Open source intelligence
The internet leaves clues.
Investigate them.
A free OSINT intelligence platform for cybersecurity researchers, investigators, and digital footprint research.
Paste anything. The platform identifies what it is and routes it to the right modules. No account needed, no API key needed, nothing to buy.
- Verified
- observed directly from an authoritative source
- Inferred
- derived from other evidence by a stated rule
- Possible
- matches, but is not corroborated
- No data
- stated plainly, never invented
Intelligence modules
Each module collects from independent public sources and normalises the result into findings with a source, a confidence level and a verification status.
Email Intelligence
Provider classification, mail routing, SPF, DKIM, DMARC, DNSSEC and public exposure.
02Phone Intelligence
E.164 normalisation, numbering-plan validity, country and line type, with no ownership claims.
03Username Intelligence
Presence across documented public platforms, with evidence and explicit coverage gaps.
04Domain Intelligence
Full DNS, RDAP registration, certificate transparency, subdomains and hosting.
05IP Intelligence
Network allocation, ASN, RIR, reverse DNS and reputation across independent sources.
06URL Intelligence
Redirect chains, headers, TLS, technology fingerprinting, behind a strict SSRF policy.
Built around evidence, not answers
Most lookup tools hand you a verdict. An investigation needs the opposite: the observation, where it came from, and how much weight it can carry.
These four rules are enforced in the code and the database schema, not just described here.
- 01
A failed lookup is not a negative result
If a DNS query errors, the finding reads 'could not be determined', not 'not published'. If a platform returns 403 to a username probe, the answer is 'undetermined', not 'no account'. Absence of evidence is never dressed up as evidence of absence.
- 02
Disagreement is preserved, not averaged
Reputation sources keep their own verdicts. When one feed says clean and another says malicious, both are shown side by side and the confidence drops. Blending them into a score would destroy the most useful thing an analyst can learn.
- 03
Entities merge only on exact identifiers
The same email address, domain, IP or certificate fingerprint. Never a name, a display name or a photograph. A handle existing on several platforms is explicitly not treated as proof that one person holds them.
- 04
Every edge states its evidence
Each relationship in the graph carries a written explanation naming the shared identifier it rests on. The database column is NOT NULL: an edge that cannot be justified in a sentence is not an edge this platform will draw.
How an investigation runs
- 01
Identify
The target is classified and normalised.
- 02
Collect
Applicable providers run in dependency stages.
- 03
Normalize
Results become findings with sources attached.
- 04
Correlate
Entities merge on exact identifier matches only.
- 05
Verify
Independently corroborated facts are promoted.
- 06
Report
Graph, timeline, evidence vault, exportable report.