Best OSINT tools 2026: what analysts actually run

The OSINT stack most analysts actually run in 2026 is small: Maltego for graph pivoting, Shodan for exposed services, SecurityTrails for DNS history, theHarvester for passive recon, VirusTotal for indicator triage, DarkOwl for dark-web coverage, and BGPView plus the Wayback Machine for attribution and proof. Everything else is either a wrapper around those same sources or a budget line you cannot defend.

What are the best OSINT tools in 2026?

Twelve tools cover almost all of the work. The table below is organised by what each one is actually for, what it costs, and the question most buyer’s guides skip: what the vendor or the upstream source learns about your investigation when you run a query.

Tool	Best for	Cost	Access	What your query leaks
OSINT Framework	Source discovery and routing	Free	Static web directory	Nothing. No account, no server-side query
theHarvester	Passive domain and email recon	Free, open source	CLI	Every upstream source it queries sees your origin
SecurityTrails	DNS, WHOIS and certificate history	Freemium	Web and API	Logged by the vendor, now part of Recorded Future
BGPView	ASN and routing attribution	Free	Web and API	Logged, but the lookup reveals little intent
Shodan	Exposed services and device discovery	Freemium	Web and API	All searches are logged and credit-metered
Maltego	Graph pivoting and link analysis	Freemium	Desktop and API	Transforms route through Maltego and each provider
VirusTotal	File, URL and indicator triage	Freemium	Web and API	Submissions are visible to other subscribers
Wayback Machine	Temporal validation and evidence capture	Free	Web and CDX API	Minimal. No account required to read
Google advanced operators	Targeted discovery of indexed material	Free	Web	Tied to whatever Google session you are in
DarkOwl	Dark-web and closed-forum index	Paid	Web and API	Logged under vendor policy
Recorded Future	Enrichment and scoring at scale	Paid	Web and API	Logged under vendor policy
Sintelix	Multi-source fusion for large teams	Paid	Self-hosted and web	Self-hosting removes the third party entirely

One structural note before the profiles. SecurityTrails and Recorded Future are not independent options: Recorded Future acquired SecurityTrails in a 65 million dollar deal and the DNS data now feeds the larger platform. If you are pricing both, you are pricing one vendor twice.

What does each OSINT tool actually do?

OSINT Framework

OSINT Framework is a community-maintained directory that routes an investigative question to the right specialist tool. It collects nothing itself, which is exactly the point: it is a static site, so there is no account, no rate limit, and no record of what you were looking for. Use it when you know the question but not the source. Its limit is that it will never automate anything for you.

theHarvester

theHarvester collects subdomains, hosts, email addresses and open ports from search engines, certificate transparency logs and DNS datasets. It ships with Kali, runs from the command line, and slots into the first five minutes of a domain investigation without configuration. The OPSEC cost is real and often missed: theHarvester does not query the target, it queries dozens of third-party sources on your behalf, and each of those sees where the request came from.

SecurityTrails

SecurityTrails holds historical DNS records, passive DNS, WHOIS history and certificate transparency data behind a web interface and a REST API. History is the reason to use it. Current DNS tells you where infrastructure points today, and a threat actor who rotated hosting last month is invisible in current records but obvious in the historical set. Free-tier rate limits are tight enough that any repeatable pipeline will need the paid plan.

BGPView

BGPView maps an IP address to the autonomous system, prefix and organisation actually responsible for it. It is narrow and it is free, and it settles the single most common attribution mistake in ransomware work: assuming the hosting reseller named in WHOIS is the party that matters. The JSON API makes it trivial to script as an enrichment step.

Shodan

Shodan indexes banners, open ports, TLS certificates and device metadata across the public internet. It is the fastest route from an IP range to a picture of what is actually exposed on it. Understand the credit model before you build anything on it: Shodan’s documentation states that one query credit returns 100 results, credits renew monthly, and filtered searches consume them while a plain first-page search does not. Every search is logged, which matters when the infrastructure you are enumerating belongs to someone who might be watching.

Maltego

Maltego turns identifiers into a graph. Transforms fetch related data from dozens of providers, and the canvas shows relationships that a spreadsheet of the same facts hides. It remains the standard for link analysis because the transform model matches how analysts already pivot. The Community Edition is enough to learn the tool and to run small cases. Our Maltego tutorial walks through building a defensible link chart from a single selector, and our comparison of Maltego, SpiderFoot and Recon-ng covers when a different framework fits better.

VirusTotal

VirusTotal aggregates verdicts from many antivirus engines and sandboxes, which makes it the quickest triage step for a file, URL, IP or domain. The paid Intelligence tier adds retrohunt, YARA hunting and structured export. The rule that matters more than any feature: anything you submit becomes visible to other subscribers. Uploading a sample from a live client incident is a disclosure decision, not a lookup.

Wayback Machine

The Internet Archive’s Wayback Machine holds dated snapshots of pages that have since changed or disappeared, and its CDX API exposes snapshot metadata programmatically. In practice it is an evidence tool rather than a discovery tool. When a company quietly edits a security statement, or a leak site rewrites a victim listing, the archived copy is what makes the claim survive contact with a lawyer. Coverage is broad but not complete, and robots.txt exclusions leave gaps.

Google advanced operators

Operators like site:, filetype:, intitle: and inurl: still surface exposed configuration files, open directory listings and misconfigured endpoints that no paid platform indexes as such. The technique costs nothing and works in the first ten minutes of almost any investigation. It also has the worst OPSEC profile on this list, because the queries sit in whatever Google account and browser profile you happen to be signed into.

DarkOwl

DarkOwl maintains an index of dark-web forums, paste sites and closed leak repositories, with alerting on newly indexed content. This is the category where free tooling genuinely cannot substitute: you are paying for continuous collection from sources that require access, persistence and operational risk to reach. For credential exposure specifically, check our own StealerCheck data before committing to a subscription, since infostealer logs account for a large share of what turns up in these indexes.

Recorded Future

Recorded Future combines analyst-curated content with broad commercial collection and a risk-scoring layer that cuts triage time on high-volume indicator feeds. It integrates with SIEM and SOAR platforms through its API. It is built for security operations teams processing volume, not for an individual investigator running ad hoc queries, and the pricing reflects that.

Sintelix

Sintelix is a multi-source fusion suite with configurable ingest and a knowledge graph that persists entity relationships across collection cycles. The reason it appears here rather than in the enterprise footnote is the self-hosted deployment option, which is the only architecture on this list that removes third-party query logging outright. The learning curve is steep and it only pays back for teams with dedicated analysts.

How do you choose an OSINT tool?

The only selection criterion that survives contact with real casework is whether the output slots into the workflow you already have. A platform that covers more sources but forces you to rebuild your collection logic around its constraints makes analysts slower, not better. Work through six questions before a trial, not after:

1. Which data types does the mission actually need? DNS history, dark web, routing, identity records. Map these first, then shortlist.
2. Does it export into your case file? JSON, CSV, STIX or GraphML that your reporting tooling already reads.
3. Can it be scripted? A tool without an API is a tool that stays manual forever.
4. Where does the data come from, and how fresh is it? Ask the vendor directly. An answer they cannot give is itself the answer.
5. Are analyst queries logged, and for how long? Then ask whether those logs are shared or sold.
6. Does the licence permit your use case? Commercial investigation, government work and academic research are not interchangeable in most terms of service.

Three answers should end a trial early: undocumented collection practices, results with no provenance metadata, and a vendor who cannot say how long query logs are retained.

What does an OSINT workflow look like in practice?

Tools matter less than the order you run them in. These four chains cover most of the casework that comes through a threat-intelligence desk. Our guide to building an OSINT investigation workflow covers the intake and reporting stages that sit either side of them.

Domain reconnaissance. theHarvester first, for subdomains, hosts and addresses. Then SecurityTrails for DNS and certificate history, BGPView to resolve the discovered IPs to a responsible ASN, and Shodan across those ranges for exposed services. Not one step in that chain sends a packet to the target.

Attribution and enrichment. Here the order matters less than knowing when to stop. Begin with routing data, add certificate transparency records, pivot in Maltego on WHOIS and DNS transforms, and watch whether the graph converges on an owner. Often it will not. Saying so in the report is worth more than reaching for the nearest plausible name.

Account triangulation. A matching handle is not evidence. Route through OSINT Framework to the platform-specific search tools, then corroborate against creation dates and posting history before anything goes in writing. Handle collisions are common enough that most experienced analysts have been burned by one. Our write-ups on pivoting on threat-actor handles and social media OSINT from X to Telegram go deeper on both.

Leak and exposure triage. DarkOwl for the organisation’s domain and known address patterns, then the question that actually changes the remediation: did these credentials come out of a breach of the organisation, or off an infostealer on somebody’s personal machine? Timestamp and source each hit as you find it, not afterwards.

One discipline applies to all four. Treat each tool’s output as a hypothesis until a second independent source confirms it. Misattribution is the most common failure in multi-tool work, and it almost always begins with an analyst accepting one platform’s confident-looking answer without a second read.

When is a paid OSINT tool worth paying for?

Buy when the data does not exist for free, not when the free version is merely inconvenient. Three conditions justify the invoice: coverage of sources that require access rather than crawling, history depth that free tiers truncate, and rate limits that block a pipeline you actually run in production. Everything else is a scripting problem.

For teams starting from zero, the free layer covers more than most procurement decks assume. Our OSINT 101 starter toolkit assembles a working stack at no cost, and it is worth exhausting that before writing a purchase order.

What OPSEC does OSINT tooling demand?

Every query you run is itself intelligence about you. That is the part tool comparisons routinely omit, and it is the part that gets investigations burned. Four practices, in order of how often they are skipped:

• Run investigations from dedicated accounts and a sanitised browser profile, never from the profile you are signed into personally.
• Prefer client-side or self-hosted tooling for sensitive targets, since the query never leaves your control.
• Never submit client or proprietary artifacts to shared-verdict platforms without an explicit disclosure decision.
• Log every query and its result as you go. Reconstructing provenance a month later is how defensible findings become unusable ones.

The most-cited reference on the ethics side, the Public-Private Analytic Exchange Program’s Ethical Frameworks in Open-Source Intelligence paper, hosted by DHS, does not hand you a rulebook. Its actual finding is the opposite: there is no universally accepted ethical framework for OSINT across the public and private sectors. What it does establish is the working principle most practitioners already operate under, that collection must not breach existing privacy law, must not be used maliciously, and must be necessary to the question being asked. Provenance discipline is what fills the gap the paper describes. Our OPSEC guidance for OSINT investigators covers the operational side, and OSINT fundamentals covers the discipline itself.

For structuring collection against adversary behaviour rather than against a tool list, MITRE ATT&CK’s Reconnaissance tactic (TA0043) is the useful overlay. It describes what an attacker gathers before intrusion, which is the same ground defensive OSINT covers from the other direction.

What we left out, and why

Palantir Gotham turns up on almost every list like this one. It should not. You do not evaluate Gotham, you enter a procurement cycle with it, and anyone in a position to do that already has people whose job is running that process. Nothing in this article helps them.

Pipl and the other identity-resolution services are a different problem. They work, which is the issue. Whether you are allowed to point one at a named individual depends on your jurisdiction, your sector and who is asking, and getting that wrong is not a tooling mistake. It belongs in a due-diligence workflow with legal review attached, not in a general recommendation.

Satellite imagery is a third discipline entirely, with its own tradecraft and its own analysts. Nobody picks a GEOINT provider in the same week they pick a Shodan plan.

The self-hosted OSINT projects circulating on GitHub were the harder call. Several are working on provenance tracking and local-first collection, which is the right problem to be working on. But a repository with single-digit stars and no release history is a research project, and building casework on one means you own the maintenance. That cost arrives later, usually during an investigation you cannot pause.

What we run ourselves

Ransomtracker is our own leak-site feed, StealerCheck answers whether a domain appears in infostealer logs, and the threat-group profiles hold the actor context. They slot into the chains above at the obvious points: Ransomtracker where you would otherwise be reading listings by hand, StealerCheck before you commit budget to a dark-web subscription you may not need. The methodology behind all three is in our piece on tracking ransomware infrastructure.

Frequently asked questions

Sources and further reading

• Ethical Frameworks in Open-Source Intelligence, Public-Private Analytic Exchange Program, hosted by DHS
• Reconnaissance (TA0043), MITRE ATT&CK
• theHarvester, Kali Tools documentation
• Credit types explained, Shodan Help Center
• Maltego Graph Community Edition, Maltego documentation
• Recorded Future acquires SecurityTrails, PR Newswire

Related Ransomnews coverage

• OSINT 101: a starter toolkit for 2026
• Multi-tool OSINT search: IntelX, SpiderFoot and Maltego
• Tracing ransom payments on-chain: a 2026 OSINT walkthrough
• OSINT.industries hands-on: usernames and emails