Outils OSINT

WhatsMyName Web

Username

Free web-based OSINT username enumeration tool that searches for a specified username across 1500+ websites and platforms simultaneously, returning direct links to matching profiles.

WhatsMyName (T)

Username

OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.

Sylva Identity Discovery (T)

Username

Open-source CLI tool for username and identity discovery with branch discovery to expand searches as additional linked identities are uncovered.

Sherlock (T)

Username

Python CLI tool that hunts down social media accounts by username across 400+ social networks. Supports Tor routing, proxy configuration, and CSV/XLSX export.

Namechk

Username

Web-based username and domain availability checker that searches 100+ social media platforms and 36 domain extensions simultaneously.

Thats Them

Username

Free people search engine aggregating data from 50+ sources. Supports lookups by name, address, phone number, or email.

NameCheckup

Username

Free web-based username and domain availability checker that searches across 20+ social media platforms and 40+ domain extensions with WHOIS lookup support.

FootprintIQ

Username

Ethical digital footprint scanner that searches usernames, emails, and phone numbers across 500+ platforms. Includes breach detection, data broker scanning, and confidence scoring to reduce false positives.

GitFive (T)

Username

OSINT CLI tool for investigating GitHub profiles. Tracks username/name history, maps emails to accounts, extracts SSH public keys, and exports findings as JSON.

Names Directory

Username

Searchable database of 1B+ name combinations collected from public sources. Allows bidirectional lookup to find first names by surname or surnames by first name.

Lullar

Username

Free people search and username lookup tool that searches across 148+ social media platforms including Instagram, TikTok, Facebook, and LinkedIn.

Amazon Usernames (M)

Username

Google dork that searches Amazon.com for pages associated with a specific username, surfacing public profiles, wishlists, and reviews.

Github User (M)

Username

Queries the GitHub public Events API to retrieve a user's recent public activity, including pushes, pull requests, issues, and other repository events.

Tinder Usernames (M)

Username

Accesses a Tinder user's public web profile via their username. The gotinder.com domain redirects to tinder.com.

Keybase

Username

Platform for cryptographic identity verification, linking social media accounts, PGP keys, and cryptocurrency addresses to a single profile. Acquired by Zoom in 2020 but still operational.

MIT PGP Key Server

Username

MIT PGP Public Key Server for searching, submitting, and removing PGP public keys. Look up keys by name, email, or key ID to find associated cryptographic identities.

ProtonMail users (M)

Username

Queries ProtonMail's HKP-compatible PGP key server to look up the public key for a ProtonMail username. A successful response confirms the account exists.

ProtonMail Domains (M)

Username

Queries ProtonMail's HKP key server with a full email address to check for a PGP public key. Useful for identifying ProtonMail users on custom domains.

ThatsThem

Email Address

Reverse email lookup tool that searches a database of hundreds of millions of emails to reveal name, address, phone number, and public records associated with an email address.

Hunter

Email Address

Email finder and verifier that discovers business email addresses from company domains, names, and social profiles with up to 98% accuracy rate.

Email to Address (R)

Email Address

Melissa.com's data quality and verification service that validates and enriches email addresses with supplementary contact information.

VoilaNorbert

Email Address

Email finder and verifier with 98% success rate that discovers business emails by company/domain, person name, or LinkedIn profile with bulk upload capability.

GHunt (T)

Email Address

Offensive Google framework that investigates Google accounts using email addresses to uncover YouTube channels, Google Photos, Maps reviews, and associated artifacts.

OSINT Industries

Email Address

Account linking service that extracts all registered accounts tied to an email or phone across 500+ platforms including social media, messaging apps, and lifestyle services.

theHarvester (T)

Email Address

Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.

Infoga (T)

Email Address

Python-based email OSINT tool that gathers email account information (IP, hostname, country) from search engines, PGP servers, and Shodan, with breach checking via haveibeenpwned.

Skymem

Email Address

Email finder that discovers company and personal email addresses by domain or name, with bulk search, email list creation, and advanced filtering capabilities.

Epieos Email Tool

Email Address

Freemium OSINT tool performing email reverse lookups to uncover associated social media profiles across 120+ websites and services with breach detection.

breach.vip

Email Address

Free database search engine providing access to 1000+ breach databases for research, email searching, and analysis of compromised credentials.

Holehe (T)

Email Address

Python-based email enumeration tool that checks if an email is registered across 120+ websites and services using password-reset mechanisms.

Email Format

Email Address

Tool for analyzing and discovering corporate email address patterns and formats to predict valid employee email addresses within an organization.

Email Permutator

Email Address

OSINT tool that generates all possible email address combinations from a person's name and domain(s) for reconnaissance and email guessing.

Reacher Github (T)

Email Address

Open-source Rust-based email verification API that checks email deliverability without sending messages, detecting catch-all and disposable addresses.

Reacher Demo

Email Address

Hosted demo of the Reacher email verification API allowing free testing of email validation and deliverability checks online.

MailScrap

Email Address

Email verification tool that connects to mail servers to verify mailbox existence and removes disposable email addresses from lists.

Read Notify

Email Address

Email tracking and read receipt service that monitors email opens and engagement, useful for confirming email validity through delivery.

Email Reputation

Email Address

Tool that checks email reputation, risk scoring, and breach history to identify phishing emails, compromised accounts, and risky addresses.

MailboxValidator

Email Address

Email verification API that validates email deliverability, detects catch-all addresses, and provides risk scoring for bulk email list cleaning.

VerifyEmail (R$)

Email Address

Email verification API that checks deliverability, MX records, and syntax validity for any address. Returns detailed bounce risk and mailbox existence confidence.

Disposable Email Domains (T)

Email Address

Community-maintained blocklist of 5,000+ disposable email domains with allowlist support and multi-language implementation examples. Used by PyPI and other projects.

Disposable Emails Registry

Email Address

Searchable registry of disposable email domains with bulk download support for threat intelligence integration.

Burner Email Providers (T)

Email Address

Curated list of temporary email service domains with API references and detection library implementations across multiple languages.

Have I been pwned?

Email Address

Database of breached credentials and email addresses from known data breaches.

Hudson Rock

Email Address

Infostealer threat intelligence platform that searches a database of compromised devices and stolen credentials to identify if emails have been exposed via malware infections.

DeHashed (R)

Email Address

Modern breach search engine indexing historical breach data over a decade old, enabling searches by email, username, password, domain, phone, and IP address.

Vigilante.pw

Email Address

Breach database directory and search platform raising awareness of data breaches by aggregating publicly leaked database information and breach details.

MxToolbox

Email Address

Email deliverability diagnostics tool that checks MX records, SPF, DKIM, DMARC configuration, and server health to prevent email delivery issues.

Domain Dossier

Domain Name

Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.

domainIQ

Domain Name

Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.

DomainTools Whois

Domain Name

Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.

SWITCH Internet Domains Whois (.ch)

Domain Name

Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.

Whoisology

Domain Name

Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.

Whois ARIN

Domain Name

Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.

DNSstuff

Domain Name

Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.

Robtex (R)

Domain Name

Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.

Domaincrawler.com

Domain Name

Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.

MarkMonitor Whois Search

Domain Name

ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.

easyWhois

Domain Name

Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.

Website Informer

Domain Name

Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.

Who.is

Domain Name

Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.

Whois AMPed

Domain Name

Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.

ViewDNS.info

Domain Name

Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.

Daily DNS Changes

Domain Name

DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.

IP2WHOIS

Domain Name

Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.

Netlas.io

Domain Name

Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.

SynapsInt

Domain Name

Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.

Aquatone (T)

Domain Name

Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.

FindSubDomains

Domain Name

Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.

Google Subdomains (D)

Domain Name

Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.

Recon-ng (T)

Domain Name

Full-featured web reconnaissance framework with independent modules for data gathering.

XRay

Domain Name

Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.

DNS Recon (T)

Domain Name

Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.

Gobuster (T)

Domain Name

Multi-mode brute-force tool for DNS subdomain, virtual host, and directory discovery.

Fierce Domain Scanner (T)

Domain Name

DNS reconnaissance tool focused on subdomain discovery and non-contiguous IP space mapping.

Bluto (T)

Domain Name

Recon utility for domain intelligence including DNS records, email patterns, and infrastructure clues.

OWASP Maryam (T)

Domain Name

Modular OWASP OSINT framework with footprinting and search modules for multi-source reconnaissance.

Pentest-tools.com Subdomains

Domain Name

Web-based subdomain finder that enumerates subdomains for a given domain through hosted scanning.

SecLists DNS Subdomains (T)

Domain Name

Community-maintained DNS wordlist collection used to power subdomain brute-force workflows.

dnspop (T)

Domain Name

DNS reconnaissance utility for enumerating records and identifying domain-related infrastructure.

gdns (T)

Domain Name

Google DNS-focused command-line tool for DNS lookup and domain record exploration.

Sublist3r

Domain Name

Python tool for subdomain enumeration using search engines, passive sources, and optional brute-force.

AltDNS (T)

Domain Name

Permutation-based DNS tool that generates and resolves alternative subdomains from known names.

Netlas.io

Domain Name

Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.

Shodan

Domain Name

Search engine for internet-exposed devices, services, and security-relevant banners.

Netlas.io

Domain Name

Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.

Kraken (T)

Domain Name

Open-source reconnaissance utility for domain and network intelligence gathering workflows.

Online Nikto scanner

Domain Name

Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.

urlscan.io

Domain Name

URL and domain analysis service that captures page loads, requests, and security-relevant artifacts.

Redirect Detective

Domain Name

Web tool that traces URL redirect chains and final destinations across multi-hop redirects.

Sitediff (T)

Domain Name

Command-line utility for comparing website versions to detect content and structural changes.

BuiltWith

Domain Name

Technology profiling platform that identifies web stacks, frameworks, analytics, and hosting signals.

Wappalyzer

Domain Name

Technology detection platform and browser tooling for identifying frameworks, CMS, and SaaS usage.

AnalyzeID

Domain Name

Reverse lookup service for tracking IDs such as Google Analytics, AdSense, and affiliate identifiers.

Criminal IP Search

Domain Name

Cyber threat intelligence search engine for exposed assets, domains, vulnerabilities, and risk indicators.

urlDNA

Domain Name

URL intelligence service for investigating domains, redirects, and related reputation indicators.

ZoomEye.ai

Domain Name

Cyberspace search engine indexing internet-connected devices, services, and vulnerabilities globally. Provides AI-powered search via ZoomEyeGPT with support for ZoomEye dorks for targeted reconnaissance.

Google's Certificate Transparency

Domain Name

Directory of all known Certificate Transparency logs monitored by Chrome and other browsers. Browse CT log records to discover issued certificates, identify unauthorized domain certificates, and monitor for certificate misuse.

Spyse

Domain Name

Internet assets registry providing certificate search, domain intelligence, and vulnerability discovery. Scans domains, subdomains, certificates, emails, and open ports across the global internet.

Censys

Domain Name

Internet-wide scanner and search engine for hosts, certificates, and services.

crt.sh - Certificate Search

Domain Name

CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.