Top 10 OSINT (Open Source Intelligence) Software Tools

Maltego is a Java application that claims to simplify and expedite your investigations, thanks to its access to databases and visualization tools. Whether you’re in trust and safety, law enforcement or cybersecurity, the company lets you run one-click investigations that deliver easy-to-understand results.

At the time of writing, Maltego lets you view up to one million entities on a graph, with access to 58 data sources. You can even connect your own public databases and upload data sources manually.

Once all the information is loaded in the program, you can choose from different visualization layouts, such as blocks, hierarchical or circular, using weights and notes to adjust the graphs.

Finally, Maltego isn’t just a great tool; the company also has a collection of hand-picked resources on OSINT tools and techniques to help you get more from the product. There is even a Maltego Foundation course you can purchase online.

Best for

Visual link analysis across large data sets.

Limitation

The graph-based interface has a learning curve for non-technical investigators.

Confirming someone’s identity by checking for linked social media and online platform accounts is becoming increasingly popular, for a number of good reasons:

• It’s a high barrier of entry for fraudsters, who don’t have the time or resources to create fake profiles.
• It’s a strong way to gather a user’s digital footprint.
• It can help establish an idea of someone’s socioeconomic background, even in markets where financial information is scarce.
• The type of social media linked to the user can reveal more about who they are.

Of course, you can manually search directly into your target network by typing a name into LinkedIn, Facebook or Twitter. For scalability reasons, however, it’s easier to use a specialist solution, and this is where SEON shines.

SEON builds a digital footprint from four core signals: email, phone, IP and device. When you send an email address, it checks it in real time against hundreds of digital properties, from social networks to work tools, to see whether a registered account exists. That answers a question reputation-based vendors struggle with: is this identity brand new, or does the rest of the internet already know it? Since many fraud attempts use freshly created data, no history is often the clearest red flag.

The platform also draws on data breach records and a cross-client consortium, flagging an email, phone or IP that another customer has already marked as fraudulent. All signals feed one real-time scoring engine, producing an IP fraud score and wider risk assessment, so a weak device signal combined with a bad email can add up to a confident decision.

Best for

Real-time onboarding and social/digital footprint analysis.

Limitation

Purpose-built for fraud and anti money laundering (AML) use cases rather than general-purpose investigation.

Lampyre is a paid application designed specifically for OSINT. It’s particularly useful for due diligence, cyberthreat intelligence, crime analysis and financial analytics. You can install it on your PC or run it online.

The key selling point of Lampyre is that it’s a one-click application. Start with single data points such as a company registration number, full name or phone number, and Lampyre will sift through huge amounts of data to extract interesting information.

The company automatically processes 100+ regularly updated data sources, and you can access them via PC software or API calls if needed. The SaaS product is called Lighthouse, and you pay per API call.

An important point here: as with many OSINT tools, you have to perform your due diligence to check if the databases are really open source. Lampyre may automate searches, but you may still have to double-check where the information comes from, as well as who exactly it is that is sourcing it for you, as one researcher found out.

Best for

One-click due diligence and financial analytics.

Limitation

You may need to verify that underlying sources are genuinely open.

Search engines such as Google, Bing or DuckDuckGo are perfectly adequate free OSINT tools. That is, if you know how to use advanced filters. In short, it’s about refining your search to benefit from the indexing power of some of the best algorithms on the planet.

Over the years, talented investigators have learned how to reverse-engineer search engines. The method is called Google dorking, or Google hacking, and it uses search operators or functions to expand the capacity of the tools (it works with search engines beyond Google, too).

The method is controversial because it may cross the line in terms of how “public” the information is. For instance, you may find a link to a PDF file containing a list of passwords, but downloading it may be a prosecutable offense.

Best for

Free, ad hoc lookups by skilled investigators.

Limitation

No automation, and advanced operators carry legal grey areas.

Recon-ng initially started as a free and open source script for gathering technical information about website domains. Since its creation, it has evolved into a full framework, which you can access via a command-line interface on Kali Linux, or as a web application.

Its interface is similar to Metasploitable, another computer security project designed for penetration testing, and has similar goals: to assess and identify web vulnerabilities. Its features include GeoIP lookup, DNS lookup and port scanning, among others.

While it’s certainly one of the more technical tools featured on this list, you’ll find plenty of resources online to learn how Recon-ng can locate sensitive files such as robots.txt, identify hidden subdomains, look for SQL errors and get information about a company’s CMS or WHOIS.

Best for

Technical reconnaissance of website domains.

Limitation

Command-line framework aimed at security professionals.

SpiderFoot is an OSINT tool designed specifically for investigation professionals. It’s loved by cybersecurity intelligence experts who need to perform regular asset discovery or attack surface monitoring. SpiderFoot was acquired by Intel471 in November 2022, with the company announcing that it plans to integrate SpiderFoot’s capabilities into its solutions.

The tool can access hundreds of open data sources and monitor the results in real time. The key difference with other OSINT tools, however, is how you can use SpiderFoot: you can choose to self-host it as a true open source version. You can also purchase the hosted version, which is completely managed by SpiderFoot.

There are numerous advantages to the latter. For instance, you’ll get better performance, full team collaboration and the ability to see correlations in your investigation. All the modules and third-party tools will come preinstalled and preconfigured.

Best for

Asset discovery and attack surface monitoring.

Limitation

Full value depends on the managed hosted version.

When it comes to checking US citizens’ records, there are plenty of services offering more or less the same features at the same price range. You might hear of BeenVerified, Pip or Intelius, for example.

Spokeo offers an easy-to-use interface, and the results seem to be more accurate upon testing. You can also use Spokeo as a reverse email lookup, phone lookup tool and postal address lookup, to get info based on a single data point.

The service is available online, and there’s even an Android app to perform searches directly from your smartphone. You’ll be able to access billions of records such as property deeds, court records and even historical records and social networks.

Best for

US consumer and public records lookups.

Limitation

Coverage is US-focused.

We’ve previously written about how you can use an email data breach for user verification, but it’s particularly useful when looking at whether an email address exists or not. In fact, you can even infer how mature the address is depending on which data breach it’s been found in. 

Have I Been Pwned? is still the best site to quickly search for email addresses that appear in said data leaks (you can now also do the same with phone numbers). Best of all, it’s completely free.

Best for

Fast, free data breach checks on an email or phone. 

Limitation

Single-purpose; no wider investigation features.

You may need to be rather tech-savvy to use it, but you’ll be hard-pressed to find a better open-source tool for OSINT for reverse phone lookups. 

The tool squeezes as much information as you can imagine from a phone number, and it works for every location worldwide. 

Note, however, that unlike with SEON’s tool, you don’t get reverse social media lookup to learn which networks the user has registered to with their phone number.

Best for:

Free, worldwide reverse phone lookups.

Limitation

Requires technical setup and offers no social media lookup.

Email Hippo, which you can also access through VerifyEmailAddress.io, has been operating since 2009. However, it recently underwent a complete overhaul and is now far from free and open.

Instead, the solution is split into CORE, MORE, ASSESS and WHOIS, covering use cases such as data enrichment for investigations, marketing and fraud prevention.

Unfortunately, this sea change in the way the product positions itself has rendered it much more complicated to comprehend. However, the free trial does not require a credit card and lasts 14 days, which can help you figure out whether it is for you.

Best for

Email validation and MX record checks.

Limitation

No longer free or open, and the tiered structure adds complexity.