Lookup
A domain, IP address, URL, file hash or CVE id. Results come from public sources and our own data; the link is shareable.
Extract IOCs
Paste any text (a report, an email, logs) and pull out the indicators in it. Defanged input like hxxp and [.] is read correctly.
Email header analyzer
Paste the raw headers of a suspicious email to see where it came from and whether it passed authentication. Nothing is fetched.
Image metadata
Pick a photo to see the camera, times and GPS location stored inside it. The file stays on your device.
Most social platforms (Facebook, Instagram, X, WhatsApp, Telegram, Signal) strip metadata when a photo is uploaded, so a missing location often means it was removed, not that it never existed. Originals sent as files or by email usually keep it. Only look at photos you have the right to examine.
Encode and hash
Base64, URL and hex encode or decode, and MD5, SHA-1, SHA-256 and SHA-512 of text or a local file.
A local file
Files up to 50 MB are hashed on this device; nothing is uploaded.
Time and sun position
Convert epoch, ISO 8601 and RFC 2822 times between UTC and a time zone, and work out where the sun was, for dating and placing a photo.
Sun position
Where the sun was at the time above, at a place. Useful to check a photo's claimed time and location: the shadows must point away from the sun and match the length ratio.
OSINT tools
Free tools for going further, grouped by what you are looking at. Links only; nothing here is fetched.
Domains & DNS
- DNSDumpsterMap a domain's DNS records and hosts.
- SecurityTrailsHistorical DNS and subdomain data (free tier).
- ViewDNS.infoReverse IP, DNS and WHOIS utilities.
- who.isWHOIS and registration lookups.
- dnstwistLook-alike domain generator (open source).
IP & infrastructure
- ShodanSearch engine for internet-connected devices.
- Censys SearchHosts and certificates seen on the internet.
- BGP.toolsASNs, prefixes and peering.
- Hurricane Electric BGP ToolkitASN, prefix and IP lookups.
- GreyNoise VisualizerIs an IP mass-scanning the internet?
Certificates
- crt.shCertificate Transparency log search.
- Censys CertificatesSearch certificates by name, issuer or host.
- SSL LabsTest a server's TLS configuration.
Threat intel & IOCs
- abuse.ch ThreatFoxCommunity indicators of compromise.
- URLhausMalware distribution URLs.
- AlienVault OTXOpen threat exchange pulses and indicators.
- VirusTotalScan files, URLs, domains and IPs with many engines.
- urlscan.ioScan and screenshot a URL, see what it loads.
- PhishTankCommunity-verified phishing URLs.
Malware analysis & sandboxes
- MalwareBazaarMalware sample database by hash.
- ANY.RUNInteractive online sandbox (free tier).
- Hybrid AnalysisFree automated malware analysis.
- TriageMalware sandbox with config extraction.
- CAPE SandboxOpen-source malware sandbox with payload extraction.
Company & corporate records
- SEC EDGARUS public company filings.
- OpenCorporatesOpen database of company registrations worldwide.
- Companies HouseUK company register.
- GLEIF LEI SearchLegal entity identifiers and ownership links.
- OpenSanctionsSanctions lists and politically exposed entities.
Archives
- Wayback MachinePast snapshots of web pages.
- archive.todaySave and view page snapshots.
- Common CrawlOpen web crawl archive and index.
Maps, imagery & geolocation
- OpenStreetMapOpen map data.
- Overpass TurboQuery OpenStreetMap features.
- Sentinel Hub EO BrowserFree satellite imagery browser.
- NASA WorldviewDaily satellite imagery and fire data.
- SunCalcSun position and shadows for dating photos.
Aviation & maritime tracking
- ADS-B ExchangeUnfiltered live aircraft tracking.
- Flightradar24Live flights worldwide.
- MarineTrafficLive ship positions.
- VesselFinderVessel tracking and port calls.
Reference & frameworks
- OSINT FrameworkTree of free OSINT tools by category.
- Bellingcat Online Investigation ToolkitBellingcat's curated tool list.
- MITRE ATT&CKAdversary tactics and techniques.
- CISA KEV CatalogKnown exploited vulnerabilities.