OSINT Toolbox

Open-source tools for checking the news yourself. Verify, don’t just read.

New to this? Key terms for this page

OSINT: Information gathered from public sources such as news, social media, satellite imagery and ship or flight trackers.
GEOINT: Analysis of imagery and location data, such as satellite photos, to describe activity on Earth.
SIGINT: Intelligence from intercepting communications or electronic emissions such as radar.
AIS: Transponders on ships that broadcast identity and position. Switching one off hides a vessel's movements.
SAR: Radar carried on satellites or aircraft that makes images day or night and through cloud.

Conflict, geodata & GNSS

GPSJam
Daily map of GPS/GNSS interference derived from aircraft data — where jamming and spoofing are happening.
Copernicus Browser
Free Sentinel satellite imagery from the EU programme — check for yourself what changed on the ground.
Sentinel Hub EO Browser
Free Sentinel satellite imagery — check for yourself what changed on the ground.
NASA FIRMS
Near-real-time active fire / thermal anomaly data; useful for verifying strikes and burns.
DeepStateMap
Frontline map of the war in Ukraine.
Live Universal Awareness Map
Crowd-sourced conflict event map. Verify before relying on single posts.
Bellingcat Online Investigation Toolkit
Curated, maintained list of open-source investigation tools.
Maxar Open Data
High-resolution imagery released for major crises and disasters.
USGS EarthExplorer
Landsat and other public satellite and aerial archives.
ACLED
Armed Conflict Location & Event Data — comprehensive conflict mapping database.
Conflictly
Free live map and feed of active conflicts. Check its sources before relying on a single item.
IntelMapper
Open-access map of bases, flights and ports for tracking military posture.
OpenGridWorks power plants map
Power plants and grid infrastructure on OpenStreetMap data; useful context for strikes on energy sites.

Cylist
Threat intelligence triage for SOC analysts: IPs, domains, URLs and file hashes with AI-generated verdicts and case reports.
CISA Known Exploited Vulnerabilities
Authoritative list of vulnerabilities exploited in the wild, with federal deadlines.
NVD
CVE details and CVSS scores.
MITRE ATT&CK
The common language for attacker tactics and techniques — the best single thing to learn.
VirusTotal
File, URL, domain and IP reputation.
urlscan.io
Safely inspect what a URL loads.
Shodan
Search engine for internet-exposed devices.
Censys Search
Internet-wide host and certificate search.
ransomware.live
Tracker of ransomware group leak-site victims.
Have I Been Pwned
Check exposure in known breaches.
SOCRadar cyber conflict dashboard
Vendor dashboard of hacktivist and state-linked cyber activity in the Iran–Israel conflict. Vendor data, so treat counts as indicative.
SitDeck
Customisable situational-awareness dashboard mixing conflict, cyber, markets and weather feeds (free tier).

Wayback Machine
Archived copies of pages — essential for verification.
Who.is / WHOIS lookup
Domain registration data.
crt.sh
Certificate transparency search — find subdomains and lookalike domains.
TinEye
Reverse image search for verifying where a photo came from.
OSINT Framework
Browsable tree of OSINT tools by category.
IntelligenceX
Search engine for leaked data, Tor sites, public documents and more.

Counted from this page. Select one to filter.