# Osint Daily

> Osint Daily is a searchable directory of free and premium OSINT tools — what each one does, what it costs, and when to use it.

Canonical site: https://osint-daily.com. Published by Redwing Technologies LLC, 8 The Green, Ste A, Dover, DE 19901.
Each tool page leads with a quotable answer, then cost and what the tool actually does.
Sponsor placements are labeled Sponsor. They do not change sort order.

## Related products
- [Rook Intelligence](https://rook-intel.com/): Licensed private detective agency in Washington, DC. Senior analysts for OSINT, threat hunting, due diligence, and vetting, on retainer or by project.
- [Octoprobe](https://www.octoprobe.ai/): OSINT investigation platform from Redwing Technologies LLC at octoprobe.ai. One identifier runs through premium APIs, public records, and facial recognition, then lands on a sourced graph.

## Directory
- [Search the directory](https://osint-daily.com/directory): Filter by category, price, interface, and platform.
- [Categories](https://osint-daily.com/categories): The jobs these tools are for.
- [Developments in OSINT](https://osint-daily.com/newsletter): Weekly email when the directory changes. Confirm before the first issue.
- [Advertising](https://osint-daily.com/advertise): Labeled sponsor placements and launch rates. Listings are not for sale.
- [About](https://osint-daily.com/about): Who publishes the directory.

## Categories
- [Domain & infrastructure](https://osint-daily.com/categories/domain-infrastructure): Amass and Subfinder enumerate subdomains. theHarvester collects emails, hosts, and names from public sources. Hunter finds professional addresses for a domain from a hosted search. SpiderFoot chains those jobs across hundreds of modules. Start with a passive tool when you only have a domain, and move to an active scan only with authorization.
- [Internet scanning](https://osint-daily.com/categories/internet-scanning): Shodan and Censys both index internet-wide scan data. Shodan is the banner search practitioners open for a specific product, port, or organization. Censys is strongest when the question is about hosts and certificates. Neither replaces a scan you run yourself against assets you own.
- [Automation & frameworks](https://osint-daily.com/categories/automation-frameworks): SpiderFoot, Recon-ng, and sn0int run collection from a console or a local UI. MISP and OpenCTI are where a team stores and shares indicators. Maltego belongs beside them when the output needs a graph rather than a table. Hunchly is the capture tool for the pages you actually open.
- [Link analysis](https://osint-daily.com/categories/link-analysis): Maltego is the purpose-built link analysis tool: entities, transforms, and a graph you can brief from. Octoprobe is a hosted investigation graph that runs licensed sources, public records, and a face-matching step from one identifier. Recorded Future is an enterprise intelligence platform with its own workbench. Use a search tool first when you do not already have leads to connect.
- [Breach & identity](https://osint-daily.com/categories/breach-identity): Have I Been Pwned answers whether an email appears in known breaches. Hunter finds professional addresses tied to a domain. Holehe checks whether an email is registered on other sites. Intelligence X and DeHashed search larger breach archives. GHunt asks Google about an address from a session you control. OSINT Industries, Skopenow, and Octoprobe are paid workspaces when that search is a whole case. Confirm a hit before you treat it as identity.
- [Usernames & social](https://osint-daily.com/categories/usernames-social): Sherlock, Blackbird, Maigret, and Social Analyzer check a username across large lists of sites. UserSearch.org does that in the browser for free; UserSearch.com meters a wider set of sources. OSINT Industries, ShadowDragon, and Skopenow are paid workspaces for teams that run this search often. Hits are leads, not proof that two accounts are the same person.
- [Metadata & files](https://osint-daily.com/categories/metadata): ExifTool is the standard for file metadata: timestamps, device fields, and GPS when a photo or document still has them. sigtop is a different local job. It exports messages and attachments from a Signal Desktop installation on a machine you can already open. A missing GPS tag is unknown, not a location, and a Signal export is not a remote lookup.
- [Search & dorking](https://osint-daily.com/categories/search-dorking): The Google Hacking Database is a maintained catalog of search operators, grouped by what they tend to surface. The OSINT Framework is a map of tools and sources by task. Use operators such as site: and filetype: on domains you are allowed to assess. A dork is a query, not permission.
- [Threat intelligence](https://osint-daily.com/categories/threat-intelligence): VirusTotal judges files, URLs, domains, and IPs across many scanners. urlscan loads a URL and records the screenshot, the page, and the requests. Shodan shows exposed services. Recorded Future and Flashpoint are paid intelligence platforms for teams that need ongoing collection. Pick VirusTotal or urlscan for a single artifact. Pick a platform when the work is a program, not a lookup.
- [Archives & history](https://osint-daily.com/categories/archives): The Wayback Machine, run by the Internet Archive, stores public captures of web pages and exposes them in a browser and an API. Intelligence X overlaps when the question is leaked or historical data rather than a normal webpage. Start with Wayback when a URL disappeared or was edited.
- [Location & device data](https://osint-daily.com/categories/location-data): Venntel and Fog Reveal sell access to commercially sourced device-location data, usually tied to mobile advertising identifiers rather than a GPS feed those companies collect from the phone. They are contracted products for qualified organizations, not free search boxes. A trail of device observations is a lead. It is not a name, and it is not proof of who held the phone.
- [Geolocation & imagery](https://osint-daily.com/categories/geolocation): WiGLE maps wireless networks people have uploaded. Flightradar24 tracks aircraft from public receiver data, with a free map and paid plans. Copernicus Browser opens Sentinel satellite imagery from the EU data space. These are not the advertising-derived device trails sold by Venntel and Fog Reveal. A dot on a map is an observation, not a name.
- [Reverse engineering](https://osint-daily.com/categories/reverse-engineering): Ghidra is the National Security Agency Research Directorate's free software reverse engineering framework. It disassembles, decompiles, graphs, and scripts binaries on Windows, macOS, and Linux. GhidraMCP is the MCP server from LaurieWired/GhidraMCP that exposes a running Ghidra to an AI client. VirusTotal and MalwareBazaar tell you whether a hash was shared. They do not open the program.

## Tools
- [AbuseIPDB](https://osint-daily.com/tools/abuseipdb): AbuseIPDB is a project where administrators check and report IP addresses tied to activity such as spam, intrusion attempts, and denial-of-service. Checking and reporting are free. API plans are paid, and the pricing page says each plan includes a 30-day trial. A report is a submission from another user. It is not proof the address is still hostile, or of who operates it. Pricing: Freemium. Reviewed: 2026-10-15.
- [Amass](https://osint-daily.com/tools/amass): Amass is the OWASP project for in-depth attack surface mapping. It enumerates subdomains and related infrastructure from passive sources and, if you turn it on, from active DNS queries and brute force. The CLI is free and open source. Active modes touch the target, so they belong on domains you are authorized to assess. Pricing: Free. Reviewed: 2026-10-15.
- [Blackbird](https://osint-daily.com/tools/blackbird): Blackbird is a free, open-source command-line tool that checks a username across a large list of sites. The project is at github.com/antoniaci/blackbird; an earlier p1ngul1n0 repository redirects there. A hit is a profile URL to open and verify. It does not prove two accounts belong to the same person, and sites that answer every name with a success page will create false positives. Pricing: Free. Reviewed: 2026-10-15.
- [BuiltWith](https://osint-daily.com/tools/builtwith): BuiltWith is a web-technology lookup. You give it a site and it reports the technologies it detects. The homepage offers a free signup, and lists, datasets, and API access sit behind plans. The pricing page is the rate card. This listing does not quote a dollar amount from it. A technology tag is a detection on that site. It is not proof of who built it or that the tag is still current. Pricing: Freemium. Reviewed: 2026-10-15.
- [Censys](https://osint-daily.com/tools/censys): Censys scans the public internet and lets you search hosts and certificates. It is the other major internet-scan index beside Shodan, with a reputation for certificate and host data born out of University of Michigan research. Censys Search has a free tier with limits. Higher volume, the platform, and the API are paid. Pricing: Freemium. Reviewed: 2026-10-15.
- [Copernicus Browser](https://osint-daily.com/tools/copernicus-browser): Copernicus Browser is the free web viewer for the Copernicus Data Space Ecosystem. It opens Earth-observation imagery from the Sentinel satellites, plus other datasets the ecosystem publishes. You use it in a browser. An image is what a satellite recorded over that tile at that time. It is not a live camera, and it does not name a person in the frame. Pricing: Free. Reviewed: 2026-10-15.
- [DeHashed](https://osint-daily.com/tools/dehashed): DeHashed is a breach-data search site. Its pages describe search across compromised records for usernames, emails, IP addresses, names, hashes, and related fields, plus monitoring, an API, and WHOIS lookups. Monitoring is advertised as free. Search is presented as a subscription, but the public price figures were not a stable number when this listing was reviewed. A row in a breach file is a lead about exposure. It is not a password to reuse. Pricing: Freemium. Reviewed: 2026-10-15.
- [DNSDumpster](https://osint-daily.com/tools/dnsdumpster): DNSDumpster is a domain research site that maps hosts related to a domain from passive DNS. A basic account is free. The membership page lists 50 requests a day on that tier, and paid Plus and Max plans with higher caps and published prices. A hostname is a lead from DNS. It does not mean the host is vulnerable, and it does not authorize you to scan it. Pricing: Freemium. Reviewed: 2026-10-15.
- [ExifTool](https://osint-daily.com/tools/exiftool): ExifTool is Phil Harvey’s open-source tool for reading and writing metadata. Point it at a photo, video, audio file, or document and it prints what the file still stores: timestamps, device fields, software, and GPS when those tags were not stripped. It is a local command-line tool, free to use, and the one metadata utility other tools shell out to. Pricing: Free. Reviewed: 2026-10-15.
- [Flashpoint](https://osint-daily.com/tools/flashpoint): Flashpoint is a paid intelligence platform used by security and intelligence teams. It collects from illicit online communities and related threat data, then exposes that collection in a workspace and an API. It is not a free search box, and it does not publish a simple public price. Use VirusTotal or urlscan for one artifact. Use a platform like Flashpoint when the work is ongoing collection your team is allowed to license. Pricing: Paid. Reviewed: 2026-10-15.
- [Flightradar24](https://osint-daily.com/tools/flightradar24): Flightradar24 is a live flight map. Opening the map is free. Subscription plans add more, and the premium page offers a 7-day trial. This listing does not quote a plan price, because the premium page we opened did not print the amounts in its HTML. A track is an aircraft position the service has received. It does not identify a passenger, and it is not a government radar feed you control. Pricing: Freemium. Reviewed: 2026-10-15.
- [Fog Reveal](https://osint-daily.com/tools/fog-reveal): Fog Reveal is the browser platform from Fog Data Science. It analyzes commercially available device-location records indexed by mobile advertising IDs, supplied by third parties. Fog says it does not collect precise location directly from phones. Access is for qualified public- and private-sector organizations, not a free lookup. The company also offers managed analysis. A device seen at a place and time is a lead to check against other sources. It is not a name. Pricing: Paid. Reviewed: 2026-10-15.
- [FotoForensics](https://osint-daily.com/tools/fotoforensics): FotoForensics is a free website from Hacker Factor for analyzing a digital photo. Dr. Neal Krawetz described the methods in a 2007 Black Hat talk, and the FAQ still points at that work. You submit a JPEG, PNG, WebP, HEIC, or AVIF. The analysis is meant to show whether a picture was changed and, sometimes, how. It is a lead for a researcher. It is not a court opinion. Pricing: Free. Reviewed: 2026-10-15.
- [Ghidra](https://osint-daily.com/tools/ghidra): Ghidra is the National Security Agency Research Directorate's open-source software reverse engineering framework. It disassembles, decompiles, graphs, and scripts binaries across many processors and executable formats, on Windows, macOS, and Linux. The project is free under the Apache 2.0 license. You install a release build and a current JDK, then open a program you are allowed to analyze. A decompiler listing is a reading of the binary. It is not a verdict that the file is malicious. Pricing: Free. Reviewed: 2026-10-15.
- [GhidraMCP](https://osint-daily.com/tools/ghidramcp): GhidraMCP is an open-source Model Context Protocol server that exposes a running Ghidra to an AI client. The canonical repository is LaurieWired/GhidraMCP. Its README describes a Ghidra plugin plus an MCP server that can decompile, list methods and imports, and rename methods and data inside the project. It is free under Apache 2.0. You still need Ghidra. A rename writes the Ghidra project. It is not a second opinion about whether the file is malicious. Pricing: Free. Reviewed: 2026-10-15.
- [GHunt](https://osint-daily.com/tools/ghunt): GHunt is a free, open-source Python tool by mxrch for asking Google questions from the command line. The modules in the README cover an email address, a Gaia ID, a Drive file or folder, and BSSID geolocation. It does not search anonymously: login uses a Google session you control. Results can be written to JSON, and the code can be imported as a library. The same README links an online version at osint.industries. The license is AGPL-3.0. Pricing: Free. Reviewed: 2026-10-15.
- [Google Hacking Database](https://osint-daily.com/tools/google-hacking-database): The Google Hacking Database (GHDB) is a free catalog of search queries — “dorks” — grouped by what they tend to find, such as files, login pages, and error messages. Offensive Security maintains it on Exploit-DB. It does not run the searches for you. A query is not authorization to access a system, download private data, or attack anything the result points at. Pricing: Free. Reviewed: 2026-10-15.
- [GreyNoise](https://osint-daily.com/tools/greynoise): GreyNoise is a network threat-intelligence service. The site offers a free search and documents a community API, next to paid platform and blocklist products on the plans page. You ask about an IP address. The answer is GreyNoise’s classification of that address from what it observes on the internet. A tag is not a packet from your own network, and it does not name the operator. Pricing: Freemium. Reviewed: 2026-10-15.
- [Have I Been Pwned](https://osint-daily.com/tools/have-i-been-pwned): Have I Been Pwned, run by Troy Hunt, tells you if an email address shows up in breaches it has loaded. The website lookup is free. The API that checks addresses in bulk is a paid subscription. A separate Pwned Passwords service lets you test a password with k-anonymity, without sending the whole password. Pricing: Freemium. Reviewed: 2026-10-15.
- [Holehe](https://osint-daily.com/tools/holehe): Holehe is an open-source command-line tool that checks whether an email address is registered on a set of websites. It is built to use registration and password-reset checks rather than to email the account. Those checks can still have side effects. Run it only on addresses you are allowed to investigate, and confirm a hit in a browser before you cite it. Pricing: Free. Reviewed: 2026-10-15.
- [Hunchly](https://osint-daily.com/tools/hunchly): Hunchly is a paid browser tool that captures pages while you research. It records the URL, timestamps, and hashes, and it stores full-page captures. The pricing page lists a free trial with no credit card, then Classic at €149 or $169 a year for storage on your own computer. Cloud storage is quoted by sales. A capture is a record of a page you opened. It is not a warrant. Pricing: Paid. Reviewed: 2026-10-15.
- [Hunter](https://osint-daily.com/tools/hunter): Hunter finds professional email addresses that appear with a domain on the public web, and it can check whether an address looks deliverable. It is a hosted product at hunter.io with a free monthly allowance and paid plans for more searches and API access. It is not a breach archive. An address it returns still has to be confirmed before you treat it as a person. Pricing: Freemium. Reviewed: 2026-10-15.
- [Instaloader](https://osint-daily.com/tools/instaloader): Instaloader is a free Python program for downloading Instagram photos and videos along with captions and other metadata. The project site documents a pip install and a Python module of the same name. The docs page reviewed here listed version 4.15.4. Private profiles, stories, and saved posts need a session you already control. A download is a copy of a post. It is not proof of who runs the account. Pricing: Free. Reviewed: 2026-10-15.
- [Intelligence X](https://osint-daily.com/tools/intelligence-x): Intelligence X, often called IntelX, is a search engine for leaked, public, and historical data at intelx.io. You query a selector such as an email, domain, IP, URL, or bitcoin address and get what that archive holds. A free account can search with tight daily limits. The product page lists paid annual plans from €2,500 to €20,000 for more history, phonebook lookups, and API access. A hit is a stored item, not a current fact. Pricing: Freemium. Reviewed: 2026-10-15.
- [Maigret](https://osint-daily.com/tools/maigret): Maigret takes a username and checks a very large list of sites, then tries to pull public details from the profiles it finds. It is a free, open-source command-line tool. Reports can be written as HTML, JSON, or other formats depending on the version. Like Sherlock, a hit is a URL to verify, not an identity. Pricing: Free. Reviewed: 2026-10-15.
- [Maltego](https://osint-daily.com/tools/maltego): Maltego is a desktop link-analysis tool. You drop in an entity — a domain, email, person, or phrase — run transforms, and work from the graph that comes back. Maltego CE is the free community edition with limits. Professional and organization licenses are paid. The product is a GUI, not a terminal recon suite. Pricing: Freemium. Reviewed: 2026-10-15.
- [MalwareBazaar](https://osint-daily.com/tools/malwarebazaar): MalwareBazaar is a sample-sharing platform operated by abuse.ch. Researchers upload malware and look up what others have submitted. The community API is free under the fair-use note on the API page, and that page says commercial use may require the paid abuse.ch API. A hash is a lead about a file. It is not a conviction, and this directory does not host the samples. Pricing: Freemium. Reviewed: 2026-10-15.
- [MISP](https://osint-daily.com/tools/misp): MISP is a free, open-source platform for collecting, storing, and sharing indicators from incident and malware analysis. The project site listed release 2.5.47 when this page was reviewed. You run it yourself. It is built so analysts can exchange structured information with detection tools and SIEMs. An indicator in MISP is a lead from a feed or a colleague. It is not a verdict on an address. Pricing: Free. Reviewed: 2026-10-15.
- [Octoprobe](https://osint-daily.com/tools/octoprobe): Octoprobe, at octoprobe.ai, is a premium investigation platform from Redwing Technologies LLC. You start with an email, phone, handle, name, domain, or photo. It runs licensed APIs, public records, and a facial-recognition step, then maps the results on one graph with a source on each link. Access is a request. The site does not publish a price. A match on that graph is a lead, not an identification. Pricing: Paid. Reviewed: 2026-10-15.
- [OpenCTI](https://osint-daily.com/tools/opencti): OpenCTI is an open-source threat-intelligence platform from Filigran. You can run the software from the public GitHub project. Filigran also offers a commercial path on the product page, with a demo rather than a price this listing could quote. The platform is where a team stores, links, and shares indicators. A relationship in the graph is only as good as the source that created it. Pricing: Freemium. Reviewed: 2026-10-15.
- [OSINT Framework](https://osint-daily.com/tools/osint-framework): The OSINT Framework is a website that organizes links to tools and sources as a tree: email, username, domain, social, and the rest. It does not collect data. Justin Nordine maintains it as a free map. Use it to discover a tool, then read that tool’s listing here before you depend on it. Pricing: Free. Reviewed: 2026-10-15.
- [OSINT Industries](https://osint-daily.com/tools/osint-industries): OSINT Industries is a paid web platform that searches a selector — an email, phone number, username, name, or ETH, BTC, or TRC wallet — and returns linked accounts and profile fields from many live sources. The pricing page lists plans at £19, £49, and £99 a month, with monthly credits. An API is on the higher plans. The GHunt README points at this site as its online version. A linked account is a lead, not an identity. Pricing: Paid. Reviewed: 2026-10-15.
- [PhoneInfoga](https://osint-daily.com/tools/phoneinfoga): PhoneInfoga is a free phone-number framework by sundowndev. It reads an international number and returns standard fields such as country, area, carrier, and line type, then can run optional scanners you configure. The project README says it is stable but unmaintained. A result is a lead. It does not prove who owns the number, and a scanner that is not configured simply does not run. Pricing: Free. Reviewed: 2026-10-15.
- [Recon-ng](https://osint-daily.com/tools/recon-ng): Recon-ng is a Python reconnaissance framework that feels like a console: workspaces, modules, and a local database of what you collected. It is free and open source. You install modules from its marketplace, add API keys, and run them against a target you are allowed to examine. It is a classic framework, not a hosted search engine. Pricing: Free. Reviewed: 2026-10-15.
- [Recorded Future](https://osint-daily.com/tools/recorded-future): Recorded Future is an enterprise threat-intelligence platform. It uses machine learning and natural language processing over open, technical, and dark-web sources, then puts the result in an analyst workbench and an API. It is a paid product sold to teams, not a free CLI. Osint Daily lists it because “what does the expensive tool actually replace?” is a fair directory question. Pricing: Paid. Reviewed: 2026-10-15.
- [ShadowDragon](https://osint-daily.com/tools/shadowdragon): ShadowDragon is a paid OSINT company. SocialNet searches a username, email, phone, or name across public social and online sources and maps aliases and relationships. That engine sits inside Horizon, the company’s investigation platform, which also sells monitoring and alerting. It is sold to investigative teams. shadowdragon.io does not publish a price. A profile it returns is still a lead you open and cite. Pricing: Paid. Reviewed: 2026-10-15.
- [Sherlock](https://osint-daily.com/tools/sherlock): Sherlock is an open-source command-line tool that takes a username and checks many websites for a matching profile URL. It is a fast first pass, not a proof that two accounts belong to one person. Expect false positives where a site returns a soft 200, and false negatives where a profile is private or renamed. Pricing: Free. Reviewed: 2026-10-15.
- [Shodan](https://osint-daily.com/tools/shodan): Shodan indexes banners from internet-connected devices — what a host says when you reach a port, not a copy of the web page behind it. Practitioners use it to find exposed services by product, port, organization, or geography. A free account can search; filters, credits, monitoring, and the API open up on paid plans. Pricing: Freemium. Reviewed: 2026-10-15.
- [sigtop](https://osint-daily.com/tools/sigtop): sigtop is a free command-line utility by Tim van der Molen that exports messages, attachments, and other data from Signal Desktop. It reads the local data directory of an installation you can already open. It does not connect to Signal’s servers and it does not recover an account you cannot open. Builds exist for Linux, macOS, and Windows. Use it when the investigation already has lawful access to that desktop, and keep the export inside the case file. Pricing: Free. Reviewed: 2026-10-15.
- [Skopenow](https://osint-daily.com/tools/skopenow): Skopenow is a paid investigation platform for analysts, law firms, and investigators. It searches public records and open-web sources from one workspace, and the company describes the product as AI-assisted. Pricing is sales-led. A record or a profile still has to be opened and cited. Use it when the case needs hosted search across people data, not a single free lookup. Pricing: Paid. Reviewed: 2026-10-15.
- [sn0int](https://osint-daily.com/tools/sn0int): sn0int is a free OSINT framework and package manager by kpcyrd. It collects public information about a target you are allowed to assess, or about yourself, and keeps the rows in one local database. The manual describes jobs such as subdomains from certificate logs and passive DNS, then a check for sites that answer. A row is a lead for a follow-up. It is not a completed report. Pricing: Free. Reviewed: 2026-10-15.
- [Social Analyzer](https://osint-daily.com/tools/social-analyzer): Social Analyzer is a free, open-source project from qeeqbox for finding a username across social sites. It ships an API, a command-line tool, and a local web app, so you can run one search or call the same check from a workflow you control. Treat every hit as a page to open. A matching handle is a lead, not an identity. Pricing: Free. Reviewed: 2026-10-15.
- [SpiderFoot](https://osint-daily.com/tools/spiderfoot): SpiderFoot automates OSINT collection. You give it a domain, email, name, or address, and modules query public sources, then correlate the results in a local web interface. The open-source edition is free and self-hosted. SpiderFoot HX is the commercial hosted product. It is a framework, not a single-purpose search box. Pricing: Freemium. Reviewed: 2026-10-15.
- [Subfinder](https://osint-daily.com/tools/subfinder): Subfinder finds subdomains from passive sources. It is a free, open-source CLI from ProjectDiscovery, built to be fast and scriptable. It does not brute force DNS by itself. Some sources return more if you supply API keys. Pair it with Amass when you also need active enumeration or a richer graph. Pricing: Free. Reviewed: 2026-10-15.
- [theHarvester](https://osint-daily.com/tools/theharvester): theHarvester is a command-line collector for emails, names, subdomains, IPs, and URLs tied to a domain. It queries public sources such as search engines, certificate logs, and other indexes. It is free, open source, and shipped with Kali. It does not validate that an address is live. Confirm a result before you cite it. Pricing: Free. Reviewed: 2026-10-15.
- [urlscan](https://osint-daily.com/tools/urlscan): urlscan.io loads a URL in a controlled browser and records what the page does: a screenshot, the DOM, and the network requests. You can also search scans other people have already made public. Public scans and search are free within rate limits. Private scans and higher API volume are paid. It is a lookup for a link, not a license to visit infrastructure you do not own. Pricing: Freemium. Reviewed: 2026-10-15.
- [UserSearch](https://osint-daily.com/tools/usersearch): UserSearch is two sites. UserSearch.org runs a free reverse username search across a large list of social, dating, gaming, and forum sites, with no account required. UserSearch.com is the paid platform: the pricing page lists Premium at $18.97 a month or $159.97 a year, with a monthly credit for metered modules. Some modules are free. A profile hit still has to be opened. Two handles that match are not automatically one person. Pricing: Freemium. Reviewed: 2026-10-15.
- [Venntel](https://osint-daily.com/tools/venntel): Venntel sells location intelligence to government, defense, and selected private organizations. The data is commercially sourced device location, not a GPS feed Venntel collects from phones itself. Location Intelligence is the historical product. Location Stream is a low-latency feed delivered by API. Gravy Analytics, its parent, has merged with Unacast, and an FTC complaint describes Venntel sales to public-sector customers. There is no public search box and no public price. Pricing: Paid. Reviewed: 2026-10-15.
- [VirusTotal](https://osint-daily.com/tools/virustotal): VirusTotal aggregates malware scanners and reputation data for a file, URL, domain, or IP address. The website is free with rate limits. The public API is quota-limited; VirusTotal Enterprise and Intelligence are paid. Code Insight adds an AI-written summary for some files. Anything you upload can be shared with scanners and other users. Pricing: Freemium. Reviewed: 2026-10-15.
- [Wayback Machine](https://osint-daily.com/tools/wayback-machine): The Wayback Machine is the Internet Archive’s public archive of the web. You give it a URL and it shows captures over time, when it has them. It is free. A CDX API lists capture timestamps for people who need more than the calendar view. Not every page was saved, and a capture is what the archive fetched, not a notarized original. Pricing: Free. Reviewed: 2026-10-15.
- [WhatsMyName](https://osint-daily.com/tools/whatsmyname): WhatsMyName is a free community dataset, started in 2015 by Micah Hoffman, that records how to check whether a username exists on a site. The list is published on GitHub under CC BY-SA 4.0, and other username tools consume it. A match is a URL to open. It does not prove two accounts belong to one person, and a site that answers every name with a success page still creates a false positive. Pricing: Free. Reviewed: 2026-10-15.
- [WiGLE](https://osint-daily.com/tools/wigle): WiGLE is a worldwide database of wireless networks, built from files volunteers upload. The site offers web search, an Android app, and an API, and you register for an account. Search fields include latitude, longitude, SSID, and BSSID. A pin is a network someone submitted. It does not prove who owns the router, and it is not a person’s location. Pricing: Free. Reviewed: 2026-10-15.

## Guidance
- A username hit, a breach row, or a scan is a lead. It is not an identity and it is not proof.
- Paid tools with no public price are described as quote-based. This file does not invent prices.