Top 10 OSINT Tools for Corporate and Security Investigations

A supplier’s website, a director’s online profile and an unfamiliar domain can each raise questions before a deal. The investigation may need to establish who controls the business, whether its claims hold up or which digital assets belong to it. Different tools answer different parts of that assessment.

OSINT tools accelerate the collection, comparison and preservation of information from public sources. Some map relationships. Others search internet infrastructure, locate online accounts or recover earlier versions of websites.

This guide compares 10 tools across those tasks. Each appears in the Molfar Intelligence Institute’s OSINT catalogue. Selection reflects documented capabilities, access requirements and investigative use rather than a universal performance ranking.

The Top 10 OSINT Tools at a Glance

• Maltego: visual link analysis across people, companies and digital identifiers.
• SpiderFoot: automated collection from multiple sources.
• Shodan: research into internet-facing devices and services.
• Censys: internet infrastructure and certificate research.
• Intelligence X: identifier searches across indexed and historical datasets.
• WhatsMyName: discovery of public accounts by username.
• TinEye: reverse image search for reused or modified photographs.
• ExifTool: inspection of metadata in images, videos and documents.
• Hunchly: capture and organisation of online research.
• Wayback Machine: retrieval of historical website content.

The list covers several stages of an investigation. A team researching corporate ownership will need different sources from one assessing network exposure or verifying a photograph.

What Are OSINT Tools?

OSINT tools are applications, search engines and services used to collect or examine information from openly accessible sources. Those sources can include websites, company filings, public profiles, technical records, documents and archived pages.

Some tools are open-source software, but the two terms describe different things. Open-source intelligence concerns the information being researched. Open-source software concerns access to a program’s code. A commercial product can therefore be an OSINT tool.

Our guide to what OSINT is explains how collection, verification and analysis turn source material into an assessment.

1. Maltego: Best for Visual Link Analysis

Access: a limited free Basic plan and paid plans. Data access depends on the subscription and connected providers.

Maltego represents people, companies, domains, email addresses and other identifiers as entities in a graph. Its transforms query connected sources and return additional entities or relationships. Analysts can also import information they have collected separately.

This makes it useful when an investigation spans several businesses, websites or individuals. A graph can help organise shared addresses, contacts and infrastructure so the analyst can examine each connection.

The significance of a connection still requires assessment. Two websites using the same hosting provider do not necessarily share an owner. Record the source, date and meaning of each material relationship before including it in a report.

2. SpiderFoot: Best for Automated Collection

Access: free, open-source software. Some integrations require API keys or paid data subscriptions.

SpiderFoot automates searches across multiple sources using identifiers such as domains, IP addresses, email addresses and usernames. Its modules collect different types of information, which analysts can review through a browser interface or export for further work.

The tool can reduce repetitive searches during an initial assessment. It is particularly useful when a team needs to examine several identifiers and organise the resulting associations.

Collection settings matter. Some modules query third-party datasets; others interact with the target’s infrastructure. Configure the collection method to match the investigation’s scope. Review module compatibility, source availability and returned records before relying on the output.

3. Shodan: Best for Internet-Facing Asset Research

Access: limited free functionality, paid membership and subscription products.

Shodan indexes information about internet-connected devices and services. Analysts use it to examine publicly observable service details and research an organisation’s external network exposure.

For corporate security teams, it can help identify services associated with known network ranges. It can also contribute technical context during research into suspicious websites or infrastructure.

Check when the service was observed and whether the asset still belongs to the organisation under review. Hosting arrangements change, and an indexed record may describe an earlier configuration. A visible service or software version requires further assessment before it can be reported as a confirmed vulnerability.

4. Censys: Best for Infrastructure and Certificate Research

Access: account-based access, with search allowances and capabilities varying by plan.

Censys maintains searchable information about internet infrastructure, including hosts, services and certificates. Analysts can examine technical characteristics and investigate possible relationships among digital assets.

Certificate information can help identify additional domains worth researching. Infrastructure records can also help a security team compare an organisation’s declared assets with those visible online.

Shared technical characteristics require careful interpretation. A certificate, IP address or hosting service may connect unrelated customers. Compare findings with website content, registration information and other relevant records before attributing several assets to one operator.

5. Intelligence X: Best for Historical Identifier Searches

Access: restricted public and free account access, alongside paid research, API and enterprise plans.

Intelligence X is a search engine and data archive. It searches using specific identifiers, including email addresses, domains, URLs, IP addresses and Bitcoin addresses. Its indexed sources include historical records, document-sharing platforms and publicly circulating datasets.

It can help locate earlier references to an identifier or examine whether a company domain appears in an indexed exposure. Historical material may suggest further sources or connections to investigate.

Review the original context and date. A record may be outdated, duplicated or inaccurately labelled. Appearance in a dataset establishes that the identifier occurs in that material; further evidence is needed to determine what that means for the subject.

6. WhatsMyName: Best for Username Discovery

Access: a free browser interface built on a community-maintained dataset.

WhatsMyName checks whether a username appears across hundreds of public websites. The dataset records how supported sites identify existing accounts, while its browser interface runs the checks and returns possible matches.

It is a practical starting point when an investigation begins with a distinctive handle. Relevant results can reveal other public profiles or suggest alternative names to research.

Matching usernames require identity verification. Compare profile links, photographs, activity dates and other identifiers. Coverage also has limits: sites requiring login, profiles using numeric IDs and platforms that change their response behaviour may be missed.

For a wider selection of account and platform tools, see our guide to OSINT tools for social media.

7. TinEye: Best for Finding Reused Images

Access: a public search service, with commercial products and API access available under separate terms.

TinEye searches by image rather than by keywords. It can locate indexed copies of a photograph, including versions that have been resized, cropped or modified.

This helps investigators examine whether a supplier’s project photograph appears elsewhere or whether a profile image originated from another page. Results can also identify a higher-resolution copy for closer inspection.

The earliest indexed result may not be the original publication. Review the hosting page, publication context and available dates. An unsuccessful search means TinEye found no matching image in its index; it does not establish that the photograph is unique.

8. ExifTool: Best for Metadata Inspection

Access: free, open-source command-line software.

ExifTool reads metadata from many image, video and document formats. Depending on the file, that metadata may include timestamps, device details, editing software, author fields or GPS coordinates.

Analysts can use it to examine a supplied file or compare related documents. Metadata may suggest a chronology or identify details that deserve further verification.

Preserve the original file when possible and document its source. Platforms may remove metadata during upload, while users and software can change it. Corroborate important fields with publication history, visible content or other records.

9. Hunchly: Best for Capturing Online Research

Access: paid local and cloud options, with a trial.

Hunchly captures pages during online research and records URLs, timestamps and hashes. Analysts can organise captures with tags and notes, search the collected material and assemble reports.

This is useful when a website changes during an investigation or another reviewer needs to understand how a finding was obtained. Captures retain more context than an isolated screenshot.

Review capture completeness, particularly on dynamic pages. A preserved page documents the material collected at that time. The analyst must separately assess whether its claims are accurate and relevant.

10. Wayback Machine: Best for Website History

Access: free.

The Internet Archive’s Wayback Machine retrieves historical captures of websites. Analysts can compare earlier descriptions of a business, former team pages, contact details or claims that have since changed.

That history can help establish when a statement appeared and whether a company presented its activities differently in the past. Save Page Now can also create a public capture of an accessible page.

Archive coverage is incomplete. Images, interactive elements and pages requiring authentication may be missing. Record the capture date and distinguish it from the page’s claimed publication date. Review several captures when a change is material to the investigation.

How to Choose the Right OSINT Tools

Start with the question and the identifier already available.

For a username, WhatsMyName is a useful discovery tool. For an image, start with TinEye and inspect the original file through ExifTool where available. For a domain or IP address, Shodan and Censys can add technical context.

Use SpiderFoot when repeated searches justify automation. Maltego helps organise relationships that span several sources. Intelligence X and Wayback Machine can add historical material, while Hunchly records the research as it develops.

Before buying a subscription, check source coverage, export options, usage limits and the cost of connected datasets. Test the product against a defined task and assess how much manual verification remains.

Example: Checking a Supplier Before a Contract

Consider a hypothetical UK buyer assessing a supplier that claims an established operating history, experienced directors and completed projects.

The analyst first confirms the legal entity and relevant company identifiers. Wayback Machine then helps examine earlier versions of the supplier’s website. TinEye can test whether project photographs appear on other sites, while ExifTool may reveal useful fields in original documents.

WhatsMyName can suggest additional public profiles linked to a known handle. Maltego can organise verified relationships among directors, businesses and domains. Hunchly records the source pages used in the assessment.

The report should explain which claims were confirmed, which remain unsupported and which findings could affect the contract decision. An older photograph might be licensed marketing material; a shared address might belong to a serviced office. Investigators need to test those explanations.

For the methods behind that verification, see our guide to OSINT techniques.

Frequently Asked Questions

What is the best free OSINT tool?

The choice depends on the task. WhatsMyName searches for usernames, ExifTool reads metadata and Wayback Machine retrieves website history. SpiderFoot automates collection, although some sources require separate access.

Are paid OSINT tools better than free tools?

Paid products may add data access, automation, collaboration or reporting functions. Compare those benefits with the actual research requirement. A narrowly focused free tool may answer an individual question effectively.

Can OSINT tools verify someone’s identity?

They can locate possible associations among accounts, names and identifiers. Identity verification requires examining whether those records refer to the same person, when the association was valid and which independent evidence supports it.

Can OSINT tools replace an analyst?

Tools collect, structure and preserve information. An analyst assesses source quality, tests alternative explanations and determines how the findings affect the decision.

Molfar Intelligence conducts due diligence, corporate investigations and risk assessments using public and commercial sources. The reporting identifies material findings, documents their evidence and explains uncertainty that could change the client’s decision.

What are the best free OSINT tools for beginners researching a company?

WhatsMyName helps locate public accounts linked to a known username. Wayback Machine reveals earlier versions of company websites, while ExifTool reads metadata from available documents and images. Start with the company’s legal name, registration number and official domain. Compare discoveries with authoritative records before drawing conclusions.

Which OSINT tools can find social media accounts by username across multiple websites?

WhatsMyName checks a username across hundreds of supported public websites. Its results identify possible profiles for further research. Compare profile links, photographs, activity dates and published contact details to establish whether accounts belong to the same person. Common usernames and copied content can produce misleading matches.

Which OSINT tools help verify a supplier’s website history and project photographs?

Wayback Machine can reveal earlier company descriptions, team pages and project claims. TinEye searches for indexed copies of project photographs, while ExifTool examines metadata when original files are available. Hunchly captures the pages used during research. Compare findings with project dates, client references and other independent evidence.

What OSINT tools can help assess a company’s internet-facing infrastructure before an acquisition?

Shodan and Censys help research publicly observable hosts, services and certificates. SpiderFoot can automate selected searches, while Maltego organises relationships among the resulting identifiers. Confirm asset ownership and observation dates before reporting exposure. These findings inform technical due diligence; a full assessment also requires internal records and authorised security testing.