
- CertStreamalso written Cert StreamReal-time certificate transparency log monitoring. Stream newly issued SSL/TLS certificates to discover new domains, phishing sites and infrastructure as they are created.free
- CheckShortURLalso written Check Short URLPreview service for shortened URLs with destination and threat-check context.free
- Cisco Talosalso written CiscoTalosCisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.free
- Cisco Umbrella Popularity ListDomain popularity ranking based on Cisco Umbrella DNS telemetry.free
- ClearWebStats.comalso written Clear Web Stats.com, ClearWebStatsPublic site-statistics index showing traffic and rank snapshots for domains.free
- Criminal IP SearchCyber threat intelligence search engine for exposed assets, domains, vulnerabilities, and risk indicators.freemium
- crt.sh - Certificate Searchalso written crt sh Certificate SearchCT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.free
- Daily DNS ChangesDomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.freemium
- Deteque (R)also written DetequeReal-time IP, domain, and threat intelligence from Spamhaus and abuse.ch alliance. Provides comprehensive malware, botnet, and abuse data with diverse IOC coverage (IPs, domains, URLs, files, cryptos).freemium
- DNS Dumpsteralso written DNSDumpsterFree domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.free
- DNS Recon (T)also written DNS Recon, DNSReconPython-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.free
- DNS Twist (T)also written DNS Twist, DNSTwistDomain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.free
- dnspop (T)also written dnspopDNS reconnaissance utility for enumerating records and identifying domain-related infrastructure.free
- DNSSEC Analyzeralso written DNSSECAnalyzerVerisign's DNSSEC validation tool that checks the DNSSEC chain of trust for a domain.free
- DNSstuffalso written DN SstuffSuite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.free
- DNSTwist en lignealso written DNS Twist en ligneDomain permutation engine for detecting typosquatting, phishing campaigns, and brand impersonation. Generates thousands of variants of a domain name and checks which are registered.free
- dnstwisterWeb-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.freemium
- DNSVizalso written DNS VizDNS and DNSSEC analysis platform that visualizes delegation chains and cryptographic validation paths. Helps diagnose trust and signing issues in domain configurations.free
- Domain Dossieralso written DomainDossierFree web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.free
- Domaincrawler.comalso written DomaincrawlerEnterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.paid
- domainIQalso written domain IQComprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.freemium
- DomainToolsalso written Domain ToolsEnterprise domain intelligence platform. Access historical WHOIS records, DNS history, hosting history, reverse IP lookup and domain risk scoring. Industry standard for domain investigation.paid
- DomainTools Whoisalso written Domain Tools Whois, DomainToolsWhoisEnterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.paid
- easyWhoisalso written easy WhoisFree domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.free
- Email Domain ValidationFree email domain validation tool checking DNS records, MX records, and mail server connectivity.freemium
- EwhoisWeb WHOIS lookup utility for registration, registrar, and nameserver details.free
- EyeWitness (T)also written EyeWitness, Eye WitnessOpen-source tool for automated website screenshotting, service header collection, and default credential identification.free
- Fierce Domain Scanner (T)also written Fierce Domain ScannerDNS reconnaissance tool focused on subdomain discovery and non-contiguous IP space mapping.free
- Follow That PageWebsite monitoring service that checks pages for changes and sends alerts when tracked content updates. Supports keyword-based notifications for focused monitoring.freemium
- FortiGuard Reputation Servicealso written Forti Guard Reputation ServiceFortinet's IP reputation service aggregating malicious source IP data from global threat sensors and collaborators. Blocks botnets, DDoS sources, and IPs associated with phishing, scanning, and malware.free
- FullHuntalso written Full HuntAttack surface management platform that continuously discovers and monitors all internet-facing assets of a target organization — domains, subdomains, IPs, technologies.freemium
- gdns (T)also written gdnsGoogle DNS-focused command-line tool for DNS lookup and domain record exploration.free
- Gobuster (T)also written GobusterMulti-mode brute-force tool for DNS subdomain, virtual host, and directory discovery.free
- Google Safe BrowsingGoogle's phishing and malware reporting portal for submitting suspicious URLs for review.free
- Google Safe Browsing APIGoogle's free API detecting malicious URLs and phishing sites with protection across billions of devices.free
- Google Subdomains (D)also written Google Subdomains, GoogleSubdomainsGoogle Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.free
- Google Trendsalso written GoogleTrendsGoogle's search trend analysis tool for tracking keyword popularity and comparing search interest over time.free
- Google's Certificate TransparencyDirectory of all known Certificate Transparency logs monitored by Chrome and other browsers. Browse CT log records to discover issued certificates, identify unauthorized domain certificates, and monitor for certificate misuse.free
- GrayhatWarfarealso written Grayhat WarfarePublic cloud storage bucket search engine. Search through exposed AWS S3, Azure Blob and Google Cloud Storage buckets for publicly accessible files and data.freemium
- Hunter.howalso written Hunter howInternet-wide asset search engine: exposed services, certificates and technologies, with a syntax close to Shodan and different coverage.freemium
- Hunting-New-Registered-Domains (T)also written Hunting-New-Registered-Domains, Hunting New Registered DomainsOpen-source tool for identifying newly registered domains matching patterns, useful for phishing and brand threat detection.free
- ICANN Lookupalso written ICANNLookupThe registry lookup operated by ICANN itself. The authoritative answer on a domain's registrar, status codes and creation date, without a third party in between.free
- International Domain Name Conversion ToolVerisign's IDN/Punycode bidirectional converter for translating international domain names to and from ASCII-compatible encoding.free
- IntoDNS.aialso written Into DNS.ai, IntoDNSFull DNS configuration audit with plain-language explanation of each anomaly, useful for spotting a misconfiguration or a hasty migration.free
- IP2WHOISalso written IP2 WHOISFree WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.free
- IslegitsiteFast plausibility check on a merchant site: age, registration, certificate and warning signs, for triaging a suspicious shop.free
- isMaliciousalso written is MaliciousChecks a domain or address against several reputation feeds at once and shows which ones flag it, with the reason.free
- Joe Sandbox Url AnalyzerDeep URL and document analysis using real browser execution in isolated environments. Detects malware, phishing, and suspicious behavior with detailed system/network monitoring.freemium
- Katana (T)also written KatanaFast web crawler and spider for attack surface discovery by ProjectDiscovery.free
- Keyword Densityalso written KeywordDensityText and page analyzer that measures keyword frequency and relative density.free
- Kraken (T)also written KrakenOpen-source reconnaissance utility for domain and network intelligence gathering workflows.free
- MajesticBacklink index built over more than a decade. Reveals which sites link to a domain, which exposes networks of connected properties.freemium
- MalwareURL (R)also written MalwareURL, Malware URLCommercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.freemium
- MarkMonitor WHOISalso written Mark Monitor WHOIS, MarkMonitorWHOISWHOIS interface of a registrar specialised in corporate portfolios. Often returns detail that generic lookups omit on brand-owned domains.free
- MnemonicMnemonic's public PassiveDNS service providing historical and current DNS records collected from global sensor networks. Unauthenticated queries available with rate limiting.free
- Netcraft Site ReportHosting history of a site: successive IP addresses, operating systems, netblocks and hosting providers, going back years. Traces a site's moves over time.free
- Nuclei (T)also written NucleiFast vulnerability scanner using community-maintained YAML templates to detect CVEs, misconfigurations, exposed panels and sensitive files across target infrastructure.free
- ODINInternet scanning engine with historical records: lets you see what a host exposed months ago, not only today.freemium
- Online Nikto scannerHosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.free
- Open Bucketalso written OpenBucketSearch engine for open cloud storage buckets. Discovers and indexes publicly accessible S3, GCS and Azure storage containing exposed files and sensitive data.freemium
- Open Site ExplorerLegacy Moz Open Site Explorer entry now represented by Moz Link Explorer for backlink analysis.freemium
- OpenText Threat Intelligence URL/IP Lookupalso written Open Text Threat Intelligence URL/IP LookupWeb classification and reputation tool providing URL/IP threat and content analysis. Uses machine learning reputation scoring across 82 content categories with IP risk tiering.free
- OWASP Maryam (T)also written OWASP Maryam, OWASPMaryamModular OWASP OSINT framework with footprinting and search modules for multi-source reconnaissance.free
- Pentest-tools.com Subdomainsalso written Pentest tools com Subdomains, Pentest-tools.comSubdomainsWeb-based subdomain finder that enumerates subdomains for a given domain through hosted scanning.freemium
- Phonebook.czalso written Phonebook czFree OSINT intelligence tool for enumerating subdomains, email addresses and URLs associated with a target domain by querying passive DNS and certificate data.free
- PubDBalso written Pub DBLegacy public-database lookup entry with expired or unavailable service state.free
- Qualys SSL LabsDeep audit of a server's TLS configuration: certificate chain, supported protocols, known weaknesses. The certificate itself often reveals sibling domains.free
- RapidDNSalso written Rapid DNSFast subdomain and reverse DNS lookup tool. Enumerate subdomains, find domains sharing an IP, discover certificate transparency data and perform bulk DNS queries.free
- Recon-ng (T)also written Recon-ng, Recon ngFull-featured web reconnaissance framework with independent modules for data gathering.free
- Redirect Detectivealso written RedirectDetectiveWeb tool that traces URL redirect chains and final destinations across multi-hop redirects.free
- RobotsDisallowedalso written Robots DisallowedCurated wordlist of top disallowed paths harvested from robots.txt files across high-traffic websites.free
- Robtex (R)also written RobtexComprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.free
- scumware.orgalso written scumwareFree malware and spyware tracking domain blacklist maintained by security community for 18+ years.free
- SecLists DNS Subdomains (T)also written SecLists DNS Subdomains, Sec Lists DNS SubdomainsCommunity-maintained DNS wordlist collection used to power subdomain brute-force workflows.free
- SecurityTrailsalso written Security TrailsComprehensive DNS and domain intelligence platform. Access historical DNS records, WHOIS data, IP neighbors, subdomain enumeration and attack surface data for any domain.freemium
- SEMrushalso written SE MrushSEO intelligence platform for domain analytics, keyword intelligence, backlinks, and competitor profiling.paid
- Shadowserver Foundationalso written ShadowserverFoundationNonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.free
- ShodanSearch engine for internet-exposed devices, services, and security-relevant banners.freemium
- SimilarWebalso written Similar WebDigital intelligence platform for traffic estimates, referrals, and audience insights.freemium
- Sitediff (T)also written SitediffCommand-line utility for comparing website versions to detect content and structural changes.free
- SitelinerWebsite crawler that highlights duplicate content, broken links, and SEO quality issues.freemium
- SiteSleuthalso written Site SleuthOSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.free
- Sn1per (T)also written Sn1perAutomated reconnaissance and penetration testing framework combining multiple scanning tools for full-scope target enumeration.free
- SourcegraphSearch across millions of public repositories at once. Finds an internal domain, a key or a configuration published by accident.freemium
- StatsCropalso written Stats CropWebsite statistics portal with traffic rank snapshots and related metadata.free
- SubDomainRadar.ioalso written Sub Domain Radar.io, SubDomainRadarSubdomain enumeration combining passive sources and certificate logs, with results exportable for the rest of an investigation.freemium
- Sublist3rPython tool for subdomain enumeration using search engines, passive sources, and optional brute-force.free
- Sucuri SiteCheckalso written Sucuri Site Check, SucuriSiteCheckFree remote website scanner that checks for malware, security threats, blacklisting, and vulnerabilities. Detects outdated CMS versions, insecure configurations, and security anomalies.free
- SWITCH Internet Domains Whois (.ch)also written SWITCH Internet Domains Whois ( ch)Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.free
- SynapsIntalso written Synaps IntUnified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.free
- Trend Micro Site Safety CenterFree service that checks website safety ratings from Trend Micro's research and reputation sources. Identifies websites with malware, phishing activity, or suspicious behavior.free
- UPcheckalso written U PcheckWebsite uptime checker that tests if a site is currently accessible.free
- URL Voidalso written URLVoidFree website reputation checker that scans URLs against 30+ blocklist engines and reputation services. Detects fraudulent and malicious websites with browser extension available.free
- urlDNAalso written url DNAURL intelligence service for investigating domains, redirects, and related reputation indicators.freemium
- UrlQuery.netalso written Url Query.net, UrlQueryFree online URL scanner that analyzes webpages for malware, suspicious elements, and phishing threats. Provides comprehensive threat detection reports with threat briefs on emerging campaigns.free
- urlscan.ioalso written urlscanFree URL and website scanner that takes screenshots, extracts all resources loaded, DOM structure, network connections, and links — ideal for analyzing phishing pages safely.free
- UrlwatchOpen-source Python CLI tool for monitoring webpages and feeds for changes. Supports multiple filters, reporters, and scheduled checks via local automation.free
- ValidinInternet intelligence platform offering passive DNS history, subdomain enumeration, IP/domain reputation, certificate data, YARA support, and lookalike domain detection.freemium
- ViewDNS.infoalso written View DNS.info, ViewDNSComprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.free
- Visual Site MapperSite-crawling mapper used to visualize website structure and page relationships.free
- VisualPingalso written Visual PingWebsite monitoring platform that alerts on page content or visual changes.freemium
- W3Techsalso written W3 TechsWeb technology usage statistics and site-specific technology detection. Identify the server, CMS, programming language, hosting provider and analytics tools used by any website.free
- WappalyzerTechnology detection platform and browser tooling for identifying frameworks, CMS, and SaaS usage.freemium
- Web Data Exposure Scanner (T)also written Web Data Exposure ScannerOpen-source scanner for detecting exposed web application data and sensitive file disclosures on web servers.free
- Web Inspector Online ScanFree cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.free
- Web-Checkalso written Web CheckRuns about thirty checks on a URL in one pass: DNS, certificate, headers, technologies, redirects, blocklists. An open-source first reconnaissance sweep.free
- WebscoutAggregates DNS, certificates, technologies, headers and reputation for one domain in a single report.freemium
- Website Informeralso written WebsiteInformerFree domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.free
- WebsiteSEOStatsalso written Website SEO StatsWebsite intelligence and SEO analysis tool. Provides domain age, traffic estimates, social metrics, technology stack, backlinks and WHOIS data for any website.free
- WhatCMSalso written What CMSWeb CMS and technology detection tool. Identify the content management system, frameworks, plugins and technologies used by any website.free
- WhatWebalso written What WebOpen-source fingerprinting scanner for identifying technologies, frameworks, and server-side indicators.free
- Where Does This Link Go?Redirect-chain inspector that traces and visualizes final destination paths.free
- Who.isalso written Who isComprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.free
- Whois ARINalso written WhoisARINOfficial American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.free
- WhoisologySearchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.freemium
- Windows Defender Security Intelligence (WDSI)Microsoft's security intelligence portal for reporting malicious URLs and checking Windows Defender threat assessments.free
- WPScan Vulnerability Databasealso written WP Scan Vulnerability DatabaseReference catalogue of WordPress vulnerabilities, by core version, plugin and theme. Given a site's stack, it tells you what is publicly known against it.freemium
- XRayalso written X RayGo-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.free
- Zone-H.orgalso written Zone-HArchive of reported website defacements and related incident metadata maintained by the Zone-H community.free
- ZoomEye.aialso written Zoom Eye.ai, ZoomEyeCyberspace search engine indexing internet-connected devices, services, and vulnerabilities globally. Provides AI-powered search via ZoomEyeGPT with support for ZoomEye dorks for targeted reconnaissance.freemium
- Zscaler Zulu URL Risk AnalyzerFree dynamic risk scoring engine for web content analysis. Assesses URLs from multiple perspectives: content analysis, URL patterns, and host reputation using machine learning.free
Frequently asked
- How to find all subdomains of a site?
- crt.sh uses Certificate Transparency logs to find all certificates issued for a domain. Subfinder and Amass complete the analysis.
- How to see a domain's history?
- SecurityTrails and Wayback Machine let you view old DNS records and past content of a site.