Open Source Intelligence Websites Analysts Actually Use

There is no shortage of open source intelligence websites. The OSINT Framework directory alone branches into hundreds of leaves, and a determined afternoon of link collecting will leave you with a bookmarks folder you never open again. The problem is not availability. The problem is that a list organized by tool category does not map onto the way an investigation is actually run.

A case asks questions in a specific order. Who is behind this domain and for how long. Where does its mail go and can it be spoofed. What else does this organization expose. Is this entity a real registered company. Has this asset appeared in a breach corpus. The sites below are grouped that way, and each entry says plainly where it stops being enough.

Registration: who holds the name, and since when

Registration data is the cheapest useful check in the discipline. A counterparty claiming two decades of trading on a domain registered eleven weeks ago is the single most common signal in invoice and vendor fraud, and it costs one lookup to find.

• RDAP (rdap.org) answers over HTTPS in structured JSON, served by the authoritative registry or registrar. It carries explicit event records for registration, expiry and last change, plus the registry status codes. This is what you want now that ICANN has retired the port-43 WHOIS requirement.
• ICANN Lookup is the reference implementation and a reasonable sanity check when a registrar answers oddly.
• Registry-specific WHOIS still matters for country-code domains, many of which never adopted RDAP and answer with their own formats and their own redaction rules.

Where it stops: GDPR redaction removed registrant name, address and email for most individual registrations. What survives is what an investigator uses most anyway. Creation date, expiry date, last change, registrar of record, status codes and delegated nameservers. Our page on WHOIS lookup as evidence goes through each status code and what it tells you about a target.

DNS: what the organization has published about itself

DNS is the most under-read public record set there is. An organization publishes its mail routing, its anti-spoofing posture, its certificate issuance policy and often its entire SaaS vendor list, in plain text, to anyone who asks.

• Google Public DNS resolve API and Cloudflare DNS over HTTPS both answer JSON over HTTPS with permissive CORS, which is why browser tools can query them directly. A, AAAA, MX, NS, TXT and CAA answers with the TTL attached.
• dig on your own machine, when you need the authority section, DNSSEC material or a query against a specific nameserver rather than a resolver cache.
• MXToolbox for a fast human-readable read on mail posture, though the output is a page rather than a record you can cite.

The findings that matter come from combining records rather than reading them one at a time. An SPF record ending in ~all paired with a DMARC policy of p=none means the domain publishes anti-spoofing rules and enforces none of them. Neither record is alarming alone. Together they describe a domain that can be impersonated. That derivation is the point of the DNS lookup module.

Certificate transparency: the subdomain list nobody meant to publish

Every publicly trusted certificate issued since 2018 is logged to append-only certificate transparency logs. Because certificates carry subject alternative names, those logs are an unintentional and highly reliable inventory of an organization's hostnames, including the ones that were never linked from anywhere.

• crt.sh is the standard front end, searchable by domain with wildcard support and a JSON output.
• Censys and Cert Spotter cover the same logs with different interfaces and different rate limits.

Corporate registries: is this a real legal entity

Domain data tells you about infrastructure. It tells you nothing about whether a counterparty is a company that exists, files accounts and has directors you can name.

• OpenCorporates aggregates company records across many jurisdictions and is the usual first stop for a cross-border check.
• Companies House (UK) publishes filings, directors, charges and a full document history at no cost, and is one of the best public registries anywhere.
• SEC EDGAR for US public companies, where the filings themselves are the richest source in this entire list.
• The national registry itself whenever the jurisdiction matters, because aggregators lag and occasionally mis-map entities.

Infrastructure exposure: what is reachable from the internet

Shodan and its peers index the results of internet-wide scanning. They are the fastest way to understand what an estate exposes, and they are the entry in this list that carries the most responsibility, because the same query that audits your own perimeter reads as reconnaissance when pointed at someone else.

• Shodan for service banners, open ports, product and version strings, and historical views on the paid tiers.
• Censys Search for a certificate-centered view of the same territory.
• ZoomEye and FOFA for coverage that differs regionally.

We wrote about the boundary in detail in using Shodan on infrastructure you own. The short version: querying an index is passive, and the ethical line is drawn by scope and purpose rather than by the tool.

Breach and credential exposure

• Have I Been Pwned for domain-level exposure, where the domain search feature tells an organization which of its own addresses appear in known breaches without exposing anyone else's.
• DeHashed and similar commercial services, which carry a much heavier legal and ethical load and should only be touched with a documented lawful basis.

What the list does not fix

Every site above is genuinely useful, and none of them produces evidence. They produce answers on a screen. An answer you screenshot has no retrieval timestamp, no record of which server responded, and no link back to the scope you were working under. DNS records, registration data and certificates all change, which is exactly why an undated claim about them cannot be verified later, by you or by whoever reviews your work.

That gap is what Osintpro closes. The same public sources, queried the same passive way, with the raw record, the source endpoint and the UTC retrieval time attached to every finding, inside a case that already recorded what you were authorized to look at. If you want the honest version of where free tooling ends, we wrote it on free OSINT tools. If you want the sites organized by question rather than by category, that is the OSINT tools list.