| | | | ---------------- | --------------- | | **Capabilities** | **Limitations** | | | | | | | | | | ### Summary Summarise the pros and cons of the tool and which part of the OSINT workflow it's most useful for. ### Ownership Explain who owns the tool (person/company) where they're from, where they're based, and any other useful information. ### Ethical Considerations Include bullet points of the ethical considerations for utilising this particular tool e.g. consider privacy and potential harm when sharing personal data. ### Related Tools: Include bullet points of similar OSINT tools. #### Sources Paste your source URLs here. # Track-Trace Tool Description : An online tracking and lookup service that helps users trace parcels and shipments using tracking numbers. | **Track-Trace** | **Quick Overview** | | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | URL |
**2. Review the tracking information and, where necessary, follow the link to the relevant carrier's tracking service. Record the identifier, result and date/time observed for reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
Free for basic tracking. Additional subscription/integration services are available.
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No for basic tracking.
### Cookies:
The site uses cookies associated with Google advertising and consent management, including \_\_gads, \_\_gpi, \_\_eoi, FCCDCF and FCNEC. These support advertising, ad measurement and the storage of privacy/consent preferences and are not directly related to shipment-tracking data.
### Use in Reporting
Track-Trace can be used to:
* Verify the status or movement of a parcel, shipment or postal item.
* Identify the carrier associated with a tracking identifier.
* Investigate publicly available information relating to a shipment or logistics movement.
* Track containers using standard container identifiers.
* Investigate air-cargo movements using available tracking information.
* Search bill-of-lading numbers associated with supported shipping companies.
* Document tracking identifiers, carrier information, shipment status and the date information was observed.
* Support investigations involving publicly observable logistics or supply-chain activity.
Reporting caveat: Remember that tracking results should be corroborated against the relevant carrier's official tracking system.
| **Capabilities** | **Limitations** |
| -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| Tracks shipments across multiple carriers from one interface. | Results depend on information supplied by the underlying carrier. |
| Supports parcel, postal and EMS tracking. | Not every carrier or shipment is necessarily supported. |
| Supports container and bill-of-lading tracking. | Tracking information can change or disappear over time. |
| Can automatically identify carriers from certain identifier formats. | A tracking result does not necessarily establish who owns or possesses a shipment. |
| Provides links to carrier tracking services and other logistics resources. | External carrier pages are outside Track-Trace's control and may have different availability or retention policies. |
### Summary
Track-Trace is a useful OSINT tool for quickly checking parcel and shipment information across multiple carriers and is best suited to verification and analysis within the OSINT workflow. However, results should ideally be corroborated with the relevant carrier’s official tracking system.
### Ownership
Owned and operated by Webfokus, a small Norwegian-based web development and online services provider.
### Ethical Considerations
* Treat tracking information as potentially sensitive, particularly where it could reveal someone's movements, address or activities.
* Do not assume that a tracking identifier establishes the identity of the sender or recipient.
* Cross-check significant findings against the underlying carrier's records where possible.
* Record the date and time because shipment status can change.
* Be aware that Track-Trace may redirect users to third-party carrier websites, whose privacy policies and data practices differ from Track-Trace's.
### Related Tools:
* [Maersk Tracking](/osint-tools/maersk-tracking)
* [Global Suppliers Online](/osint-tools/global-suppliers-online)
* [Import Yeti](/osint-tools/import-yeti)
* [MarineTraffic](/osint-tools/marinetraffic)
#### Sources
**2. Examine the railway network and available infrastructure information, such as track type, gauge, electrification, speed limits and operational status.**
**3. Record relevant locations, map features and observations, and corroborate important findings against additional authoritative sources before reporting them.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
May use standard website cookies. None noted during our site session on 24 August 2026.
### Use in Reporting
OpenRailwayMap can be used to:
* Identify railway lines, stations, junctions, bridges and tunnels in a specific geographic area.
* Establish the approximate location and characteristics of railway infrastructure.
* Examine track type, gauge, electrification and maximum-speed information.
* Identify operational, disused, abandoned or historical railway infrastructure where mapped.
* Cross-reference locations identified through satellite imagery, photographs, videos or other OSINT sources.
* Support geolocation and geographic analysis involving railway infrastructure.
* Provide contextual mapping evidence alongside other independently verifiable sources.
The platform has also been cited as a source in formal infrastructure and planning documentation, including a [Finnish Transport Infrastructure Agency report ](https://www.doria.fi/bitstream/handle/10024/193505/vj_2025-84eng_978-952-405-354-9.pdf?sequence=5)and a [UK Planning Inspectorate environmental statement.](https://nsip-documents.planninginspectorate.gov.uk/published-documents/EN010168-000677-6.3%20Appendix%2019-4%20Lime%20Down%20D%20Desk%20Study.pdf)
| **Capabilities** | **Limitations** |
| -------------------------------------------------------------- | ------------------------------------------------------------------ |
| Worldwide railway infrastructure coverage. | Coverage and accuracy depend on OpenStreetMap contributions. |
| Detailed railway-specific information. | Data may be incomplete or outdated. |
| Shows infrastructure such as tracks, stations and junctions. | Not all railway features will be mapped. |
| Provides information such as gauge, electrification and speed. | Mapping data should not automatically be treated as authoritative. |
| Useful for geolocation and infrastructure analysis. | | dilisense | Quick Overview |
| URL | https://dilisense.com/en |
| What it does | Searches consolidated sanctions, Politically Exposed Persons (PEPs), criminal-watchlist and adverse-media data against people and organisations. |
| How to use it | Enter a person's or organisation's name into the web search and review the resulting matches, source lists and associated risk information. |
| Cost | Partially Free. |
| Account required | No for basic web searches. Yes for full functionality. |
| Cookies | Mostly payment, analytics, advertising and consent cookies. |
| Ownership | dilisense GmbH, based in Switzerland, with operations/teams in Zurich and Luxembourg. |
| Use in Reporting | Can be used to document sanctions, PEPs, criminal-watchlist and adverse-media matches, including the underlying source and date/time of the check. |
**2. Review the returned matches, paying attention to the source, list type, jurisdiction and identifying information to determine whether a result actually relates to your subject.**
**3. Record the relevant result, source and date/time of the search and cross-check significant findings against the original authoritative source before relying on them in reporting.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Free web searches are available without registration. Paid plans provide additional capabilities such as API access, higher-volume screening, monitoring and adverse-media screening.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for the basic web search. An account is required for API, batch-processing, ongoing-monitoring and other registered/paid services.
### Cookies:
The site uses Stripe payment/security cookies, Google Analytics cookies, advertising/conversion cookies (Google/Reddit), and a cookie-consent management cookie. These primarily support payment security, website analytics, advertising attribution and management of cookie preferences.
### Use in Reporting
dilisense can be used to:
* Identify whether an individual or organisation appears on sanctions lists, PEP lists or criminal watchlists.
* Identify relevant risk indicators associated with an investigative subject.
* Cross-reference names against multiple international and national sources from a single interface.
* Identify the underlying source/list associated with a potential match.
* Support identity-resolution by comparing names and other available identifiers.
* Corroborate information obtained through other OSINT sources.
* Support AML/KYC, due-diligence and risk-assessment investigations.
The UK Government's [Economic Crime Survey 2024](https://www.gov.uk/government/publications/economic-crime-survey-2024/economic-crime-survey-2024) explicitly mentions dilisense as a third-party service used by surveyed businesses for sanctions and PEP screening.
**Important Note:** a dilisense match should not automatically be treated as proof that the result relates to your subject. Similar names can produce false positives, so the result should be checked against identifiers such as date of birth, nationality, location, organisation, aliases or other available information.
| **Capabilities** | **Limitations** |
| --------------------------------------------------------------- | ------------------------------------------------------------------ |
| Consolidates thousands of sanctions, PEP and watchlist sources. | A name match does not necessarily identify the correct individual. |
| Free web-based screening without registration. | Coverage depends on the sources incorporated into the platform. |
| Covers international and national sanctions sources. | Some advanced features require a paid account. |
| Supports people and organisation screening. | Results need to be verified against the underlying source. |
| Provides access to source information and screening timestamps. | 
**2. Open the dataset and examine its metadata, source, methodology, date/coverage, licence and available resources. Refine by countries and economies, source catalog, collections, resource type etc.**
**3. Download the relevant data or use an available API, then analyse and cross-reference it with other sources. Record the dataset name, source, version/date and URL when using it in reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No for general catalogue access and many datasets. Some datasets, particularly certain microdata, may require registration or an application.
### Cookies:
The site uses third-party Google/YouTube cookies supporting embedded media, security, session management and privacy controls.
### Use in Reporting
The World Bank Open Data Catalog can be used to:
* Obtain official development and socioeconomic statistics for countries and economies.
* Establish statistical context around an investigation.
* Compare countries, regions or time periods using structured datasets.
* Corroborate claims relating to population, economics, health, education, infrastructure, finance and development.
* Identify datasets and indicators that can generate further investigative leads.
* Download machine-readable data for independent analysis.
* Cross-reference World Bank data with government, academic and other authoritative sources.
As an example, an IDS working paper on Mozambique cited both [World Bank Open Data](https://assets.publishing.service.gov.uk/media/5e59257ee90e071111640425/Wp523_Online.pdf) and specific World Bank indicators in its research. A report examining primary healthcare in Europe also used [World Bank Open Data](https://medicosypacientes.cgcom.es/wp-content/uploads/2023/08/mocha-issues-and-opportunities-in-primary-health-care-for-children-in-europe-1.pdf) to investigate population, mortality, fertility and other health indicators.
| Capabilities | Limitations |
| Has a large collection of development-related datasets. | Not all datasets are owned or produced by the World Bank. |
| Enables search and filtering by country, source, resource type and licence. | Dataset coverage and update frequency vary |
| Provides downloadable and machine-readable resources. | Some datasets have access or licensing restrictions. |
| APIs available for some datasets. | Statistics provide context rather than necessarily identifying specific individuals or events. |
| Has strong provenance and metadata for many datasets. | World Bank states that it does not warrant the accuracy or usefulness of all data/ |
# Names Directory Tool Description : A web-based name-association search tool to search for first names associated with surnames and surnames associated with first names. | **Names Directory** | **Quick Overview** | | ------------------- | ------------------------------------------------------------------------------------------------ | | URL |
**2. Review the associated names, alternative spellings and frequency indicators returned by the site.**
**3. Use promising results as leads and cross-check them against stronger sources such as official records, reputable news reporting, company records or other independent OSINT sources.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses Google advertising and consent-management cookies, including \_\_gads, \_\_gpi, \_\_eoi, FCCDCF and FCNEC. These are primarily associated with advertising, measurement and privacy/consent management rather than the core name-search function.
### Use in Reporting
Names Directory can be used to:
* Identify possible name variations, spellings and naming patterns.
* Generate potential leads when researching an individual's name or surname.
* Establish whether a particular name appears to be associated with a particular country or region.
* Provide background context when assessing the likely origin or distribution of a name.
* Cross-reference names against other open-source records and databases.
* Support identity-resolution research by generating additional search terms or variants.
As an example, a researcher could use Names Directory to investigate an uncommon surname, identify its apparent geographic distribution, and then use those locations and spelling variants as search terms across authoritative sources such as company registers, electoral records, court records, news archives or professional databases.
**Reporting Caveat:** Names Directory should be treated as a lead-generation and corroboration tool, rather than definitive evidence of a person's identity, location, or relationship to another individual.
| **Capabilities** | **Limitations** |
| ------------------------------------------- | -------------------------------------------------------------------------------- |
| Links first names and surnames. | Data is not an authoritative identity database. |
| Can surface unusual name combinations. | Results are based on crawled public sources. |
| Can help identify spelling/name variations. | Common-name searches can be limited to 1,000 records. |
| Simple and quick to search. | A name association does not establish that two records refer to the same person. |
| Useful for generating investigative leads. | 
**2. Record the returned ID or username and cross-reference it with other sources before drawing conclusions.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses Google Analytics cookies (\_ga and \_ga\_\*) for visitor/session measurement and Google advertising-related cookies such as \_\_eoi.
### Use in Reporting
TweeterID can be used to:
* Help establish continuity when an account's username has changed.
* Record a more persistent identifier for an X/Twitter account.
* Support identity resolution when investigating social-media accounts.
* Cross-reference an account ID with other X/Twitter evidence.
* Provide a reproducible identifier when documenting an account in an investigation.
* Support verification of whether different usernames relate to the same underlying X/Twitter account.
**Reporting Caveat:** The platform should be used alongside screenshots, archived material, and other independent evidence rather than treated as proof of the account holder's real-world identity.
| Capabilities | Limitations |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Converts X/Twitter handles to account IDs. | Does not establish the real-world identity of an account holder. |
| Converts account IDs back to usernames. | Depends on the availability/recognition of the relevant X/Twitter account information. |
| Provides a persistent account identifier. | An account ID alone provides little contextual information. |
| Useful for documenting social-media accounts. | Does not independently verify that an account is authentic or controlled by a particular person. |
| Can support account-change/continuity research. | 
**2. Review the returned information, such as line type, carrier, location and fake/invalid status.**
**3. Cross-reference the result with independent sources and record the date of the lookup if using it in an investigation.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Individual web validation is free while API/batch/dashboard services are paid.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for the basic free web lookup but an account is required for API/paid services.
### Cookies:
The site uses Google Analytics cookies (\_ga, *ga*\*, \_gid) for website usage and session measurement, a Google advertising/conversion cookie (\_gcl\_au), and an ASP.NET session cookie (ASP.NET\_SessionId) for maintaining the user's website session.
### Use in Reporting
Phone Validator can be used to:
* Establish whether a telephone number appears valid or potentially fake.
* Determine whether a number is a mobile, landline, VOIP or toll-free number.
* Identify the current service provider/carrier where available.
* Establish an approximate geographic association from the number's area code and prefix.
* Check whether number portability may have changed the current line type.
* Corroborate telephone information obtained from other open sources.
* Generate further investigative leads for researching a phone number.
* Support technical verification of a phone number without claiming that it identifies a particular person.
The platform is cited in [a peer-reviewed academic study ](https://pmc.ncbi.nlm.nih.gov/articles/PMC10504660/)that specifically lists Phone Validator among OSINT tools for phone-number research. The researchers tested it as part of an OSINT survey and reported that it could provide information such as the number type, operator and geographic area. In their testing, it correctly matched the US number they tested.
| **Capabilities** | **Limitations** |
| ---------------------------------------------- | --------------------------------------------------------------------------------------------------- |
| Can identify potentially fake/invalid numbers. | Does not establish who owns or controls a number. |
| Supports worldwide phone-number validation. | Carrier information can change, particularly following number porting. |
| Identifies telephone line type. | Location is based on numbering information, not live device location. |
| Provides carrier/service-provider information. | A number being classified as valid does not prove that it is currently used by a particular person. |
| Provides approximate geographic information. | 
**2. Run the search and examine the resulting trade values, quantities, commodity codes and trading relationships. Results can be reviewed, downloaded and used for further analysis. Registered users can access larger downloads and API functionality.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Basic access is free. Registered users receive additional free query/download/API allowances, with premium services also available.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for basic searches. A free account/API key provides additional features, including larger downloads and API access.
### Cookies:
The site uses Google Analytics cookies, including \_ga and several \_ga\_\* cookies, for website analytics and measuring user interactions and sessions. These are analytics/measurement cookies rather than cookies used to provide the underlying UN Comtrade trade data.
### Use in Reporting
UN Comtrade Database can be used to:
* Identify imports and exports between countries.
* Examine trade relationships between specific countries and territories.
* Investigate the movement of particular commodities or products.
* Establish the value and quantity of reported international trade.
* Analyse changes in trade over time.
* Investigate potential supply-chain relationships.
* Identify unusual increases or decreases in reported trade.
* Compare a country's trade with different international partners.
* Examine trade involving specific commodity codes.
* Corroborate claims about international trade using an official UN statistical source.
* Generate investigative leads concerning companies, industries, commodities or trading relationships.
UN Comtrade data is also used by the UN and other organisations for economic and policy analysis. UN documentation notes that the database is used by member states, UN organisations and other international agencies.
| **Capabilities** | **Limitations** |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------ |
| Detailed international trade statistics. | Data depends on information reported by national authorities. |
| Covers numerous countries and territories. | Availability and completeness vary between reporters and periods. |
| Commodity-level information. | Commodity classification can be technically complex. |
| Allows comparison of trading partners. | Differences in national reporting practices can affect comparability. |
| Annual and monthly data are available for many datasets. | Larger downloads/API usage may require registration or be subject to limits. |
| Download and API capabilities. | Trade statistics do not necessarily identify individual companies or individual shipments. |
### Summary
The UN Comtrade Database is particularly useful during the analysis and verification stages of an investigation, where trade claims or suspected commercial relationships need to be quantified and compared.
However, because the data is reported by national authorities and can be revised, important findings should be cross-checked against relevant national customs, statistical or company records where possible.
### Ownership
United Nations, maintained by the UN Statistics Division (UNSD), Trade Statistics Branch.
### Ethical Considerations
* Treat trade statistics as statistical evidence rather than proof of individual wrongdoing.
* Be careful when interpreting commodity codes, quantities and trade values.
* Consider differences in national reporting practices when comparing countries.
* Check the relevant reporting period because historical data can be revised.
* Do not infer that a country-to-country trade relationship establishes a relationship between particular companies without additional evidence.
* Avoid presenting statistical anomalies as evidence of illegal activity without corroboration.
* Clearly distinguish between reported trade and independently verified physical movements of goods.
### Related Tools:
* [World Bank Open Data](/osint-tools/the-world-bank-open-data-catalog)
* IMF Data
* [OpenCorporates](/osint-tools/opencorporates)
* [CITES Trade Database](/osint-tools/cites-trade-database)
#### Sources
**2. Review the returned search results and identify potentially relevant webpages, news reports, documents or other sources. You can also use the available Web, Images, News and Video search options.**
**3. Open and evaluate the original sources. Record relevant URLs and dates and independently verify important information using primary or authoritative sources before relying on it in reporting.**
\\
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No account is required for ordinary web searching. Some linked services may have separate account requirements.
### Cookies:
The site may use cookies for website functionality, analytics, advertising and session management. None were noted during our site session on 26 August 2026.
### Use in Reporting
Excite can be used to:
* Discover publicly available webpages relevant to an investigation.
* Locate news articles, reports, organisations and other online sources.
* Search for information about people, companies, organisations and events.
* Identify potential primary sources for further investigation.
* Find alternative sources when information is difficult to locate through another search engine.
* Locate images, videos and other publicly available material.
* Generate investigative leads for subsequent verification.
* Cross-reference information discovered through other OSINT tools.
* Identify historical or less prominent webpages that may not immediately appear through other discovery methods.
As an example use case, if you were researching a company, you could search the company’s name together with terms such as ‘lawsuit’, ‘contract’, ‘investigation’, ‘sanctions’, or ‘annual report’ to identify potential relevant sources.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------- | ------------------------------------------------------------------------------- |
| Searches publicly available information across the web. | Search results are not necessarily comprehensive. |
| Useful for discovering investigative leads. | Search rankings can change over time. |
| Can search names, organisations, phrases, and keywords. | A search result does not establish that the underlying information is accurate. |
| Can identify potentially relevant reports, articles, and documents. | Some sources may be inaccessible, removed or behind paywalls. |
| Doesn’t require an account for basic searching. | Important information requires independent verification. |
### Summary
Excite Web Search is a general web-search tool that is most useful during the discovery and collection stages of an OSINT investigation.
It can help locate potentially relevant sources and generate leads, but information found through search results should be traced back to the original source and independently verified before being relied upon in reporting.
### Ownership
The Excite site is operated by Ask Media Group LLC on behalf of Ask Applications, Inc. Excite's web-search service is provided by System1 LLC.
### Ethical Considerations
* Do not assume search results are accurate simply because they appear prominently.
* Take care when searching for or reporting information about private individuals.
* Treat allegations found in search results as unverified until corroborated.
* Preserve relevant source material where appropriate, as webpages and search results can subsequently change or disappear.
### Related Tools:
* Google search
* [DuckDuckGo](/osint-tools/duckduckgo)
* Yandex
* [Wayback Machine](/osint-tools/wayback-machine)
#### Sources
**2. Refine the search using options such as file size, domain, path or excluded path, then examine the returned FTP locations and files.**
**3. Preserve the relevant source information and independently assess the provenance and authenticity of any file before using it in reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
FreewareWeb sets legacy Google Analytics cookies (\_\_utma, \_\_utmb, \_\_utmc, \_\_utmt, \_\_utmz) for visitor/session and traffic-source analytics. It also sets FCCDCF and FCNEC, which are associated with Google's consent-management and advertising infrastructure. These cookies primarily support analytics, consent management and advertising functionality.
### Use in Reporting
FreewareWeb FTP Search can be used to:
* Locate files hosted on publicly indexed FTP servers.
* Search for specific filenames or directory names.
* Locate older or obscure files that may not appear prominently in conventional web-search results.
* Search for particular file types, including images, music and video.
* Identify FTP servers associated with particular files or domains.
* Locate potential historical copies of files.
* Generate investigative leads from publicly accessible FTP infrastructure.
* Identify documents or files that may require further provenance and authenticity checks.
* Support investigations involving historical internet infrastructure or legacy file repositories.
A Spanish cybersecurity article from Spain's National Cybersecurity Institute (INCIBE/ICM) discusses FTP search engines as a reconnaissance technique and explicitly lists ‘[FreewareWeb FTP File Search](https://www.icm.es/2022/02/08/recopilacion-informacion-servicios-web-detectar-fallos-seguridad-parte-ii/)’ alongside other FTP search engines.
| **Capabilities** | **Limitations** |
| ---------------------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| Searches indexed FTP servers for files and directories. | It doesn’t represent the entire internet or all FTP servers. |
| Supports filename and keyword searches. | Results depend on the FTP servers and material indexed by the service. |
| Allows searches by file type, including images, music and video. | Some indexed files may be old, unavailable or no longer hosted at the returned location. |
| Can filter by domain, path and file size. | The provenance and authenticity of returned files must be independently assessed. |
| Can help locate obscure or historical FTP-hosted material. | The service provides discovery rather than authoritative verification. |
### Summary
FreewareWeb FTP Search’s main OSINT value is in discovering files and directories hosted on indexed FTP servers, particularly material that may be difficult to find using conventional search engines.
It’s best treated as a discovery/collection tool, with any significant findings subsequently verified through the original FTP source, file metadata, independent copies or authoritative documentation.
### Ownership
Not clearly disclosed.
### Ethical Considerations
* Confirm that files are publicly accessible before accessing or downloading them.
* Do not attempt to bypass authentication or access controls on FTP servers.
* Treat files discovered through the service as unverified until their provenance and authenticity have been established.
* Avoid downloading or retaining unnecessary personal information.
* Record the source URL, date and relevant metadata when using a file as investigative evidence.
### Related Tools:
* [File Phish](/osint-tools/file-phish)
* [De-digger](/osint-tools/de-digger)
* [Wayback Machine](/osint-tools/wayback-machine)
#### Sources
[freewareweb.com/ftpsearch.shtml](http://freewareweb.com/ftpsearch.shtml)
**2. Select the relevant series and examine the metadata, dates and values.**
**3. You can then create charts/tables or export the data as CSV or Excel. BIS also provides bulk downloads and an SDMX API for more systematic analysis.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses Matomo/Piwik analytics cookies (\_pk\_id, \_pk\_ref, \_pk\_ses) to measure visitor activity, sessions and referral sources. The site also sets two opaque, session-only cookies that are Secure, HttpOnly and SameSite=None, which appear to support application/session functionality.
**Note:** Their exact purpose cannot be established from the cookie values alone.
### Use in Reporting
The BIS Data Portal can be used to:
* Research international financial and economic statistics.
* Examine data relating to international banking, credit, debt securities, derivatives, exchange rates, property prices and global liquidity.
* Compare financial and economic indicators across countries and over different time periods.
* Identify trends, changes and anomalies in financial markets and banking activity.
* Investigate cross-border banking exposures and international financial relationships.
* Support research into financial flows, international banking activity and global financial risk.
* Download datasets for further analysis, calculations and visualisation.
* Use BIS statistical metadata and methodological information to understand how figures were compiled and what they represent.
* Provide quantitative evidence to support investigations and reporting concerning banks, financial markets, monetary policy and international finance.
**Reporting Note:** BIS Data Portal data is particularly useful as supporting quantitative evidence rather than evidence of wrongdoing by itself. Investigators should check the dataset's definitions, reporting period, revisions and geographic coverage before drawing conclusions, and should preserve the exact dataset/query used so that figures can be reproduced.
| **Capabilities** | **Limitations** |
| -------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| Provides official financial and economic statistics. | Primarily statistical rather than person/entity-level OSINT |
| Provides international banking and cross-border exposure data. | Data may be aggregated rather than identifying individual transactions. |
| Offers historical time-series data. | Interpretation requires understanding the dataset's methodology. |
| Enables search, filtering, charts and tables. | Different datasets have different coverage and reporting periods. |
| CSV, Excel, bulk-download and API access available. | BIS does not guarantee the accuracy, completeness or fitness of the statistics for a particular purpose. |
### Summary
BIS Data Portal is a high-value source for financial OSINT, particularly during investigations involving international banking, financial flows, debt, credit, monetary policy or economic trends.
Its greatest strength is source authority and structured historical data required and it’s particularly useful after an initial lead has been identified, as well as during the verification stage of an investigation.
### Ownership
The portal is operated by the Bank for International Settlements (BIS), an international financial institution headquartered in Basel, Switzerland. BIS statistics are compiled in cooperation with central banks and other national authorities.
### Ethical Considerations
* Treat BIS statistics as evidence requiring interpretation, not proof of wrongdoing.
* Check the methodology and metadata before drawing conclusions.
* Distinguish between residence, nationality and location measures where relevant.
* Preserve the original dataset/series identifier and retrieval date.
* Do not imply that BIS endorses an investigative conclusion simply because BIS data is used.
* Be aware that BIS itself states that its statistics are not guaranteed to be accurate, complete or fit for every intended purpose.
### Related Tools:
* [UN Comtrade Data](/osint-tools/un-comtrade-database)
* [World Bank Data](/osint-tools/the-world-bank-open-data-catalog)
* IMF Data
#### Sources
### How to Use: **1. Enter the URL of the webpage you want to monitor together with an email address. You’ll need to sign up for an account if you don’t already have one.**
**2. Once you’ve confirmed your account details and logged in, you’ll be directed to configure the monitoring options. Filters can be used to focus on particular keywords or sections of a webpage and reduce notifications caused by irrelevant changes.**
**3. Review the email notifications when changes are detected. The service reports text that has been added or removed, allowing the investigator to identify potentially significant updates and preserve the relevant information for further verification.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Free tier available alongside paid pro account.
## Data Processing
### Account Required:
* [x] Yes
* [ ] No
An account is required to manage ongoing page monitoring.
### Cookies:
The site uses legacy Google Analytics cookies, including \_\_utma, \_\_utmb, \_\_utmc, \_\_utmt and \_\_utmz, to measure website visits, sessions and traffic sources. It also uses a PHPSESSID session cookie to maintain the user's temporary website session. These cookies are primarily related to website analytics and functionality and do not form part of the webpage-monitoring data collected by the service.
### Use in Reporting
Follow That Page can be used to:
* Monitor publicly accessible webpages for subsequent changes.
* Identify when information on a webpage has been added, removed or amended.
* Track changes to government, corporate, regulatory or organisational webpages.
* Identify potential developments that warrant further investigation.
* Establish a timeline showing when publicly available information changed.
* Receive automated notifications rather than repeatedly checking a source manually.
* Focus monitoring on particular keywords or sections of a webpage using filters.
* Support preservation and verification of information that subsequently changes or disappears.
* Generate investigative leads from changes to publicly available information.
**Potential OSINT applications include monitoring:**
* Government webpages and public notices.
* Company websites and corporate announcements.
* Regulatory or policy pages.
* News and press-release pages.
* Public profiles or organisational webpages.
* Job advertisements and procurement pages.
* Pages containing information relevant to an ongoing investigation.
| **Capabilities** | **Limitations** |
| -------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| Monitors publicly accessible webpages for changes. | It cannot monitor password-protected webpages. |
| Sends email notifications when changes are detected. | The service doesn’t execute JavaScript, Java or Flash, so dynamically generated content may not be captured. |
| Reports added and removed text. | Changes can be missed if they occur and are subsequently reversed before the service checks the page. |
| Supports keyword and block filtering. | Websites can block the monitoring service's crawler. |
| Can monitor pages at different frequencies depending on the account. | Monitoring frequency and capacity are subject to account limits. |
### Summary
Follow That Page’s main value is in the monitoring and collection stages of the OSINT workflow, particularly where an investigator needs to establish whether information on a webpage has changed over time. It’s particularly useful for long-running investigations because it reduces the need for manual, repeated checking of websites.
However, detected changes should be independently verified and preserved where they’re important to an investigation.
### Ownership
Operated by [Onno Zweers](https://www.linkedin.com/in/onnozweers/) as a personal/hobby project. He states he works at [SURFsara](https://www.surfsara.nl/) (Dutch) as a systems programmer.
### Ethical Considerations
* Only monitor webpages that are publicly accessible and relevant to a legitimate investigative purpose.
* Avoid excessive monitoring frequencies that could place unnecessary load on smaller websites.
* Do not attempt to circumvent authentication or access controls.
* Do not provide passwords or session cookies for protected websites.
* Preserve the original URL, date/time and relevant webpage content when documenting an important change.
* Be aware that email reports may contain information about which webpages are being monitored; Follow That Page itself warns that its email reports may be sent in plain text.
### Related Tools:
* Visualping
* Wachete
* [Wayback Machine](/osint-tools/wayback-machine)
* [Anna’s Archive](/osint-tools/annas-archive)
#### Sources
**2. Enable forensic mode if you need the WARC and TLS chain (This is only available for subscriptions rather than one-off credits). It reloads the page under the debugger. Optionally add an OpenTimestamps anchor, an EU qualified timestamp, screen recording or AI-image analysis. Run the capture and download the ZIP.**
**3. Verify with the free web verifier, the open source CLI verifier, or the verify.sh / verify.ps1 script inside the package. None need an account.**
### Cost
* [ ] Free
* [ ] Partially Free
* [x] Paid
A 7 day free trial may be available with a payment card required. Subscriptions start from 8.99 USD per month (Essential, 100 captures) through Professional 16.99 and Enterprise 28.99, plus one-off credit packs. The forensic mode with WARC output is available from Professional upwards. Verification of a package is free and needs no account.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
Yes, to capture. No, to verify. Anyone can check a package with the free web verifier, the open source command line verifier, or the scripts shipped inside the package itself.
### Cookies:
The extension does not read or export the cookies of the page being captured into the archive. The getproofsnap.com website uses Google Analytics 4. The extension authenticates through Firebase and stores a session token locally.
### Use in Reporting
The output is built to survive being handed to someone who does not trust you: a third party can re-verify the hashes, manifest signature and timestamps offline, years later, using the MIT-licensed CLI verifier or the scripts inside the package.
**Typical uses:**
* Preserving a post, listing, review or profile before it is edited or deleted
* Recording a browsing trail across tabs
* Fixing what a page looked like at a verified time
* Documenting image provenance signals at the moment of capture
**Note:** US packages include a Rule 902(13)/(14) declaration template with the technical facts pre-filled and the declarant block left blank.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Preserves webpages as forensic evidence, including screenshots and HTML. | Chromium only. No Firefox, no Safari. |
| Generates SHA-256 hashes and RSA-4096 digital signatures. | Forensic mode with WARC needs the mid tier or above. |
| Provides OpenTimestamps/Bitcoin blockchain anchoring. | One page at a time. No bulk or scheduled crawling, so it does not replace an archiving crawler. |
| Can capture metadata, TLS information, forensic logs and chain-of-custody information. | AI-generation signals are heuristic and indicative, not determinative. |
| Works on authenticated and session-dependent content, with dedicated handling for virtualised scroll containers on WhatsApp Web, Telegram, Discord, Slack, Messenger, LinkedIn and Airbnb. | Captures only what the operator can already access. It does not bypass access controls. |
| 29 languages, and a separate mode for certifying local files. | A cryptographic timestamp demonstrates integrity/existence of the captured package but does not by itself establish that the underlying webpage's claims are true. |
### Summary
ProofSnap sits at the collection and preservation step of the OSINT workflow, right after you find something and before it changes. It does not search, enrich or pivot, so it complements discovery tools rather than replacing them.
### Ownership
Founded by[ Radim Motycka.](https://www.linkedin.com/in/radim-motycka-63b6a6108/) Qualified timestamps are issued by Disig a.s., a Qualified Trust Service Provider on the EU Trusted List.
### Ethical Considerations
* Anything preserved from a logged-in session was visible to you, but the subject may not expect it archived. Consider whether preservation is proportionate.
* Packages from authenticated sessions contain session state including cookies. Check metadata.json before sharing, to protect your own account and to avoid handing over access material.
* Preserved pages routinely contain personal data about people who are not the subject. Apply the usual minimisation.
* The AI-generation signals are indicators, not conclusions. Presenting them as a determination would overstate what the tool measures.
* Layout changes made to stabilise the page are listed in the chain of custody record. Disclose that record, not just the image.
* The tool documents when and how a page was captured. It does not establish that the contents are true.
### Related Tools:
* [Lookyloo](/osint-tools/lookyloo)
* [Wayback Machine](/osint-tools/wayback-machine)
* [Hunchly](/osint-tools/hunchly)
* Page Vault
* ArchiveBox
#### Sources
*With thanks to Radim Motycka for submitting this tool to the OSINT Tool Library.*
# ScanMalware Tool Description : An online URL and website security-analysis platform for investigating potentially malicious or suspicious websites. | **Tool name** | **Quick Overview** | | ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | URL |
**2. Submit the URL and allow ScanMalware to perform its browser-based analysis.**
Read the Summary and Screenshot first. The screenshot tells you what a visitor would actually have seen, which is often enough on its own for a phishing or scam page. The summary carries the verdict and the headline findings.
**3. Work through the detail tabs. HTTP shows every request the page made, TLS shows the certificate served, JavaScript shows what code loaded and how it was fingerprinted, Technologies shows what the site is built on, and IOC shows any threat-intelligence matches.**
**4. Pivot, which is the step most people skip. Take an artefact from the result, the JARM fingerprint, the favicon hash, an IP or the certificate, and search the archive for everything else that matches. This is what turns one suspicious link into the cluster of sites behind the same operation.**
**5. Share the result URL. Every scan has a permanent public link that needs no account to open, so it can go straight into a report or a ticket.**
**Top tip:** Search the archive before you scan. If the domain has been seen already you get its history for free, and you avoid touching the target at all.
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No for ordinary public URL scanning. Authentication is required for private scans.
### Cookies:
ScanMalware uses Cloudflare security cookies such as cf\_clearance to support anti-bot/security controls. The site also sets \_pk\_id.1.6111, a Matomo analytics identifier used to distinguish returning visitors. Cookie behaviour may vary depending on consent and site configuration.
### Use in Reporting
ScanMalware can be used to:
* Assess whether a website or URL exhibits indicators associated with malware, phishing or other malicious activity.
* Examine suspicious websites and webpages encountered during an OSINT investigation.
* Identify redirects associated with a suspicious URL.
* Examine domains and IP addresses contacted by a webpage.
* Investigate hosting, ASN and network infrastructure associated with a website.
* Examine JavaScript and other scripts loaded by a webpage.
* Identify forms that may be used to collect credentials or payment information.
* Examine cookies, HTTP requests and other webpage/network characteristics.
* Identify technologies, frameworks and services used by a website.
* Examine TLS certificates and JARM fingerprints associated with web infrastructure.
* Obtain screenshots and visual information about a suspicious webpage.
* Compare technical indicators against threat-intelligence and malware/phishing detection sources.
* Generate investigative leads concerning phishing sites, scam websites, malware distribution infrastructure, domains, IP addresses and associated technical infrastructure.
| **Capabilities** | **Limitations** |
| --------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| Sandboxed rendering of any URL, with screenshot and full technical record. | Public scans are visible to everyone, so it is the wrong tool for sensitive URLs unless you use an unlisted scan. |
| Public archive of 551,000+ scans, searchable and permanently linkable. | Some sites block automated scanners or serve different content to them, so a clean result is not proof a site is safe. |
| Pivots that most scanners do not expose: JARM, favicon hash, screenshot perceptual hash, TLSH and ssdeep fuzzy hashes, OCR text, JavaScript fingerprints. | The target may see the scan, as with any remote scanner. |
| YARA rule matches, TLS certificate and Certificate Transparency data, RDAP records, detected technologies, and clipboard-hijack / pastejacking detection. | Subdomain and certificate history covers a recent window rather than the full history of a domain. |
| Full REST API with no key required, plus an MCP server for use from AI tooling.
*With thanks to* [*Jonas Lejon*](https://x.com/jonasl?lang=en) *for submitting this tool to the OSINT Tool Library.* # Revealer.US username lookup Tool Description : An exposure-intelligence and OSINT tool that lets you search for information connected to an email address, username, or phone number. | **Revealer.US username lookup** | **Quick Overview** | | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | URL |
**2. Run the search and review the returned platforms and profiles.**
**3. Record relevant results and pivot to the original platform to verify them.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
A free tier provides username lookups and preview results. Paid plans provide additional functionality, including full reports and unlimited searches.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for the demo search. Yes for full functionality.
### Cookies:
Revealer.US uses an auth-token cookie containing a signed JWT to maintain authenticated user sessions. The cookie is marked Secure and HttpOnly with SameSite=Lax. The site also sets a g\_state cookie associated with Google authentication/Identity Services. These are primarily authentication and session-management cookies rather than advertising cookies.
### Use in Reporting
Revealer Username Lookup can be used to:
* Identify public accounts associated with a particular username or handle.
* Search for the same username across social-media platforms.
* Identify reuse of a username across gaming platforms.
* Identify forum accounts using the same handle.
* Identify developer accounts associated with a username.
* Establish the potential public online footprint of a username.
* Identify potentially related accounts through username reuse.
* Generate investigative leads for further OSINT research.
* Identify accounts that may warrant further examination in fraud, impersonation or threat-intelligence investigations.
* Corroborate the existence of a username across multiple public platforms.
* Pivot from a username to additional publicly available identifiers and online profiles.
* Support investigations into online identities, subject attribution, fraud and abuse.
* Provide a starting point for further verification using the original platforms.
Reporting caveat: A username match alone should not be reported as proof that multiple accounts belong to the same individual. The username should be corroborated with additional independent indicators.
| **Capabilities** | **Limitations** | | ------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------- | | Searches usernames across 800 platforms, emails across 200 platforms, and phone numbers across 10 platforms. | A username match does not prove that accounts belong to the same individual | | Covers social, gaming, forum and developer platforms. | Passwords are redacted. | | Performs searches in real time. | Platform coverage and search results may change over time. | | Can follow reused handles to identify potentially related profiles. | Results depend on information currently available from third-party/public sources. | | Free tier available for username searches and preview results. | Full reports and additional functionality require paid plans. | ### Summary Revealer Username Lookup can identify where a username is publicly exposed and follow reused handles to surface potentially related accounts. It is therefore particularly useful as an initial discovery and pivoting tool. However, sometimes the same individual may not carry the same username across all platforms and it will return false positives. Important findings should be checked against the original platform and corroborated with independent identifiers before being included as a factual attribution in an investigative report. ### Ownership American / Thai owners Bob Adams and ‘Pat’. ### Ethical Considerations * Treat username matches as leads rather than definitive attribution. * Verify important findings against the original source. * Be particularly careful where results include breach or other sensitive data. * Avoid publishing personal information that is unnecessary for the investigative purpose. * Record the date of the search because results from live sources can change. ### Related Tools: * [OSINT Industries](/osint-tools/osint-industries) * Sherlock * [Epieos](/osint-tools/epieos) * [Have I Been Pwned?](/osint-tools/have-i-been-pwned) #### Sources
# BotScout Tool Description : A bot-signature lookup service that checks names, email addresses & IP addresses against a database of previously identified bot activity. | **BotScout** | **Quick Overview** | | ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | | URL |
**2. Run the search and review whether it has previously appeared in the BotScout database. BotScout also supports separate API checks for email, IP and name, as well as combined queries.**
**3. Record the result, including the identifier searched, match status and any relevant returned information. Treat a match as supporting evidence, then corroborate it with other OSINT sources before reporting an assessment.** ### Cost * [x] Free * [ ] Partially Free * [ ] Paid Free for normal use. Higher-volume/API use may have limits or charges. ## Data Processing ### Account Required: * [ ] Yes * [x] No No for basic searches. API access requires an API key. ### Cookies: The site uses a PHPSESSID session cookie for maintaining a temporary PHP web session. (The cookie is functional rather than an advertising/tracking identifier based on its name and function). ### Use in Reporting BotScout can be used to: * Check usernames, email addresses and IP addresses for previous bot-related matches. * Investigate identifiers associated with suspected automated, spam or malicious activity. * Identify whether an identifier has previously appeared in BotScout's bot-signature database. * Corroborate findings from other OSINT, threat-intelligence and account-analysis sources. * Document searched identifiers, match results, match counts and search dates as supporting evidence. * Support assessments of potentially automated or suspicious online activity. * Inform risk assessments when profiling accounts, email addresses, IP addresses or online activity. For example, in a [2017 SC Media investigation](https://www.scworld.com/perspective/floki-bot-a-zeus-wannabe-with-delusions-of-grandeur) into ‘Floki Bot’ (a Zeus-inspired malware.botnet), researchers used BotScout to investigate an IP associated with suspected botnet infrastructure and obtained information including registrant email addresses. The BotScout results were then considered alongside VirusTotal and other evidence to assess whether the IP was being used as a command-and-control server. | **Capabilities** | **Limitations** | | --------------------------------------------------------------------- | ------------------------------------------------------------------------------ | | Checks usernames against known bot signatures. | A match does not prove that the current account is a bot. | | Checks email addresses associated with previous bot activity. | Coverage depends on what BotScout has previously observed and recorded. | | Checks IP addresses for previous bot activity. | IP addresses can be shared, reassigned or associated with compromised systems. | | Supports combined name, email and IP queries through the API. | BotScout states that it cannot catch every bot. | | Provides match information that can support investigative hypotheses. | Query/API limits may restrict large-scale investigations. | ### Summary BotScout’s strongest OSINT use is in the verification/enrichment stage of the workflow, after an investigator has identified an account, email address or IP and wants an additional indication of previous bot activity. **Note:** A positive match can strengthen a hypothesis that an identifier has been associated with automated activity, while a negative result should not be interpreted as evidence that the identifier is legitimate or human. ### Ownership Not publicly disclosed. ### Ethical Considerations * Only investigate identifiers for a legitimate and proportionate investigative purpose. * Treat BotScout matches as indicators, not proof of maliciousness, automation or identity. * Avoid unnecessarily submitting or recording personal data. * Consider applicable UK data-protection requirements and organisational handling policies. * Do not use BotScout results alone to make decisions that could materially affect an individual. ### Related Tools: * VirusTotal * AlienVault OTX * GreyNoise #### Sources
**2. Review the metric and its accompanying explanation to understand what the data represents.**
**3. Record the relevant figures, date/time and chart URL. Where possible, corroborate significant findings against the Bitcoin blockchain and independent cryptocurrency-data sources before including them in an investigation or report.** ### Cost * [ ] Free * [x] Partially Free * [ ] Paid Free for basic charts. Paid for Pro plans. ## Data Processing ### Account Required: * [x] Yes * [x] No No for free charts. Yes for Pro features, alerts and API access. ### Cookies: The site uses functional and session cookies including currency, which stores the selected currency; i18n\_redirected, which stores language/localisation preferences; and session, which maintains a server-side web session. ### Use in Reporting Bitbo can be used to: * Research Bitcoin price, market, mining and on-chain activity at a specific point in time. * Investigate historical Bitcoin metrics relevant to cryptocurrency-related activity. * Identify patterns and trends in Bitcoin supply, holder behaviour, mining and market cycles. * Corroborate findings from blockchain explorers and specialist cryptocurrency-intelligence platforms. * Document Bitcoin metrics, chart values, dates, timestamps and source URLs as supporting evidence. * Provide market and blockchain context when assessing cryptocurrency transactions or incidents. * Support financial-crime, cryptocurrency and cryptocurrency-related OSINT investigations. Bitbo data has been cited in published cryptocurrency and financial research, including [GoMining's Q4 2025 institutional report. ](https://institutional.gomining.com/docs/institutional-gomining_q4-2025-report.pdf) | **Capabilities** | **Limitations** | | ------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------- | | Provides extensive Bitcoin price, market and on-chain charts. | Focused primarily on Bitcoin rather than multiple cryptocurrencies. | | Provides both current and historical Bitcoin data. | It’s not primarily an attribution or blockchain-investigation platform. | | Covers metrics including mining, supply, realised price and market cycles. | Free data updates are slower than paid tiers. | | Offers downloadable data and an API for programmatic analysis on paid access levels. | Some advanced charts, indicators and downloads require a subscription. | | Can provide useful context around Bitcoin activity at a particular date or period. | Charts and metrics are analytical interpretations and should not automatically be treated as definitive evidence. | | Useful for building historical financial and cryptocurrency context. |
**2. Search the site and review the relevant aircraft or operator page. Compare specifications, aircraft imagery, operators and other available information.**
**3. Record the relevant aircraft details, page URL and date accessed. For significant findings, corroborate the information with authoritative sources such as government, military, manufacturer or established aviation sources.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for general browsing. Yes for additional site features.
### Cookies:
The site uses a Cloudflare security cookie which is used to detect and mitigate automated or potentially malicious traffic.
### Use in Reporting
CombatAircraft.com can be used to:
* Identify military aircraft appearing in photographs, videos or other OSINT material.
* Research aircraft specifications, roles, characteristics and operational history.
* Investigate the aircraft operated by a particular country or military organisation.
* Corroborate aircraft identifications and military aviation findings using an additional reference source.
* Document aircraft type, manufacturer, operator, specifications and source URLs as supporting evidence.
* Support research into military aviation capabilities, deployments and aircraft-related incidents.
* Provide background context for aviation, defence and conflict-related investigations.
| **Capabilities** | **Limitations** |
| --------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| Provides a large reference database covering multiple military aircraft categories. | It’s a secondary reference source and important findings should be independently corroborated. |
| Provides aircraft specifications, imagery and operational information. | Aircraft inventories and operator information may become outdated. |
| Provides country/operator pages showing aircraft associated with particular air forces. | Presence in the database does not necessarily confirm current operational service. |
| Includes military aviation news and original/author-contributed articles. | News content may aggregate material from other sources rather than represent primary reporting. |
| Useful for aircraft identification and comparison. | Identification from imagery should not rely on a single reference source. |
| Provides additional material on formations, roundels and aviation tactics. | Some site content, particularly older material, may contain historical rather than current information. |
### Summary
Combat Aircraft best fits within the identification, enrichment and verification stages of the OSINT workflow and is particularly useful when an investigator needs to determine what aircraft is visible, what role it performs, who operates the type, or what its technical characteristics are.
### Ownership
Founded and developed by Munnaf Joarder and Matt Young. No separate corporate owner is identified on the site's current [‘About’ page. ](https://combataircraft.com/about/)
### Ethical Considerations
* Do not assume that identifying an aircraft establishes its current location or operational status.
* Distinguish between historical operator information and confirmed current inventory.
* Be cautious when combining aircraft information with live-location data, imagery or other intelligence.
* Avoid using the site's information to facilitate targeting, harassment or other harmful activity.
* Respect copyright and attribution requirements when reproducing photographs, diagrams or other site content.
* Consider the security implications of publishing precise information about military activities when producing public-facing reports.
### Related Tools:
* [Open Source Munitions Portal](/osint-tools/open-source-munitions-portal)
* [Bulletpicker](/osint-tools/bulletpicker)
* Scramble
* Air-Britain
* The Aviationist
* [ADS-B Exchange](/osint-tools/global-ads-b-exchange)
#### Sources
**2. Search the database and review the relevant vessel, port or company record. Record identifiers, vessel characteristics, flag, operator/management information and available AIS-derived location or voyage information.**
**3. Cross-check significant findings against independent maritime sources. Record the page URL, vessel identifier, relevant data and date/time of access before incorporating the information into an investigative report.** ### Cost * [ ] Free * [x] Partially Free * [ ] Paid Free for core vessel information. Company-profile additions can involve paid subscriptions. ## Data Processing ### Account Required: * [ ] Yes * [x] No No for general searching and browsing. ### Cookies: The site uses a mix of Google advertising and Google Analytics cookies. No cookies from Maritime Database itself noted. ### Use in Reporting Maritime Database can be used to: * Identify vessels using names, IMO numbers, MMSIs or callsigns. * Investigate vessel specifications, flags, operators, management information and maritime affiliations. * Research vessel movements, reported destinations, current ports and AIS-derived positions. * Investigate relationships between vessels, shipping companies, ports and operators. * Corroborate findings from AIS platforms, vessel registries, company records and other maritime OSINT sources. * Document vessel identifiers, locations, voyage information, timestamps and source URLs as supporting evidence. * Support investigations involving shipping activity, maritime security, sanctions research, smuggling or other maritime-related activity. Maritime Database data was also used by the [American Alliance for Manufacturing](https://www.americanmanufacturing.org/wp-content/uploads/2025/07/AAM-Comment-re-Proposed-Modification-Section-301-Shipbuilding-07-07-2025.pdf) in a 2025 analysis of proposed U.S. shipbuilding fees covering 60 vessels. The report explicitly identifies Maritime Database as the source of vessel data used in its calculation. | **Capabilities** | **Limitations** | | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ | | Provides a large international vessel database covering 50,000+ vessels. | The provider explicitly states that its data is supplied without assurance of accuracy or reliability. | | Provides IMO, MMSI, callsign, flag and vessel-specification information. | AIS coverage depends on vessels transmitting AIS and the availability/quality of received data. | | Provides AIS-derived position, course, destination and port information. | Company and management information may become outdated or require independent verification. | | Provides information on maritime companies, including owners/managers/operators. | Similar vessel names and changing vessel identifiers can create identification errors. | | Covers ports, countries, vessel types and maritime organisations. | . | | Useful for linking vessel identifiers with maritime activity and company information. |
**The web version will also display any dictionary definitions or alternative meanings:**
**3. Use the translated terminology to continue the investigation. Where the translation is important to an evidential finding, verify it with another translation source or a suitably qualified human translator.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Limited free demo with paid plans providing expanded translation and dictionary functionality.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for the online dictionary/basic use. An account/licence may be required for some software and premium features.
### Cookies:
Babylon uses Sourcebuster.js analytics/marketing-attribution cookies, including sbjs\_first, sbjs\_first\_add, sbjs\_current\_add, sbjs\_session and sbjs\_udata. These record information such as the visitor's acquisition source, referring URL, entry/current page, session activity and browser/user-agent information.
The site also uses wp-wpml\_current\_language to store the selected language.
### Use in Reporting
Babylon can be used to:
* Translate foreign-language words, phrases and documents encountered during OSINT research.
* Identify the meaning and context of foreign-language terminology, names and expressions.
* Support investigations involving foreign-language websites, social-media content and documents.
* Generate translated terminology that can be used to conduct further searches in the original language.
* Corroborate translations obtained from other translation and dictionary services.
* Document the original-language term, translation, language and source used during an investigation.
* Support analysis where language barriers would otherwise limit access to relevant information.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| Provides multilingual dictionary and translation functionality. | Machine translation can introduce errors or lose cultural/contextual meaning. |
| Can translate words, phrases and longer passages. | A translation should not automatically be treated as an authoritative interpretation. |
| Supports document translation in several common formats. | Advanced functionality requires a paid licence, particularly on the web version. |
| Provides dictionaries from multiple sources and premium publishers. | Language coverage and dictionary availability vary by product/licence. |
| Can provide useful terminology for subsequent searches. | Names, slang, dialects, irony and specialist terminology can be mistranslated. |
### Summary
Babylon can assist investigators in understanding foreign-language websites, documents, terminology and other OSINT material and best fits in the translation and enrichment stages of the OSINT workflow. An investigator can use it after collecting foreign-language material to understand the content and identify terminology for subsequent searches.
### Ownership
Owned and managed by Babylon Software Ltd., an Israeli company founded by Amnon Ovadia.
### Ethical Considerations
* Do not treat machine translation as definitive where an interpretation could materially affect an investigation.
* Verify important translations with an independent source or qualified human translator.
* Take particular care with names, slang, dialects, sarcasm, cultural references and specialist terminology.
* Consider data-protection requirements when translating material containing personal information.
* Record the translation tool, date and language used where a translated passage is relied upon in reporting.
* Avoid presenting a machine-generated translation as a direct quotation from the original source.
### Related Tools:
* [DeepL Translator](/osint-tools/deepl-translator)
* [2lingual search](/osint-tools/2lingual-search)
* [Apertium](/osint-tools/apertium)
* Google Translate
#### Sources
**2. Enable the appropriate transport layers and inspect the displayed routes, stops and vehicle movements. Where available, examine current positions and delays.**
**3. Record the date/time, location, route, service and relevant map information, then corroborate important findings against the relevant transport operator, timetable, journey information or another independent source.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses first-party Matomo analytics cookies, including \_pk\_id, \_pk\_ref and \_pk\_ses. These are used to identify returning browsers, maintain analytics sessions and record referral sources. They relate to website usage analytics and do not represent train-location data.
### Use in Reporting
Live Train Tracker can be used to:
* Establish the location and route of public-transport services relevant to an investigation.
* Check scheduled or apparent vehicle movements around a particular time and location.
* Investigate transport-related timelines, including whether a reported journey is consistent with available data.
* Corroborate information obtained from railway operators, timetables, photographs, videos or other OSINT sources.
* Identify railway stations, routes, stops and transport connections relevant to an investigation.
* Document service names, routes, locations, timestamps and observed movements as part of an evidential record.
* Support geolocation and movement analysis where transport infrastructure is visible or relevant.
* Inform investigations involving travel, transport disruption, incidents or movements through a particular area.
**Important reporting caveat:** Where possible, record whether the information represented real-time data or timetable/interpolated data. geOps explicitly states that its tracker falls back to interpolated schedule positions where real-time feeds are unavailable.
| **Capabilities** | **Limitations** |
| ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| Displays public-transport routes and vehicle movements across many parts of the world. | Real-time coverage varies by location and operator. |
| Combines timetable information with available real-time feeds. | Some displayed positions are interpolated from schedules rather than live GPS positions. |
| Can display trains as well as buses, trams and boats where data is available. | Coverage and data quality depend on the underlying transport provider's feed. |
| Provides an interactive geographic view useful for location and route analysis. | A displayed vehicle position should not automatically be treated as precise physical-location evidence. |
| Can help establish transport timelines and identify relevant routes/stations. | Historical data may not be readily available through the public interface. |
| Uses standardised transport data such as GTFS, making data integration possible across multiple operators. | Service cancellations, feed outages, delays or stale data can affect accuracy. |
### Summary
Live Train Tracker’s strongest OSINT application is transport and movement verification. It can help investigators understand railway networks, locate stations and routes, examine scheduled services and, where real-time feeds exist, observe apparent vehicle movements.
However, the distinction between live data and estimated/interpolated positions is critical.
### Ownership
geOps; a German and Swiss software company specialising in web applications for public transport, mobility, and geodata. It is led and managed by its long-time CEO and co-founder [Uli Müller.](https://www.linkedin.com/in/ulimueller/)
### Ethical Considerations
* Treat displayed positions as OSINT indicators, not automatically as definitive proof of a vehicle's physical location.
* Establish whether the data is real-time, delayed or timetable-derived.
* Record the date and time of observation, including the relevant time zone.
* Corroborate important findings with the relevant railway/operator or another independent source.
* Consider whether publishing a particular train movement could expose sensitive information about individuals.
* Be careful with historical claims because the public tracker may not provide a complete historical record.
### Related Tools:
* geOps Maps
* OpenStreetMap
* OpenRailwayMap
#### Sources
**2. Compare the headlines returned from different publishers. Record the publication, headline, date/time and link to the original article.**
**3. Follow the relevant headline to the original publisher and verify the underlying reporting. Use the original source rather than 1stHeadlines as the primary evidential citation where possible.**
**Note:** There are a lot of third-party ads to contend with so be careful when clicking on external links.
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No for normal browsing and searching.
### Cookies:
1stHeadlines uses third-party advertising technologies, including Google DoubleClick/Google advertising services and Tribal Fusion/Exponential. Observed cookies include IDE, DSID, APC, ar\_debug, mggpc and ANON\_ID. These are primarily associated with advertising delivery, measurement, personalisation and browser recognition rather than the site's core news-aggregation functionality.
### Use in Reporting
1stHeadlines can be used to:
* Identify news coverage of an event, person, organisation or incident.
* Compare reporting across multiple news organisations and identify differences in headlines or framing.
* Establish timelines by recording when different publications reported or updated stories.
* Locate original reporting that can then be reviewed and cited directly.
* Corroborate information found through other OSINT sources by checking whether independent news outlets reported the same event.
* Identify additional sources and leads for further investigation.
* Document headlines, publication names, dates/times and original article URLs as part of an investigative record.
The platform has been documented by academic and information-resource organisations as a news-search and current-awareness resource. For example, the [Internet Scout Report ](https://scout.wisc.edu/report/2000/0428)highlighted its ability to search and monitor headlines across multiple news sources.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------- |
| Aggregates headlines from a large number of news organisations. | It is an aggregator, not the original publisher. |
| Allows rapid comparison of coverage from different sources. | Aggregation does not guarantee that the underlying reporting is accurate. |
| Provides topic, geographic and publication-based browsing. | Source selection and aggregation methodology are not fully transparent. |
| Can help identify original articles and additional investigative leads. | Headlines can omit important context contained in the underlying article. |
| Useful for establishing reporting timelines and monitoring developing stories. | Older stories may be retained or displayed alongside newer material, requiring careful date checking. |
| 
**2. Read the Snopes article results and examine the rating, explanation, evidence and cited sources. Pay particular attention to the distinction between what is established, what is false and what remains uncertain.**
**3. Follow Snopes' underlying sources and independently verify the evidence. Record the Snopes article, rating, publication date and relevant primary sources in your investigation.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Substantial public content is available, with paid membership providing additional benefits/content.
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No for ordinary fact-check searches. An account is required for certain membership features.
### Cookies:
The site uses first- and third-party cookies for functionality, referral attribution, advertising and audience measurement. Observed cookies included Criteo's cto\_bundle, Prebid Unified ID cookies (pbjs-unifiedid and pbjs-unifiedid\_cst), Scorecard Research identifiers (UID and XID), a first-party referral cookie (snopes\_tdata) and a regional user-location cookie.
### Use in Reporting
Snopes can be used to:
* Verify claims encountered during an OSINT investigation.
* Identify misinformation, hoaxes and manipulated narratives circulating online.
* Determine whether an image, video, quotation or social-media post has previously been investigated.
* Corroborate findings from social-media, reverse-image and open-web research.
* Identify the original sources and evidence used to assess a disputed claim.
* Document fact-check ratings, publication dates and supporting evidence for an investigative record.
* Identify the origins and development of recurring rumours or misinformation narratives.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------- |
| Provides researched assessments of online claims and rumours. | Snopes is a secondary source, not the original evidence behind every claim. |
| Covers images, videos, social-media posts, quotations, statistics and narratives. | A fact-check may not cover a new variation of an existing rumour. |
| Provides explanations and supporting sources rather than simply labelling content true or false. | Some claims are genuinely inconclusive. Snopes uses ‘Unproven’ where available evidence does not support a definitive conclusion |
| Maintains a large searchable archive of previous fact checks. | Ratings can simplify complex claims and should be read alongside the underlying article. |
| Can help identify misinformation, satire, manipulated content and misleading context. | The quality of a conclusion depends partly on the evidence available to the researchers at the time. |
| Can provide useful leads to primary sources, experts, records and other evidence. | 
**2. Choose the appropriate investigative function and enter your identifier, e.g. a username, email address, phone number, IP address, domain, Discord ID or image, depending on the tool being used. Indicia then queries the relevant integrated sources.**
**3. Review results, identify useful leads, and independently corroborate significant findings against the underlying source or another reliable source before including them in an investigative report.**
### Cost
* [ ] Free
* [ ] Partially Free
* [x] Paid
Pay as you go pricing based on searches (minimum credits on account are 50 = $5).
## Data Processing
### Account Required:
* [x] Yes
* [ ] No
### Cookies:
The site uses essential authentication/security cookies alongside third-party security and analytics technologies. Observed cookies included \_\_Secure-indicia.session\_token, which maintains the authenticated session; Cloudflare's cf\_clearance, which supports anti-bot/security controls; and a PostHog cookie containing pseudonymous device, visitor and session identifiers and referral information.
### Use in Reporting
Indicia can be used to:
* Identify potential online accounts associated with a username, email address or other identifier.
* Search multiple breach and compromise databases for information relevant to an investigation.
* Investigate digital identities and connections across supported social and online platforms.
* Conduct network reconnaissance, including DNS, WHOIS, SSL, Shodan and exposed-service information.
* Generate investigative leads by bringing results from multiple OSINT sources into a single workspace.
* Corroborate findings obtained from individual OSINT platforms and underlying source databases.
* Investigate Discord and Roblox accounts, including associated profiles and, where available, connected information.
* Conduct image-geolocation or facial-similarity searches where legally and ethically appropriate.
* Document search results, identifiers and source information for subsequent verification and reporting.
* Support investigative triage by quickly determining which leads warrant deeper examination.
**Reporting caveat:** Indicia should generally be treated as an aggregation and discovery layer, rather than the ultimate evidential source.
| Capabilities | Limitations |
| Aggregates 30+ data sources within one investigation platform. | Results depend on the availability, accuracy and coverage of third-party sources. |
| Searches usernames, people, breaches, social platforms and other identifiers. | A result from an aggregator is not automatically independently verified evidence. |
| Provides network reconnaissance using DNS, WHOIS, Shodan, SSL and related information. | Many functions consume credits, with more intensive searches costing substantially more. |
| Includes image-geolocation and reverse-face-search functionality. | Some features rely on third-party providers, with their own policies and limitations. |
| Provides an AI investigation assistant capable of multi-step research and report generation. | AI-generated results can contain errors, outdated information or incorrect attribution. |
| Offers API, SDK and CLI access for integrating investigations into other workflows. |
**3. Compare the simulated sun/shadow direction with the original material. Record the location, date/time, settings and screenshots used, and corroborate the result with other geolocation evide**nce.
You can [view Shadowmap’s YouTube channel here for demos.](https://www.youtube.com/@shadowmap_org)
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for basic use. Yes for some saved/paid features.
### Cookies:
Google authentication, security and consent cookies were observed during testing, including SAPISID, SID, SIDCC, SMSV, SOCS and SSID. Several are associated with Google account authentication and should be treated as sensitive session information. These cookies were set on Google domains rather than by Shadowmap itself.
### Use in Reporting
Shadowmap can be used to:
* Compare observed shadows with predicted sunlight conditions at a suspected location.
* Assess whether the lighting in an image is consistent with a claimed date or time.
* Support geolocation by analysing the direction and length of visible shadows.
* Support chronolocation by modelling the Sun's position at different times.
* Reconstruct historical or future sunlight conditions where the relevant date functionality is available.
* Corroborate findings from satellite imagery, maps, photographs and other geolocation sources.
* Document simulated Sun position, shadow direction, location, date/time and screenshots as supporting evidence.
* Test competing location or timestamp hypotheses during an investigation.
| Capabilities | Limitations |
| Provides global 3D sunlight and shadow visualisation. | Results depend on the accuracy of the underlying terrain, building and environmental data. |
| Can help compare real-world shadows against simulated conditions. | A shadow match alone rarely proves a precise location or timestamp. |
| Allows investigation of sunlight at different times and, with appropriate plans, different dates. | Some historical/date and advanced mapping features require a paid plan. |
| Provides 3D buildings, terrain and other environmental objects. | Trees, temporary structures and objects may be missing or inaccurately represented. |
| Useful for geolocation, chronolocation and image verification. | Lighting can be affected by weather, clouds, reflections and artificial light, which the basic shadow model may not reproduce. |
| Can create visualisations suitable for explaining analytical findings. |
**2. Use the available filters and visualisations to examine relevant species, locations, platforms, advertisements, trends or other indicators of illicit trade.**
**3. Record relevant findings and cross-check significant results against the underlying source material and independent OSINT sources before using them in reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No for the public-facing dashboard.
### Cookies:
Google Analytics cookies (\_ga and \_ga\_KMYCNBBLVR) were observed. These are used for website analytics, including distinguishing visitors and measuring sessions and interactions.
### Use in Reporting
ECO-SOLVE Global Monitoring System fits best during the discovery, enrichment, analysis and verification stages of the OSINT workflow. Investigators can use it after identifying a suspected wildlife-trafficking activity, species, advertisement, platform or geographic area to establish the wider environmental-crime and illicit wildlife-trade context.
It's particularly valuable for specialist wildlife-trafficking investigations, where it can provide structured data and analytical context that would be difficult to obtain through ordinary web searches. However, as always, it's not a substitute for direct source verification or broader OSINT collection.
### Summary
ECO-SOLVE is a programme of the Global Initiative Against Transnational Organized Crime (GI-TOC). The official ECO-SOLVE site describes it as an EU-funded project within the European Union's Global Illicit Flows Programme, focused on environmental crime.
### Ownership
ECO-SOLVE is a programme of the Global Initiative Against Transnational Organized Crime (GI-TOC). The official ECO-SOLVE site describes it as an EU-funded project within the European Union's Global Illicit Flows Programme, focused on environmental crime.
### Ethical Considerations
* Take care when handling information concerning protected or endangered species, as publication could potentially facilitate targeting or exploitation.
* Treat GMS records as indicators, not proof of criminality, trafficking or identity.
* Verify significant findings against the underlying source and independent evidence.
* Avoid unnecessarily collecting or recording personal information.
* Do not use GMS results alone to make decisions that could materially affect an individual.
### Related Tools:
* [CITES Trade Database](/osint-tools/cites-trade-database)
* TRAFFIC
* [Global Fishing Watch](/osint-tools/global-fishing-watch)
* [Global Forest Watch](/osint-tools/global-forest-watch)
#### Sources
**2. Review photographs, descriptions, technical information and related database entries to develop or test an identification.**
**3. Cross-check the result against authoritative sources, imagery and qualified technical advice before reporting an identification as confirmed.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for general browsing. Yes for additional member/technical content.
### Cookies:
CAT UXO uses an application session cookie (cat\_uxo\_session) and CSRF security token (XSRF-TOKEN). Google Analytics (\_gid) is also present for website analytics. Stripe cookies were observed and appear to support payment, security, fraud-prevention and cookie-consent functions.
### Use in Reporting
CAT UXO can be used to:
* Identify and contextualise suspected UXO, mines, munitions and other explosive hazards.
* Compare an unidentified object against documented explosive-hazard examples.
* Research historical or reported explosive-hazard incidents.
* Corroborate findings from imagery, military, governmental and specialist EOD sources.
* Document relevant terminology, classifications, photographs and database references.
* Support investigations involving conflict zones, military activity, historic battlefields or suspected explosive remnants.
* Provide supporting context when assessing reports or imagery involving explosive hazards.
As a real-world example, [an ICJ document in proceedings re Ukraine v Russia](https://icj-web.leman.un-icc.cloud/sites/default/files/case-related/166/166-20230606-ora-01-00-bi.pdf) cites CAT UXO's “SPM Limpet Mine” entry as a source alongside Ukrainian forensic evidence and witness testimony concerning a limpet mine discovered in the Kharkiv region. The CAT-UXO page was specifically listed in the judges' materials.
| **Capabilities** | **Limitations** |
| ---------------------------------------------------------------------------- | ------------------------------------------------------------------------------------- |
| Searchable database covering a wide range of explosive hazards. | CAT-UXO states that its information is not exhaustive or fully accurate. |
| Includes photographs and information that can assist with object comparison. | Database entries may originate from varying open sources and individual contributors. |
| Covers UXO, mines, munitions, IEDs and related incidents. | A database match does not constitute definitive technical identification. |
| Can provide useful historical and geographical context. | Some technical information and downloads require membership. |
| Useful for corroborating open-source imagery and reporting. | User-contributed material may require independent verification. |
| Allows users to contribute information to the database | 
**2. Select the required conversion option or output format, then export or copy the converted coordinates into mapping or analysis tools.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses a small number of functional, security, and analytics cookies. These include Google Analytics cookies (\_ga, \_ga\_D046Z9W07N) for anonymous website usage statistics, an ASP.NET session cookie for maintaining user sessions, a Cloudflare security cookie (cf\_clearance) to protect against automated abuse, and a temporary form cookie (FormValues) to support website functionality.
No account or persistent user profile cookies were identified.
### Use in Reporting
EarthPoint Convert can support reporting by:
* Standardising coordinates before including them in reports.
* Converting location data into formats understood by mapping platforms.
* Helping analysts verify and display geographic evidence.
* Supporting geolocation investigations where coordinates are provided from multiple sources.
**Note:** When used in reporting, analysts should record the original coordinate format and the conversion method used to maintain transparency and reproducibility.
| **Capabilities** | **Limitations** |
| -------------------------------------------------------- | ---------------------------------------------------------------------------- |
| Converts geographic coordinates between common formats. | Doesn’t provide imagery, satellite analysis or location intelligence itself. |
| Helps prepare location data for mapping platforms. | Accuracy depends on the quality of the input coordinates. |
| Supports quick coordinate validation and formatting. | Limited analytical features compared with dedicated GIS software. |
| Useful for geolocation investigations. | Online processing may not be suitable for sensitive operational data. |
| Provides a simple interface suitable for quick analysis. | Doesn’t independently verify whether coordinates are correct/authentic. |
| 
**2. Review results and cross-reference findings with other OSINT sources to confirm accuracy.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
AnyWho uses a combination of functional, analytics, and third-party advertising cookies. First-party cookies (Anywho-IDKEY, Anywho-SESSIONKEY) support visitor identification, session management, and website functionality. Google Analytics cookies (\_ga\_4YLQR6FQ93) collect website usage statistics. Third-party DoubleClick cookies (IDE, DSID, ar\_debug) indicate the use of Google's advertising and measurement services, which may support personalised advertising and visitor tracking.
### Use in Reporting
AnyWho can support reporting by:
* Providing initial leads on individuals and contact details.
* Helping identify possible links between names, addresses, and phone numbers.
* Supporting identity resolution when combined with other sources.
* Providing publicly available information that can assist with investigative timelines.
Use cases may include people-finding investigations, fraud and scam investigations, cyber investigations, and missing persons cases.
| **Capabilities** | **Limitations** |
| --------------------------------------------------------- | ----------------------------------------------------------------------------- |
| Searches publicly available people directory information. | Data accuracy depends on directory records and update frequency. |
| Supports name, phone number, and address searches. | Coverage is limited outside the United States. |
| Useful for initial identity discovery. | Results may contain outdated or incorrect information. |
| Can help connect basic personal identifiers. | Doesn’t provide verified identity confirmation. |
| Provides quick results suitable for early OSINT research. | Limited investigative depth compared with specialist people-search platforms. |
### Summary
AnyWho is a basic people-search and directory lookup tool that fits best within the initial discovery and identity research stages of the OSINT workflow.
### Ownership
Currently owned and operated with data powered by [Spokeo.](https://www.spokeo.com/privacy)
Spokeo is a privately held company owned by its original co-founders[ ](https://www.linkedin.com/in/tangtalks)Harrison T, Mike Daly, Ray Chen, and Eric Liang.
### Ethical Considerations
* Use publicly available information responsibly and lawfully.
* Avoid using personal information for harassment, stalking, or unauthorised targeting.
* Verify information before reporting or attributing it to an individual.
* Consider privacy expectations when handling personal data.
* Follow applicable data protection laws and organisational policies.
### Related Tools:
* Whitepages
* TruePeopleSearch
* [BeenVerified](/osint-tools/beenverified)
* [192.com](/osint-tools/192.com)
#### Sources
**2. Review results and see what positive results run alongside the specific blacklist names.**
**3. Click ‘see why’ to find out more information about the blacklist inclusion. Note: you will be directed to a third-party website.**
**4. Validate findings using additional reputation services (such as VirusTotal, AbuseIPDB or Shodan) before drawing conclusions, as listings may be temporary or relate to historical activity.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses first-party analytics cookies (Hst) to record visitor statistics (visits, sessions and page views), along with a standard PHP session cookie (PHPSESSID) required for website functionality. No account or login cookies are required for basic searches.
### Use in Reporting
Blacklist Alert can be used to:
* Assess the reputation of IP addresses and domains.
* Support investigations into phishing, spam or malicious infrastructure.
* Corroborate findings from other infrastructure analysis tools.
* Provide evidence that infrastructure has previously been reported by security communities.
* Inform risk assessments when profiling organisations or digital assets.
**Note:** Reputation alone should never be treated as evidence of malicious intent.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| Checks IP address and domains simultaneously. | Only reports whether a target appears on participating blacklists. You have to enter third-party sites to find out why. |
| Aggregates results from numerous public DNS-based blacklists in one search. | Blacklist entries may be historical, temporary or inaccurate, leading to false positives. |
| Quickly identifies infrastructure associated with spam or malicious activity. | Doesn’t provide attribution or identify threat actors. |
| No registration required allowing quick lookups during investigations. | Coverage is limited to the blacklists included in the service. |
| Useful for validating indicators of compromise (IOCs) during infrastructure analysis. | Requires corroboration with additional OSINT and technical analysis before reporting. |
### Summary
Blacklist Alert is a fast, lightweight reputation-checking tool, most valuable as an infrastructure validation and enrichment tool and best used after identifying technical infrastructure but before producing reporting.
Any blacklist hits should always be validated with complementary sources such as VirusTotal, AbuseIPDB, passive DNS and hosting intelligence.
### Ownership
Not publicly disclosed. Domain registration details [here. ](https://www.whois.com/whois/blacklistalert.org)
### Ethical Considerations
* Blacklist status should not be used as sole evidence of malicious activity.
* Infrastructure may be compromised, shared or inherited by legitimate users.
* Always corroborate blacklist findings with additional OSINT and technical evidence.
* Ensure reporting reflects that blacklist listings represent reputation indicators rather than proof.
* Avoid making attribution decisions based solely on reputation data.
### Related Tools:
* VirusTotal
* AbuseIPDB
* Shodan
* Cisco Talos Intelligence
* Spamhaus Lookup
#### Sources
**2. Review user profiles, post histories and discussion threads to identify historical activity, technical discussions, transaction references or links to external platforms.**
**3. Corroborate findings with blockchain explorers, social media, WHOIS records and cryptocurrency intelligence platforms before including information in reporting.**
\\
\\
### Cost * [x] Free * [ ] Partially Free * [ ] Paid ## Data Processing ### Account Required: * [ ] Yes * [x] No #### Cookies: The site uses essential cookies for website security and session management. Cloudflare's cf\_clearance cookie protects against automated abuse and DDoS attacks, while the sessionid cookie maintains the user's browsing session and login state. No advertising or tracking cookies are required for basic browsing. ### Use in Reporting BitcoinTalk can be used to: * Research cryptocurrency projects and historical discussions. * Attribute usernames across multiple online platforms. * Identify cryptocurrency wallet addresses and transaction references. * Develop timelines of user activity and project development. * Support investigations into fraud, ransomware and cryptocurrency-enabled crime. * Corroborate information obtained from blockchain analysis or other OSINT sources.
| Capabilities | Limitations |
| Provides access to over a decade of cryptocurrency discussions and historical posts. | Information to user-generated and may be inaccurate, misleading or intentionally deceptive. |
| Allows searching by keyword, username, wallet address and discussion topic. | Most users operate under pseudonyms, making attribution challenging. |
| Reveals user profiles, posting history and community reputation. | Search functionality is less effective than external search engines for complex queries. |
| Can expose cryptocurrency addresses, PGP keys and technical indicators shared publicly. | Older discussions may reference obsolete technologies or inactive services. |
| Useful for identifying links between online aliases across multiple platforms. | Does not verify user identities or authenticate posted information. |
**2. Use map layers, filters and the timeline controls to examine vessel tracks, fishing activity, port visits and historical movement patterns.**
**3. Export or document relevant observations and corroborate findings with AIS databases, satellite imagery, sanctions lists and vessel registries before reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses Google Analytics cookies (*ga*\*) to collect anonymous usage statistics, a Google Ads attribution cookie (\_gcl\_au) to measure marketing effectiveness, and functional cookies to remember language preferences (i18next) and interface settings (panelWidths). An additional analytics cookie records the visitor's initial traffic source.
These cookies support website performance, analytics and user experience rather than investigative functionality.
### Use in Reporting
Global Fishing Watch can be used to:
* Track fishing vessel movements over time.
* Investigate illegal, unreported and unregulated (IUU) fishing activity.
* Identify potential ship-to-ship (transshipment) interactions.
* Support sanctions evasion and maritime smuggling investigations.
* Develop timelines of vessel movements and operational patterns.
* Corroborate maritime intelligence obtained from AIS databases and satellite imagery.
You can [view success stories here.](https://globalfishingwatch.org/success-stories/)
| Capabilities | Limitations |
| Visualises global fishing vessel activity using interactive maps. | Coverage depends on AIS transmissions. Vessels that disable AIS or spoof signals may not be visible. |
| Provides historical vessel tracks and movement timelines. | Some fishing activity is inferred using machine learning and should not be considered definitive evidence. |
| Combines AIS data with satellite imagery and machine learning. | Smaller vessels operating without AIS are often absent from the platform. |
| Allows filtering by vessel type, location, date and activity. | Satellite coverage and data refresh rates may vary by location. |
| Integrates well with other maritime OSINT and vessel intelligence tools. | Advanced datasets and APIs may require registration or approval. |
**2. Review the company profile, including directors, shareholders, ownership structures, financial information, filing history and associated organisations.**
**3. Corroborate findings with official company registries, sanctions databases, beneficial ownership registers and other OSINT sources before including them in reporting.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for basic searches. Yes for full functionality.
### Cookies:
The site uses ConsentManager cookies (\_\_cmp\*) to store user privacy preferences and manage cookie consent. Uses Google Ads attribution (\_gcl\_au) and Leadfeeder analytics (\_lfa) cookies to measure website usage, marketing performance and identify organisational website visitors.
### Use in Reporting
North Data can be used to:
* Identify company directors and shareholders.
* Analyse corporate ownership and organisational structures.
* Support beneficial ownership and due diligence investigations.
* Develop timelines of corporate changes and filings.
* Identify links between companies and individuals.
* Corroborate information from official company registries and financial records.
View investigations into corporate crime, environmental crime, and sanctions evasion through [North Data’s Crime Lab section here.](https://blog.northdata.com/tag/crime-lab)
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- |
| Searches millions of company records from multiple jurisdictions. | Coverage varies between countries depending on the availability of public records. |
| Displays corporate ownership structures through interactive relationship diagrams. | Some financial data, documents, and advanced analytics require a paid subscription. |
| Provides access to directors, shareholders, and filing histories. | Information may not reflect the most recent filings if source registers haven’t been updated. |
| Includes financial information, insolvency records, and historical company data where available. | Beneficial ownership information is only available where disclosed in official records. |
| Enables quick identification of relationships between organisations and individuals. | Doesn’t independently verify the accuracy of source registry data. |
### Summary
North Data is a powerful corporate intelligence platform best used during the entity research, corporate profiling and intelligence enrichment phases of the OSINT workflow, and is particularly valuable for due diligence, ownership analysis and corporate investigations.
### Ownership
North Data (North Data GmbH) is owned and led by its founder [Frank Felix Debatin](https://www.linkedin.com/in/frankfelix/). Karweg Ventures and Kölmel Management Group invested in the company in the summer of 2016 where it was renamed North Data GmbH and entered into a strategic partnership with Echobot Media Technologies GmbH today known as Dealfront. The company is based in Hamburg, Germany.
### Ethical Considerations
* Verify key findings against official company registries before reporting.
* Recognise that public register information may be incomplete or subject to reporting delays.
* Avoid assuming ownership or control solely from historical corporate records.
* Respect applicable licensing and terms of use when reproducing company data.
* Consider privacy implications when reporting on individuals associated with legitimate businesses.
### Related Tools:
* [Companies House](/osint-tools/companies-house)
* [OpenCorporates](/osint-tools/opencorporates)
* [OpenSanctions](/osint-tools/open-sanctions)
#### Sources
**2. Open an entity or program page to review source records, identifiers, authorities, chronology, relationships, and changes.**
**Note:** You can use the Dashboard for high-level sanctions statistics and analytical overviews, the Global Sanctions Map to explore geographic exposure, and Sanctions Changes to review recent designations, modifications, and delistings.
**3. Open the linked official authority record to verify important findings before publication or consequential use and create optional monitors or alerts to follow selected entities, authorities, programs, or changes.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Free with paid options.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No for public research. Yes for saved monitoring and certain workflow features.
### Cookies:
Essential session cookies and local storage are used, along with documented analytics. Public search works without an account.
**Note:** During our session on 4 August 2026, we noted zero cookies being used.
### Use in Reporting
Sanctions Atlas can support reporting and investigations involving sanctioned people, organizations, companies, vessels, sanctions programs, geographic exposure, and changes to official sanctions lists.
**Potential uses include:**
* Checking whether a person, organization, company, or vessel appears in one or more of the six covered sanctions systems.
* Searching by name, alias, passport number, registration number, official sanctions ID, tax identifier, or vessel IMO number.
* Comparing how the same entity is listed by different authorities while retaining each authority’s original record and official ID.
* Reviewing designation dates, programs, aliases, identifiers, relationships, modifications, partial delistings, and full removals.
* Researching sanctions programs and the entities listed under them.
* Using country, authority, dashboard, and global-map views to identify wider geographic or program-level patterns.
* Following recent designations, modifications, and delistings through the sanctions changes and monitoring features.
* Locating the original issuing-authority record for direct verification and citation.
A typical reporting workflow is to search an entity or identifier, review the relevant entity and program pages, compare authority coverage and chronology, and then open the linked official record before publishing an important claim. Sanctions Atlas preserves authority-specific provenance and reviews imported changes before publication, but the issuing authority remains the authoritative source.
Care should be taken with common names and incomplete records. Reporters should compare dates of birth, nationalities, passport details, registration numbers, addresses, vessel identifiers, aliases, and other identifying information rather than relying on a name alone
Relationship wording should not be expanded beyond the evidence. For example, “linked to” should not be rewritten as “owned by,” “controlled by,” or “managed by” unless the official source specifically supports that conclusion.
| **Capabilities** | **Limitations** |
| ----------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Search across 6 official sanctions authorities, | It does not cover every national or regional sanctions regime. |
| Search people, organisations, vessels, aliases, official IDs, registration numbers & IMO numbers. | Official-source coverage varies. Some authority records contain extensive identifiers and remarks, while others contain only a name and limited designation information. |
| Browse sanctions programs, authorities, countries and concepts. | Historical and delisted records may remain visible for research purposes and should not be mistaken for an active designation. |
| Source-linked entity dossiers & designation histories. | Source records remain authoritative. Important findings should be confirmed against the issuing authority.
**2. Review the generated text/subtitles and optionally translate if needed.**
**3. Review, edit, and export the relevant text for analysis, reporting, or archiving.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
One free use per day otherwise paid credits required.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No account required for basic use. Some features may require registration.
### Cookies:
FreeSubtitles AI uses functional and analytics cookies. Analytics cookies (\_pk\_\*) appear to be associated with Matomo and are used to measure website usage and visitor behaviour. Functional cookies (connect.sid, freeVisitorId) maintain user sessions and manage anonymous access. A transcription access cookie is used to provide access to processed files and may temporarily contain metadata linked to uploaded media.
No obvious advertising or third-party tracking cookies were identified.
### Use in Reporting
FreeSubtitles AI can support OSINT reporting by transforming audio-visual sources into text that can be reviewed and analysed. It is especially valuable when working with:
* Social media videos
* Interview recordings
* Public speeches
* Podcasts
* News clips
* Eyewitness footage
It can be particularly valuable when reviewing conflict footage where language barriers are present.
**Note:** Generated transcripts should be manually checked against the original recording before publication, as AI transcription can introduce errors.
| **Capabilities** | **Limitations** |
| ---------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- |
| Automatically converts audio and video files into written transcripts. | Transcription accuracy can vary depending on audio quality, background noise, accents, and multiple speakers. |
| Generates subtitles from spoken content with minimal manual effort. | AI-generated transcripts may contain incorrect words or missing information. |
| Helps researchers search and analyse video content more efficiently. | Doesn’t verify whether statements made in recordings are true or authentic. |
| Supports faster review of large volumes of audiovisual material. | Uploaded files may involve privacy or data protection considerations. |
| Can assist with extracting quotes, timestamps, and key statements. | Limited value for analysing non-verbal information such as visual context, locations, or objects within footage. |
### Summary
FreeSubtitles AI is best positioned in the collection and processing stages of the OSINT workflow. It’s most useful after identifying relevant audio/video sources, helping investigators convert unstructured media into searchable text for deeper analysis.
### Ownership
Owned and operated by Saint Technology, Inc., a US-based company.
### Ethical Considerations
* Ensure you have permission to process private recordings.
* Avoid uploading sensitive or confidential material without appropriate safeguards.
* Treat AI-generated transcripts as a draft requiring human verification.
* Preserve original recordings to maintain evidential integrity.
* Consider whether automated transcription could misrepresent speakers through errors or missing context.
### Related Tools:
* OpenAI Whisper
* Google Speech-to-Text
* Otter.ai
* Descript
#### Sources
**2. Browse the available posts, reels, stories, profile information and associated metadata.**
**3. Capture relevant findings, verify against the original Instagram source where possible, and preserve evidence using screenshots or archived links.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses cookies provided primarily by Yandex Metrica for website analytics, visitor statistics, session management, and GDPR compliance. Cookies such as yandexuid, yuidss, ymex, and yabs-sid are used to distinguish anonymous visitors and analyse website usage. Additional cookies (is\_gdpr, is\_gdpr\_b) support GDPR compliance, while receive-cookie-deprecation is used for browser compatibility with evolving cookie standards.
**Note:** Be mindful of third-party ads and pop-ups on the site.
### Use in Reporting
Dumpor can be particularly useful for:
* Person of Interest (POI) profiling * Social media investigations (SOCMINT) * Username attribution * Timeline reconstruction * Digital footprint analysis * Event and incident investigations * Background research and due diligence * Image and content preservation | **Capabilities** | **Limitations** | | ------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | View public Instagram profiles anonymously. | Only accesses publicly available Instagram content. Private accounts cannot be viewed. | | Browse posts, reels, hashtags, and locations without logging in. | Functionality (e.g. story viewing) depends on Instagram’s platform and may become unavailable without notice. | | Reduce the likelihood of generating profile or story view notifications. | Content may not always be current due to indexing or caching delays. | | Quickly gather publicly available profile information for investigations. | Not necessarily suitable for real-time monitoring, as third-party services may experience delays or temporary loss of functionality. | | Assist with identifying linked accounts, usernames, and posting patterns. |
**2. Simply download the exported results into your chosen format.**
**3. Review the downloaded content alongside other OSINT findings to identify patterns, timelines and relationships.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Free for basic use. Paid for larger exports and full functionality.
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No for basic use. Account may be required for full functionality.
### Cookies:
The site uses essential first-party cookies for session management and website functionality (\_tnwx and x-client). No notable third-party advertising or social media tracking cookies were identified during testing.
### Use in Reporting
ExportGram is useful for:
* Preserving Instagram profiles before content changes or is deleted.
* Archiving posts for evidential purposes.
* Building social media timelines.
* Identifying hashtags, mentions and recurring themes.
* Analysing posting frequency and activity patterns.
* Monitoring public accounts over time.
* Capturing engagement metrics for analysis.
* Supporting attribution of online personas.
**Investigative use cases might include:**
* Social media investigations.
* Threat actor profiling.
* Online persona attribution.
* Protest and event monitoring.
* Brand and reputation investigations.
* Fraud and scam investigations.
* Missing person enquiries.
* Corporate due diligence.
| Capabilities | Limitations |
| Exports publicly available Instagram profile data. | Only accesses publicly available Instagram content. |
| Preserves posts and metadata for offline analysis. | Cannot retrieve deleted or private posts. |
| Captures captions, hashtags, and engagement metrics. | Subject to Instagram platform restrictions and rate limits. |
| Produces structured downloadable reports. | Data quality depends on current profile availability. |
| Supports evidence preservation and audit trails. | Historical content may be incomplete if previously removed. |
| Reduces manual screenshot collection. |
\
**2. You can filter results via date, policy area, and topic:**
**3. Review trends, compare reporting from multiple sources, and use the results to support further OSINT collection and verification.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
(Although some specialist services require registration).
### Cookies:
The site uses first-party functional, security and analytics cookies. Observed cookies include Matomo analytics cookies (\_pk\_id and \_pk\_ses) for measuring website usage, a consent-management cookie (cck1), and session/security cookies (355bb..., jrc\_cookie, and TS013019d...) used for maintaining website functionality and infrastructure security. No third-party advertising cookies were observed during testing.
### Use in Reporting
Europe Media Monitor provides an excellent starting point for:
* Monitoring breaking news and emerging incidents.
* Tracking media coverage and discovering additional sources.
* Supporting crisis and emergency monitoring.
* Identifying media coverage across multiple countries.
* Comparing international reporting.
* Monitoring terrorism and security-related events.
* Tracking organised crime reporting.
* Supporting due diligence and risk assessments.
[Researchers have used EMM datasets](https://arxiv.org/abs/1603.02604) and analytical capabilities to study media trends, multilingual news analysis, and information extraction techniques.
| **Capabilities** | **Limitations** |
| -------------------------------------------------------- | -------------------------------------------------- |
| Monitors thousands of global news sources. | Limited to publicly available news content. |
| Supports dozens of languages with automated translation. | Doesn’t index all global media outlets. |
| Clusters related articles into single events. | Automated translations may lose context or nuance. |
| Provides near real-time media monitoring. | Cannot verify the accuracy of source reporting. |
| Enables filtering by country, language, and topic. | Some articles may be duplicated or syndicated. |
### Summary
Europe Media Monitor is a powerful media monitoring platform, best used during the discovery, collection and monitoring phases of the OSINT workflow. It’s particularly valuable for identifying emerging stories, monitoring ongoing events, and locating original reporting from multiple countries and languages. However, information identified through EMM should be corroborated using primary sources.
### Ownership
Developed and maintained by the European Commission Joint Research Centre (JRC) on behalf of the European Commission.
### Ethical Considerations
* Verify information against original reporting before drawing conclusions.
* Be aware of media bias and differing editorial perspectives.
* Use multiple independent sources to corroborate significant events.
* Consider translation inaccuracies when reviewing foreign-language reporting.
* Respect copyright when reproducing or citing news articles.
* Avoid relying solely on aggregated news for evidential decisions.
### Related Tools:
* Google News
* GDELT Project
* Meltwater
* NewsNow
#### Sources
**2. Review available shipment details including movement status, locations, vessel information and estimated arrival dates.**
**3. Record relevant information and corroborate findings with additional maritime intelligence sources.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses first-party functional, analytics and user experience cookies. Observed cookies include Medallia/Kampyle feedback cookies (kampyle\_\*) used for website experience analytics, a session cookie (PIM-SESSION-ID) for maintaining website functionality, and a language preference cookie (selectedLang). No advertising or third-party tracking cookies were observed during testing.
### Use in Reporting
Maersk Tracking can support investigations and intelligence reporting involving both maritime and air logistics activity. It can be used to verify shipment movements, confirm delivery timelines and support supply chain analysis.
**Potential reporting uses include:**
* Tracking ocean container movements.
* Tracking air cargo shipments.
* Establishing shipment timelines.
* Verifying import/export activity.
* Supporting corporate due diligence.
* Mapping supply chain relationships.
* Investigating logistics networks.
* Supporting sanctions and trade compliance research.
* Corroborating information from shipping documents.
* Identifying links between companies, ports, airports and transport routes.
| **Capabilities** | **Limitations** |
| -------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Tracks Maersk ocean and air cargo shipments. | Requires a known shipment identifier (tracking/container number) to search. |
| Provides shipment status and milestone updates. | Doesn’t provide full cargo manifests or detailed cargo contents. |
| Supports container, booking, and shipment reference searches. | Visibility depends on Maersk data availability and shipment type. |
| Helps identify transport routes and logistics activity. | Historical tracking information may be limited. |
| Provides estimated arrival and delivery information where available. | Cannot independently confirm ownership or final destination of goods. |
| Supports supply chain mapping and verification. | 
**2. Use the generated hash as a pivot to search for other websites or infrastructure using the same favicon. Investigate any matches for signs of brand impersonation, phishing or other suspicious activity.**
The tool connects with Shodan, VirusTotal and Censys. Our results with Censys below:
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
No account or login is required. The site states that it is built using Cloudflare Workers; no cookie requirement is identified on the tool itself and none were noted during our site session on 10 August 2026.
### Use in Reporting
Relevant use cases include:
* Brand impersonation investigations. * Phishing investigations. * Threat intelligence (pivot from a known suspicious website to potentially related infrastructure.) * Infrastructure mapping (identify websites or hosts that share a common favicon and investigate possible links between them.) * Lookalike website investigations. * Brand protection reporting.
Note: A favicon hash alone does not establish ownership or attribution. | **Capabilities** | **Limitations** | | -------------------------------------------------------------- | ------------------------------------------------------------ | | Generates a hash from a favicon.ico file. | A matching favicon doesn’t prove common ownership. | | Identifies websites using the same favicon. | Legitimate websites may use the same favicon. | | Supports brand impersonation investigations. | Changing a favicon will produce a different hash. | | Can help uncover potential phishing websites. | A favicon hash alone provides limited investigative context. | | Provides a useful pivot for finding related infrastructure. | Some websites may prevent their favicon being retrieved. | | Can be used with either a favicon URL or a local favicon file. |
**2. Review the available transaction history, balances, token transfers and associated blockchain activity.**
**3. Follow relevant wallet addresses and transactions to identify potential links, movement of funds or other investigative leads.**
### Cost
* [ ] Free
* [x] Partially Free
* [ ] Paid
Free core features. Paid Premium and API options available.
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No for core features. An account is required for features such as private notes and other personalised functionality.
### Cookies:
The site uses cookies for session management, security, analytics and user preferences. Cookies observed include Google Analytics (\_gid), an ASP.NET session identifier, Cloudflare security (cf\_clearance) and Etherscan preference/localisation cookies. Some cookies may contain geographic or session-related information.
### Use in Reporting
Etherscan can be used to:
* Trace cryptocurrency transactions between wallet addresses.
* Investigate wallets linked to scams, fraud or other suspicious activity.
* Identify patterns of cryptocurrency movement and fund flows.
* Corroborate findings from other cryptocurrency and OSINT sources.
* Document transaction hashes, wallet addresses, timestamps and amounts as evidence.
* Support investigations into cryptocurrency-related activity and financial crime.
* Inform risk assessments when profiling wallets, transactions or organisations.| **Capabilities** | **Limitations** | | ----------------------------------------------------------- | ------------------------------------------------------------ | | Search wallet addresses, transactions, and smart contracts. | Wallet addresses don’t directly identify individuals. | | Trace cryptocurrency and token transfers. | Transaction activity doesn’t prove intent or criminality. | | View wallet balances and transactions histories. | Etherscan labels may require independent verification. | | Investigate token and contract activity. | Some activity may involve exchanges or intermediary wallets. | | Identify links between wallet addresses. | On-chain data provides limited off-chain context. | | Record transaction hashes for verification and reporting. |
### How to Use: **1. Enter the phone number, ideally in full international format including the + country code.**
**2. Review the available information, such as country, location, carrier, line type and any directory or reputation information.**
**3. Corroborate useful findings with additional sources before including them as evidence in an investigation or report.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses Google Analytics cookies, including ga and \_ga\_5S7X95X113, to measure website usage and user interactions.
### Use in Reporting
ThisNumber can be used to:
* Identify the country and region associated with a phone number.
* Identify the reported carrier and line type.
* Support investigations into unknown or suspicious callers.
* Investigate potential scam and spam numbers.
* Corroborate phone number information from other OSINT sources.
* Provide supporting information when profiling a person, organisation or digital identifier.
* Record available phone number information as a lead for further investigation.
| **Capabilities** | **Limitations** |
| ----------------------------------------------------- | --------------------------------------------------------- |
| Searches phone numbers across 200+ countries. | Results vary depending on the country. |
| Identifies country, region, and time zone. | Information may be incomplete or outdated. |
| Provides carrier and line-type information. | International numbers may have limited results. |
| May identify names and addresses for some US numbers. | The results don’t confirm current ownership. |
| Can highlight reported scam or spam numbers. | Names and addresses may require independent verification. |
| Supports phone number verification and enrichment. | 
**2. Use the filters to narrow results by date, resolution and data type. Select individual imagery to inspect its preview and associated metadata, including information about the imagery provider and capture details where available.**
**3. Download the imagery where appropriate, or use the available map-layer services in tools such as QGIS. Record the imagery date, provider, resolution, license and relevant metadata so the source can be properly documented in your investigation.**
**You can also** [**view this YouTube guide here.** ](https://www.youtube.com/watch?v=woDsyAQQMko)
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [x] Yes
* [x] No
Searching and accessing imagery through the browser does not require an account. An account is required for those uploading imagery.
### Cookies:
OpenAerialMap uses Google Analytics and Matomo analytics cookies to measure visits and website activity. It also uses functional cookies such as oam-map-view to retain map state. No authentication/session cookie is evident in the supplied cookie set.
### Use in Reporting
OpenAerialMap can be used to:
* Verify locations and corroborate where an image or video was taken.
* Show change over time by comparing sites across different dates.
* Map events and place incidents or infrastructure geographically.
* Corroborate claims by testing visual and location-based assertions.
* Provide aerial context by showing the wider area around a subject.
* Support visual evidence with independent geospatial information.
[The platform](https://www.elrha.org/projects/openaerialmap) was specifically developed to make satellite and UAV imagery easier for humanitarian responders to find and access after disasters. Its original humanitarian project focused on coordinating imagery so responders could quickly identify what coverage existed and use it for response planning.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------- |
| Search for aerial imagery covering specific locations and areas of interest. | Coverage varies significantly by location and may be limited in some areas. |
| Filter available imagery by factors such as date, resolution, and data type. | Available imagery may not match the date or timeframe of an investigation. |
| View imagery online and download available files for further analysis. | Image quality and resolution vary depending on the imagery source. |
| Access useful metadata about imagery including source and capture information. | Metadata can be incomplete, inconsistent, or unavailable for some imagery. |
| Compare imagery from different dates to identify changes at a location. | OpenAerialMap does not independently guarantee the accuracy of contributed imagery. |
| Import imagery into GIS tools such as QGIS for further analysis. | Detailed analysis often requires external GIS or image-analysis tools. |
### Summary
OpenAerialMap fits best at the geospatial discovery and verification stage of the OSINT workflow, sitting between identifying an area of interest and conducting detailed geospatial analysis. It can also support corroboration and evidence presentation later in an investigation.
Its strongest use is not simply finding a picture of a location, but finding appropriately dated, geographically relevant imagery with usable metadata that can be compared against other evidence.
### Ownership
OpenAerialMap is part of the [Humanitarian OpenStreetMap Team (HOT)](https://www.hotosm.org/en/) ecosystem and is built on the Open Imagery Network (OIN).
### Ethical Considerations
* Verify imagery before using it as evidence.
* Check licensing and provide appropriate attribution.
* Consider privacy risks in high-resolution imagery.
* Avoid exposing sensitive or vulnerable individuals.
* Do not overstate what imagery can prove.
* Preserve source details and imagery provenance.
### Related Tools:
* Google Earth Pro
* OpenStreetMap
* [Copernicus](/osint-tools/copernicus-browser)
* [Mapillary](/osint-tools/mapillary)
* [Wikimapia](/osint-tools/wikimapia)
#### Sources
### How to Use: **1. Search for a location using the interactive map or add locations for analysis. Multiple locations can be analysed and compared.**
**2. Select the relevant water-risk indicators, such as baseline water stress, drought risk, flood risk, water depletion or variability. Aqueduct provides explanations for the individual indicators to help interpret the results.**
**3. Review the results and, where required, export the data as CSV or GeoPackage (.GPKG) for further analysis in tools such as QGIS. Record the relevant indicator, dataset version, location and timeframe when using results in reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
The platform can be used to analyse locations and download results without creating a user account.
### Cookies:
The site uses RudderStack analytics cookies to identify anonymous visitors, track sessions and record referral information. WRI also uses X/Twitter marketing cookies, including muc\_ads and personalization\_id, for advertising and personalisation. No authentication cookie was noted.
### Use in Reporting
Aqueduct Water Risk Atlas can be used to:
* Assess water risk at specific locations.
* Identify areas exposed to water stress or scarcity.
* Contextualise environmental and climate-related investigations.
* Compare water risk across sites, regions or assets.
* Support reporting on corporate and infrastructure exposure.
* Corroborate claims about local water-related pressures.
As a real-world example, [WRI mapped Owens Corning's facilities](https://www.wri.org/research/case-study-aqueduct-informs-owens-corning-corporate-water-strategy) (a multinational building materials manufacturer) against current and projected water stress to identify which operations faced higher water-supply risks.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| Maps water risk across locations worldwide using standardised indicators. | Results are modelled estimates rather than direct measurements. |
| Assesses risks including water stress, depletion, drought, and flooding. | Baseline data is not real-time and may not reflect current conditions. |
| Compares water risk between different locations, sites, and regions. | Future projections are scenarios rather than precise predictions. |
| Provides historical baseline data and future risk projections. | Global datasets may overlook important local or site-specific factors. |
| Allows results and datasets to be exported for further analysis. | Data quality and accuracy depend on the underlying models and inputs. |
| Supports GIS analysis using downloadable spatial data. | 
**2. Click on the world map to make your own location estimate, then select “Guess Location” to see the model's result.**
**3. Compare your estimate with the model's heat map, ground-truth location and scene classification. Use the result to understand how visual features can influence automated geolocation.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
No cookies are used for TIB's web analytics, according to TIB's privacy information. No cookies were used during our site session on 11 August 2026.
### Use in Reporting
Geoestimation is very much a background/learning tool with limited operational capability but it can be useful to:
* Test whether AI can support a difficult geolocation problem.
* Generate additional hypotheses about an image's likely location.
* Compare human and machine geolocation estimates.
* Support research into AI-assisted visual verification.
* Use as a methodological reference for automated geolocation.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------- | -------------------------------------------------------------------- |
| Estimates geographic location from visual image content. | The current demo doesn’t accept users’ own photographs. |
| Uses scene context such as urban, natural, and indoor environments. | Results are estimates and can be geographically inaccurate. |
| Produces a heat map of likely geographic areas. | Generic scenes can provide few reliable location clues. |
| Shows image regions that influenced the model’s decision. | Model performance can vary significantly between images and regions. |
| Provides comparison between human and machine estimates. | The underlying research and demonstrator date from the late 2010s. |
| Uses a research-backed deep-learning geolocation methodology. | 
**2. Open the community archive and browse the available pages and posts. Use the community name, post title, author information and dates as investigative leads.**
**3. Record the archive URL and relevant post information, then corroborate important material against other archives, cached material, screenshots, contemporary reporting or independent sources.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
No account is required and no cookies noted during our session on 11 August 2026. The site is hosted on Netlify, but cookie behaviour can change so be mindful when browsing.
### Use in Reporting
deaditArchive can be used to:
* Recover historical posts from purged Reddit communities.
* Investigate how online communities developed over time.
* Verify claims about previously deleted Reddit content.
* Trace historical narratives and recurring themes.
* Identify material for further source investigation.
As an example, if you were investigating the history of an online political movement, you could use deaditArchive to recover posts from a subreddit that has since been banned or removed. You could then identify dates, usernames, recurring narratives and links, and cross-check those findings against archived webpages, contemporary news coverage and other social-media sources.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------ | ------------------------------------------------------------------------------- |
| Browses archived posts from selected purged Reddit communities. | Coverage is limited to communities included in the archive. |
| Accesses material that may no longer be available on live Reddit. | The archive doesn’t represent all deleted Reddit content. |
| Investigates historical community activity and discussions. | Provenance and completeness of archived material may be difficult to establish. |
| Identifies posts, usernames and themes for further research. | Posts may be missing, incomplete, or separated from their original context. |
| Provides leads for investigated deleted or removed online content. | Archive availability and content may change over time. |
| Preserves a historical snapshot of selected online communities. | 
**2. Use the available search-engine links to pivot the same query across different services. Try general search, news, images, maps, social platforms, academic search and archive services where relevant.**
**3. Compare the results, follow promising leads and move to the original source for verification.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
No cookies are used by default on the site itself. (and none were noted during our site session on 13 August 2026). Cookies may be used to save user settings, but the site states these do not contain identifying information or track users.
**Note:** When clicking through to third-party search sites, you will need to check each for cookie use.
### Use in Reporting
100 Search Engines can be used to:
* Identify websites, organisations, people, documents and other potential sources during the early stages of an investigation.
* Locate news, archives, academic material and original sources.
* Turn names, usernames, domains and keywords into new leads.
* Compare results across multiple search engines and services.
The platform has been recommended within the [Week in OSINT](https://medium.com/week-in-osint/week-in-osint-2018-42-e8a980e86f50) resource series as a directory for finding specialised and niche search engines.
| **Capabilities** | **Limitations** |
| --------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| Provides access to many search engines and specialist search services from one interface. | It’s primarily a search hub so it doesn’t independently verify the information returned. |
| Supports useful search operators including phrases/exclusion terms. | Results depend on the underlying search engine's index, ranking and availability. |
| Enables quick cross-engine searching and pivoting. | Different engines may return overlapping results rather than genuinely independent coverage. |
| Provides access to specialist searches including news, images, maps, video, academic search and archives. | Some linked services may have their own cookies, tracking or data-processing practices. |
| No account required for normal use. | Search functionality and linked services can change, disappear or become outdated. |
### Summary
100 Search Engines is best viewed as an OSINT discovery and collection tool rather than an investigative database. It’s most useful in the initial discovery/collection stage, when you need to broaden searches, test alternative search engines, and identify potential sources.
It can also support pivoting, particularly when a conventional Google or Bing search does not provide enough useful results.
### Ownership
The site is owned by [Advanced Search Technologies](https://www.linkedin.com/company/advancedsearchtechnologies/about/); a privately held US company based in Reno, Nevada, with offices in Connecticut.
### Ethical Considerations
* Use only publicly accessible information and comply with applicable laws, policies and terms of service.
* Do not assume that information being searchable makes it appropriate to collect, retain or publish.
* Minimise collection of unnecessary personal information.
* Verify potentially harmful, sensitive or consequential claims before reporting.
* Treat search results as leads rather than facts.
* Be aware that third-party search engines and linked websites may have different privacy and data-retention practices.
* Avoid relying solely on search ranking, snippets or sponsored results as evidence.
* Maintain an auditable record of important searches where findings may inform intelligence products or formal reporting.
### Related Tools:
* [Fagan Finder](/osint-tools/fagan-finder)
* Google Search
* Microsoft Bing
* [DuckDuckGo](/osint-tools/duckduckgo)
* [Wayback Machine](/osint-tools/wayback-machine)
#### Sources
**2. Choose an appropriate search engine, database or specialist service and enter the relevant keywords, names, usernames, organisations or phrases.**
**3. Compare and pivot between relevant services, then follow promising results back to the original source for verification and reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
The site itself is free but some linked services require payment.
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
No account is required to use Fagan Finder itself. Some linked services may require an account.
### Cookies:
The site uses first party Google Analytics cookies and third party Google advertising cookies for website analytics and advertising related functions.
**Note:** When clicking through to third-party search sites, you will need to check each for cookie use.
### Use in Reporting
Fagan Finder can be used to:
* Find relevant people, organisations, websites and documents.
* Locate specialist databases and less obvious information sources.
* Search international and non English sources.
* Identify news reports, archives, academic material and government records.
* Pivot from an initial lead into related platforms and information sources.
* Locate original sources for verification and evidential reporting.
The platform is widely included in OSINT, cybersecurity and investigative research guides as a search aggregation and source discovery tool.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------- |
| Provides access to a very broad range of search engines and specialist resources. | Does not independently verify the information returned by linked services. |
| Covers social media, news, academic, government, archive, image, video and data sources. | Availability and functionality depend on third party services. |
| Strong international and multilingual coverage. | Some resources require accounts, subscriptions or institutional access. |
| Helps identify information that may not appear prominently in conventional search engines. | Some listed tools and information pages may become outdated or unavailable. |
| Supports effective investigative pivots and source discovery. | Different services have different search methodologies, privacy policies and data coverage. |
| Provides guidance explaining how different search tools work. | 
**2. Refine the search using operators such as OR, quotation marks, -, file extensions or intext:. For example, brazil OR brasil, "Brazil Digital Report", \*.rar or intext:brazil.**
**3. Review the results, open relevant public files and verify the information against the original document and additional sources before using it in reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
Google cookies are present because de-digger uses Google Custom Search, including security, consent and search localisation cookies. Some may process information such as search preferences or approximate location.
### Use in Reporting
de-digger is useful for:
* Finding publicly accessible documents and files on Google Drive.
* Locating reports, presentations, spreadsheets and datasets.
* Searching for documents connected to people, organisations or investigations.
* Identifying potentially exposed information for further verification.
* Pivoting from discovered documents to names, organisations, domains and other leads.
* Preserving the original Google Drive URL and document details when using a finding in reporting.
| **Capabilities** | **Limitations** |
| -------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
| Searches specifically for publicly accessible Google Drive files. | Limited to content that is publicly accessible and indexed. |
| Supports OR, exact phrases and exclusion searches. | It cannot access genuinely private or permission restricted files. |
| Can filter searches by file type.Can search for terms within document titles or body text using intext:. | Results depend on Google Custom Search and its indexing. |
| Particularly useful for document focused OSINT investigations. | Not every public Google Drive file will necessarily be indexed or returned. |
| ### How to Use: **1. Create an investigation graph and add relevant entities (from a huge range of options) such as name, DOB, domain, license plate, wallet, weight, eye colour etc. You can also create a custom entity.**
Search for a country, city, or region of interest, filter events by date, category, or location, then
select map markers to view summaries and source links.
| | Cost | Free. | | Account required | No. | | Cookies | Mostly advertising and user-tracking cookies. | | Ownership | Developed by Rodion Rozhkovskiy and Oleksandr Bilchenko, Ukrainian software engineers from Dnipro. | | Use in Reporting | Useful for monitoring developing events, identifying timelines, locating incidents geographically, and discovering original reporting sources | ### What does LiveUAMap do? LiveUAMap provides a near real-time visual overview of conflicts, security incidents, humanitarian crises, protests, natural disasters, and other significant events worldwide. Rather than producing original reporting, it aggregates information from news organisations, government statements, official social media accounts, and other publicly available sources, displaying incidents as map markers linked to their cited source. **The lowdown:** It helps analysts identify emerging events by providing rapid situational awareness. ### How to Use: **1. Search for the country, city, or region of interest using the search bar or navigate directly to a place of interest on the interactive map.** **Note:** A lot of third-party adverts may pop up during your search which can get a little frustrating.
**2. Filter events by date, category (e.g., military activity, explosions, protests, disasters), or geographic area to narrow the results.**
**3. Select individual map markers to read the event summary, review timestamps, and follow links to the original reporting source for verification.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses mostly advertising and user-tracking cookies. Several belong to companies involved in real-time bidding, where advertisers exchange anonymous identifiers to target ads.
To reduce tracking, you may want to block third-party cookies in your browser.
### Use in Reporting
LiveUAMap is particularly useful during the early stages of breaking news or conflict reporting when you need to build situational awareness quickly. It helps identify where incidents are occurring, establish an initial timeline, and locate original reporting for further verification.
Typical reporting uses include:
* Monitoring conflict developments across multiple regions in near real time.
* Identifying the approximate location of reported incidents for geospatial analysis.
* Building incident timelines by reviewing chronologically mapped updates.
* Discovering original news articles, official statements, or social media posts linked from map entries.
* Supporting verification workflows by identifying corroborating reports before conducting deeper OSINT analysis.
[Reuters Institute](https://reutersinstitute.politics.ox.ac.uk/news/15-tips-investigating-war-crimes-ukraine-and-beyond) specifically recommends LiveUAMap as a good starting point for obtaining coordinates before conducting deeper verification using Google Earth and Sentinel Hub.
| Capabilities | Limitations |
| Aggregates reports from numerous public and official sources into a single interface. | Does not produce original reporting - relies entirely on external sources. |
| Displays incidents geographically on an interactive map. | Coverage varies depending on media availability and regional reporting. |
| Provides chronological updates that assist timeline construction. | Some events may appear before they’ve been independently verified. |
| Links to original report sources to support verification. | Event summaries and intentionally brief and may lack context. |
| Covers multiple event types including conflicts, protests, disasters, and political developments. | Historical searching and filtering can be more limited. |
| Uses third-party advertising and tracking cookies. |
**2. You can also filter results by conflict type, environmental impact, commodity, affected population, or geographic region.**
**Note:** The filter tool takes you back to the beginning so can bring up a large set of results:
**3. Open an individual case study to review the summary, timeline, stakeholders, impacts, and linked reference material for further verification and reporting.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses minimal Google Analytics cookies to measure website usage.
### Use in Reporting
Typical reporting uses include:
* Researching the history of environmental conflicts.
* Identifying affected communities, companies, government agencies, and NGOs.
* Discovering academic papers, NGO reports, court cases, and official documents.
* Providing context for investigations into mining, pollution, infrastructure, conservation, or land rights disputes.
* Comparing similar environmental conflicts across countries or regions.
EJAtlas-style mapping and case identification can support investigations into Niger Delta oil pollution, [lithium extraction impacts in Chile](https://www.reuters.com/sustainability/land-use-biodiversity/lithium-mining-is-slowly-sinking-chiles-atacama-salt-flat-study-shows-2024-08-22/), and Indigenous land disputes such as the Dakota Access Pipeline conflict.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
| Maps thousands of environmental conflicts worldwide. | Doesn’t provide real-time reporting or live incident updates. |
| Provides structured case studies with timelines and geographic information. | Coverage depends on contributions from researchers and partner organisations, so some regions or conflicts may be underrepresented. |
| Identifies key stakeholders, including companies, governments, NGOs, and community groups. | Case studies vary in depth and may not be updated regularly. |
| Links to academic, NGO, media, and official reference material. | Some information is based on secondary reporting and should be verified using primary sources. |
| Supports filtering by conflict type, commodity, environmental impact, and location. | Not all referenced links remain active over time. |
### Summary
EJAtlas sits in the research, contextualisation, and source discovery stages of the OSINT workflow, particularly valuable for identifying stakeholders, locating supporting documentation, and generating investigative leads. As always, findings should be corroborated using primary documents, official records, court filings, satellite imagery, or direct reporting where possible.
### Ownership
EJAtlas is a collaborative academic and activist project founded and directed by Joan Martínez-Alier and Leah Temper, and coordinated by Daniela Del Ben.
### Ethical Considerations
* Recognise that many case studies concern vulnerable or marginalised communities.
* Verify significant claims using primary sources before publication.
* Consider potential biases or differing perspectives reflected in contributed case studies.
* Avoid presenting documented allegations as established facts without corroboration.
* Respect the privacy and safety of individuals and communities involved in ongoing disputes.
### Related Tools:
* [Global Forest Watch](/osint-tools/global-forest-watch)
* Climate TRACE
* Resource Watch
* ACLED
* [Cites Trade Database](/osint-tools/cites-trade-database)
#### Sources
### How to Use: **1. Browse existing investigations by exploring live maps or create a new investigation relating to an image, video, or reported event requiring verification.**
**2. Click on the icons to open up incidents and follow sources, analyse available visual clues, then compare them against mapping and satellite imagery tools.**
**3. If contributing to analysis, record the evidence, proposed location, supporting sources, and confidence level so other researchers can review and validate the findings.** ### Cost * [x] Free * [ ] Partially Free * [ ] Paid ## Data Processing ### Account Required: * [x] Yes * [x] No No account is required to view public investigations but an account may be required to contribute to investigations or submit analysis. ### Cookies: Minimal/standard web cookies. None used during our session on 27 July 2026. ### Use in Reporting Examples of reporting uses: * **Conflict mapping:** Verified locations can support the creation of timelines and maps showing the progression of military operations or humanitarian events. * **Conflict verification:** Researchers have used Geoconfirmed investigations to geolocate battlefield footage, destroyed equipment, and military activity by matching visual evidence with satellite imagery and geographic features. * **Verification of breaking news footage:** The platform can help determine whether videos circulating online are from the claimed location or are old footage being reused in a new context. * **Collaborative investigations:** Journalists and researchers can use Geoconfirmed alongside tools such as Google Earth, Sentinel Hub, and Mapillary to build evidence-based geolocation reports. | **Capabilities** | **Limitations** | | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------- | | Supports collaborative geolocation investigations. | Relies heavily on available visual clues; some content cannot be confidently geolocated. | | Helps verify images and videos through geographic analysis. | Quality depends on the skills and experience of contributors. | | Allows researchers to document evidence and reasoning. | Crowdsourced investigations require independent review and verification. | | Provides a transparent record of investigation methodology. | Doesn’t provide guaranteed attribution of who created or uploaded content. | | Supports conflict monitoring and visual verification workflows. | Primarily supports location verification rather than full intelligence analysis. | |
**2. Enable relevant infrastructure layers (Power, Telecoms, Pipelines, Rail, Renewables, etc.) and inspect nearby assets.**
**3. Cross-reference mapped infrastructure with satellite imagery, OpenStreetMap, government datasets, company information, or news reporting to verify findings and build investigative context.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
Minimal functional cookies / none used during our site session on 28 July 2026.
### Use in Reporting
Open Infrastructure Map can support reporting by:
* Providing visual evidence of infrastructure surrounding an incident or location.
* Identifying power stations, substations, transmission lines and other critical assets relevant to investigations.
* Mapping telecommunications infrastructure and submarine cable routes to assess connectivity.
* Supporting geolocation by comparing mapped infrastructure against satellite imagery and photographs.
* Demonstrating relationships between infrastructure, industrial facilities and populated areas.
* Corroborating infrastructure-related claims when used alongside authoritative sources and satellite imagery.
For example, [analysts investigating attacks on energy infrastructure in Ukraine](https://www.info-res.org/eyes-on-russia/articles/the-war-in-maps-open-source-data-reveals-scale-of-damage-to-ukraines-infrastructure/) have used OpenStreetMap-derived infrastructure layers together with satellite imagery to identify substations and transmission networks.
| **Capabilities** | **Limitations** |
| ---------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------- |
| Visualises multiple critical infrastructure datasets on a single interactive map. | Coverage depends entirely on OpenStreetMap contributor data and may be incomplete. |
| Displays electricity transmission lines, substations, power plants, and renewable energy assets, as well as oil and gas pipelines. | Infrastructure accuracy varies significantly between countries and regions. |
| Maps telecommunications infrastructure, fibre networks, and submarine cables. | Does not provide historical imagery or change detection. |
| Supports rapid geospatial orientation and infrastructure reconnaissance. | Cannot verify operational status or ownership of infrastructure. |
| Integrates seamlessly with OpenStreetMap data making it useful alongside other OSINT mapping tools. | 
**2. Review the archived content and corroborate findings with live Reddit pages, internet archives and additional OSINT sources before reporting.**
Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
Minimal functional cookies / none used during our site session on 28 July 2026.
### Use in Reporting
Arctic Shift can support reporting by:
* Recovering historical Reddit discussions that may no longer appear in Reddit search.
* Identifying deleted or removed posts and comments preserved within archived datasets.
* Building timelines of user activity and online discussions.
* Analysing the spread of narratives, misinformation or emerging trends across Reddit communities.
* Identifying links between usernames, communities and recurring topics.
* Providing evidence of historical online discourse when corroborated with additional sources.
* Supporting attribution and contextual analysis during investigations involving social media activity.
Researchers investigating online extremism, cryptocurrency scams and coordinated influence campaigns frequently use Reddit archives alongside platforms such as the Internet Archive.
| Capabilities | Limitations |
| Searches archived Reddit posts, comments, users, and subreddits with advanced filtering. | Coverage depends on available archived Reddit datasets and may not always be complete. |
| Finds historical discussions that Reddit’s native search often misses. | Recently created content may not yet be archived/indexed. |
| Locates much deleted or removed Reddit content preserved in archives. | Deleted content may lack important context or associated media. |
| Supports searches by username, subreddit, keyword, date range and other metadata. | Some content may have been removed before archival and cannot be recovered. |
| Enables timeline analysis of user activity and community discussions. | Availability may change as Reddit policies and data access evolves. |
**2. Enable relevant datasets such as tree cover loss, fires, protected areas, mining activity, plantations or land-use layers.**
**3. Analyse changes over time and cross-reference findings with satellite imagery, government records, company information and additional OSINT sources.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
Optional account available for saving projects and analysis.
### Cookies:
The site uses essential first-party session and analytics cookies to maintain functionality, recognise returning users and support platform performance.
### Use in Reporting
Global Forest Watch can support reporting by:
* Providing satellite-derived evidence of forest loss and land-use change.
* Supporting investigations into illegal logging, mining expansion and agricultural development.
* Tracking environmental impacts linked to companies, governments and supply chains.
* Comparing forest conditions across different time periods.
* Providing geographic context for climate, conservation and environmental stories.
* Supporting verification of claims made by organisations regarding sustainability commitments.
* Creating maps and visual evidence for investigative reports and publications.
| Capabilities | Limitations |
| Provides global forest monitoring using satellite imagery and geospatial datasets. | Satellite-derived data may contain uncertainty and require interpretation. |
| Tracks tree cover loss, forest gain, fires and land-use changes over time. | Doesn’t always provide immediate confirmation of the cause of forest loss. |
| Allows users to analyse specific locations, countries, or areas of interest. | Resolution may not be sufficient for small-scale changes or individual activities. |
| Combines environmental datasets including protected areas, mining, agriculture and infrastructure. | Historical coverage and accuracy vary depending on location and dataset. |
| Supports visualisation and export of maps and data for reporting. | Requires additional sources to attribute responsibility for environmental damage. |
| Helps identify potential environmental changes requiring further investigation. |
**2. Review the matched breach names, dates, verification state, and affected data classes. Cross-check relevance before reporting or taking action.**
**3. Create an account only when saved monitoring, risk reports, or alerts are needed as in the below:**
**Note:** For an approved enterprise integration, create an API key and follow the REST and signed-webhook documentation at ### Cost * [ ] Free * [x] Partially Free * [ ] Paid One guest search per day and a continuing free plan. Paid monitoring and enterprise integrations are available. ## Data Processing ### Account Required: * [x] Yes * [x] No No for one guest search per day. Yes for saved monitoring, alerts, and integrations. ### Cookies: The site uses essential session cookies (session-id) and functional preference cookies (ld\_locale). The site also sets several Google cookies (HSID, SID, SAPISID, SSID, NID) associated with Google services such as authentication, security, user preferences and potentially reCAPTCHA or embedded Google content (if logged into a Google account or Google resources are loaded). ### Use in Reporting Typical reporting applications include: * Identifying whether a target email address has appeared in historic breaches. * Demonstrating organisational exposure following credential leaks. * Linking multiple online aliases through shared breach records. * Identifying historical passwords that may explain account compromise or password reuse. * Supporting cyber threat intelligence and incident response investigations. * Corroborating identity assessments alongside sources such as Have I Been Pwned, WHOIS records, social media, company disclosures and other OSINT datasets. **Note:** Findings should be redacted or minimized and should not be treated as proof that a current password works. The product provides risk reports for registered users, but no independent public case study is claimed here. Documentation:
**2. Access the appropriate linked tool (e.g. we selected Companies house under Business Registry), conduct your investigation and corroborate findings using multiple independent OSINT sources where possible.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses Yandex Metrica cookies for website analytics and performance monitoring. Functional cookies (is\_gdpr, is\_gdpr\_b) manage GDPR and consent preferences, while analytics cookies (pi, yandexuid, yashr, ymex, yuidss) anonymously measure visitor numbers, sessions, navigation and website performance.
### Use in Reporting
OSINT Tools Map is not itself an evidence source. Instead, it supports investigations by helping analysts identify suitable tools and diversify their collection methods.
Typical reporting applications include:
* Documenting investigative methodology and tool selection.
* Identifying alternative sources to corroborate evidence.
* Expanding investigations into additional data types.
* Supporting analyst training and OSINT capability development.
* Building structured investigative workflows.
* Discovering new specialist tools for emerging intelligence requirements.
| **Capabilities** | **Limitations** |
| ---------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Categorises hundreds of OSINT tools by investigative function. | Doesn’t perform investigations or collect intelligence itself. |
| Interactive interface makes tools easier to discover. | Tool availability depends on external websites remaining operational. |
| Frequently updated to include new resources and remove obsolete ones. | Quality and reliability vary between linked tools. |
| Supports analysts in selecting appropriate tools for specific intelligence requirements. | Some linked resources require payment or account registration. |
| Useful as both a learning resource and operational reference. | Findings obtained through linked tools must be independently verified before reporting. |
### Summary
OSINT Tools Map is a comprehensive directory of OSINT resources rather than an investigative platform in its own right, best used during the planning and collection stages of the OSINT workflow, where analysts are selecting the most appropriate tools for an investigation. It also supports ongoing enquiries by helping investigators discover alternative resources for corroboration, making it a great reference for both operational analysts and OSINT training.
### Ownership
Created and maintained by CybDetective which is owned and operated by an independent OSINT researcher who goes by the online alias [cipher387.](https://github.com/cipher387)
### Ethical Considerations
* Respect the terms of service of third-party websites.
* Verify information using multiple independent sources before drawing conclusions.
* Consider privacy implications when collecting personal information.
* Document investigative methodology to support transparency and reproducibility.
* Regularly review linked tools for reliability, security and continued availability.
### Related Tools:
* OSINT Framework
* Bellingcat OSINT Toolkit
* [Hippie OSINT Toolkit](/osint-tools/hippie-osint-toolkit)
#### Sources
| BoardReader | Quick Overview |
| URL | https://boardreader.com/ |
| What it does | Searches online forums, discussion boards and community websites to locate posts, conversations and user-generated content across a wide range of topics. |
| How to use it | Enter keywords, usernames or phrases, review matching discussions, refine results using filters, and corroborate findings with other OSINT sources. |
| Cost | Free. |
| Account required | No. |
| Cookies | Google Analytics Cookies. |
| Ownership | Owned and operated by Effyis, Inc based in Troy, Michigan, US. |
| Use in Reporting | Can identify forum discussions, usernames and historical online conversations that can provide contextual intelligence. |
**2. Review forum discussions, user profiles and historical posts, refining results where necessary.**
**3. Validate any findings using additional OSINT sources before incorporating them into reporting.**
\\
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses Google Analytics cookies (ga, \_ga\_PV1FRP43SD, \_gid) to collect anonymous visitor statistics, track sessions and measure website performance and usage patterns.
### Use in Reporting
BoardReader is useful for:
* Identifying historical discussions relating to an individual or organisation.
* Supporting attribution through forum usernames and aliases.
* Assessing public sentiment or community reactions.
* Locating technical discussions relevant to cyber investigations.
* Discovering additional identifiers for investigative pivoting.
* Corroborating information using multiple independent OSINT sources.
Example operational use cases:
* Threat intelligence reports identifying forum discussions linked to cyber activity.
* Brand or reputation monitoring using community discussions.
* Attribution reports linking usernames across multiple forums.
* Background research supporting investigations into fraud or extremist narratives.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------------ | ------------------------------------------------------------------- |
| Searches thousands of online forums and message boards. | Coverage depends on which forums are indexed. |
| Finds historical discussions often missed by traditional search engines. | Some forums restrict indexing or require login access. |
| Supports keyword, phrase, and username searches. | Search results may contain outdated or deleted discussions. |
| Useful for discovering aliases and online identities. | User-generated content may be inaccurate, biased, or misleading. |
| Provides additional context through community discussions. | Limited advanced filtering compared with mainstream search engines. |
### Summary
BoardReader is best used during the collection and enrichment stages of the OSINT workflow, when you’re gathering publicly available information and identifying additional leads for corroboration.
**Note:** As forum content is user-generated, findings should always be validated against independent sources before being relied upon in intelligence reporting.
### Ownership
Owned and operated by the private data collection and internet company Effyis, Inc based in Troy, Michigan, US.
### Ethical Considerations
* Respect forum terms of service and community rules.
* Consider the context and date of historical discussions.
* Avoid publishing personal information unless operationally justified.
* Corroborate findings using multiple independent sources.
* Be mindful that forum posts may represent opinion rather than verified fact.
### Related Tools:
* [Social Searcher](/osint-tools/social-searcher)
* Reddit Search
* Google advanced search
* 4search
* Yandex
#### Sources
**2. Start the capture process, then review and manage the preserved evidence including timestamps, metadata, and cryptographic verification.**
**3. Download, share, or reference the proof within reports, investigations, or case files to demonstrate the authenticity of the captured content.**
### Cost
* [ ] Free
* [ ] Partially Free
* [x] Paid
Subscription plans are available, and Assisted Capture can be purchased separately for individual URLs.
**Note:** You can sign up for a free 7-day trial on the professional plan.
## Data Processing
### Account Required:
* [x] Yes
* [x] No
Yes, for creating and managing captures. Public proof verification does not require an account.
### Cookies:
Minimal/the site may use essential cookies required for security, authentication, and core platform functionality. We only noted a couple of Google Analytics cookies during our session on 18 July 2026.
### Use in Reporting
GetProofAnchor can be used to preserve online sources referenced in OSINT reports, investigative findings, legal documentation, reputation investigations, and research. A Proof ID can be referenced alongside a finding so that the integrity of the preserved evidence can later be checked. The exported Evidence ZIP provides supporting files, metadata, hashes, and timestamp information that can be retained with the investigation case file.
**Potential reporting uses include:**
* Preserving social media posts before deletion or editing.
* Documenting public statements made by individuals or organisations.
* Preserving webpages used as sources in investigative reporting.
* Recording scam, impersonation, or fraudulent websites.
* Documenting counterfeit listings or intellectual property infringement.
* Preserving defamatory or threatening online content.
* Supporting chronology and timeline reconstruction.
* Retaining online evidence before submitting a platform report or takedown request.
* Providing independently verifiable integrity information alongside an OSINT report.
**Note:** The tool does not determine whether content is true, lawful, or admissible in a specific jurisdiction. Analysts remain responsible for interpretation, source evaluation, and appropriate reporting methodology.
| Capabilities | Limitations |
| Creates cryptographically verifiable captures of webpages. | Does not discover or search for OSINT data. It only preserves content already identified. |
| Produces trusted timestamps for online content. | Cannot capture content that requires inaccessible authentication or permissions. |
| Preserves evidence even if the original webpage changes or is deleted later. | Dynamic/highly interactive webpages may not always render perfectly. |
| Captures supporting metadata alongside webpage content. | Long-term storage and advanced features require a paid subscription. |
| Enables sharing and exporting of verified evidence records. | Verification is limited to what was visible and accessible at the time of capture. |
| OFAC Sanctions List Search | Quick Overview |
| URL | https://sanctionssearch.ofac.treas.gov/ |
| What it does | Searches official U.S. sanctions lists for sanctioned individuals, organisations, entities, vessels and aircraft. |
| How to use it | Enter a name or keyword, review matching records, then verify identifiers such as aliases, dates of birth, addresses and sanctions programmes. |
| Cost | Free. |
| Account required | No. |
| Cookies | Essential session cookies. |
| Ownership | U.S. Department of the Treasury – Office of Foreign Assets Control (OFAC). |
| Use in Reporting | Supports sanctions screening, due diligence, subject profiling and compliance checks. |
**2. Review returned matches carefully. Compare identifiers such as aliases, dates of birth, addresses, nationality, vessel IMO numbers or company details to determine whether the record relates to your subject.**
**3. Record relevant findings and cross-reference them with other official sources such as Companies House, corporate registries, government sanctions lists or adverse media before drawing conclusions.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses essential session cookies, including ASP.NET\_SessionId (session management) and F5 BIG-IP load balancing cookies (server session persistence).
### Use in Reporting
OFAC sanctions data is highly authoritative and suitable for inclusion within intelligence products, due diligence reports and compliance assessments. Its uses include:
* Confirming whether an individual, company, vessel or aircraft is subject to U.S. sanctions.
* Supporting AML/KYC, financial crime and corporate intelligence reporting.
* Providing authoritative evidence for sanctions screening and compliance assessments.
* Enabling verification of aliases, addresses, dates of birth and other identifying information to reduce false positives.
* Identifying sanctions programmes associated with a subject and assessing potential geopolitical or regulatory risk.
Investigative organisations such as the [International Consortium of Investigative Journalists ](https://www.icij.org/investigations/cyprus-confidential/spyware-firm-intellexa-hit-with-us-sanctions-after-cyprus-confidential-expose/)(ICIJ) and [OCCRP ](https://www.occrp.org/en/news/us-sanctions-chinese-oil-terminal-operator-tied-to-iranian-sanctions-evasion-scheme)frequently reference OFAC sanctions when reporting on sanctioned individuals, oligarchs, state-owned enterprises and illicit financial networks. Major news organisations including Reuters, Bloomberg and the Financial Times also rely on OFAC designations when covering sanctions enforcement and international finance.
| **Capabilities** | **Limitations** |
| ---------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| Searches individuals, companies, vessels, and aircraft. | Covers only U.S. sanctions and does not include all international sanctions regimes. |
| Includes aliases, identifiers, and sanctions programme details. | Name-only searches can produce multiple/ambiguous results that require careful verification. |
| No account or subscription required. | Limited contextual information beyond designation details. |
| Useful for sanctions screening and due diligence investigations. | Doesn’t provide investigative background or evidence supporting the designation. |
| Frequently updated to reflect new designations and removals. | Historical/delisted records may require consultation of additional sources. |
### Summary
OFAC Sanctions List search is best used during the verification and risk assessment stage of an OSINT investigation, after a subject has been identified but before reporting or due diligence is finalised. It should also be used alongside other sanctions databases (e.g. UK, EU or UN) for comprehensive screening.
### Ownership
Owned by the Office of Foreign Assets Control (OFAC), U.S. Department of the Treasury.
### Ethical Considerations
* Verify subject identifiers before reporting a sanctions match.
* Avoid relying solely on name-based matches.
* Clearly distinguish confirmed sanctions listings from possible matches.
* Consider the legal and reputational impact of reporting sanctions information.
* Cross-reference with other official sanctions lists where appropriate.
### Related Tools:
* UK Sanctions List Search
* [EU Sanctions Map](/osint-tools/eu-sanctions-map)
* UN Security Council Sanctions List
* [OpenSanctions](/osint-tools/open-sanctions)
* [Companies House](/osint-tools/companies-house)
* [OpenCorporates](/osint-tools/opencorporates)
#### Sources
**2. Review the similarity report, examine highlighted matches, follow linked sources where available, and independently verify any findings before reporting.** 
### Cost
* [ ] Free
* [ ] Partially Free
* [x] Paid
Paid with limited free trial/demo options (5 free credits).
## Data Processing
### Account Required:
* [x] Yes
* [ ] No
### Cookies:
The site uses essential, functional, analytics and advertising cookies, including CookieYes (consent management), Mixpanel (usage analytics), Google Ads (\_gcl\_au) and Microsoft Clarity (analytics)
### Use in Reporting
Copyleaks is useful during:
* Plagiarism and copyright infringement investigations.
* Misinformation and disinformation analysis by tracing reused or republished content.
* Content provenance investigations to identify potential original publishers or earliest known sources.
* Academic misconduct and research integrity investigations.
* Brand protection and intellectual property investigations, including unauthorised reuse of published material.
* AI-generated content assessments to support investigations involving synthetic or machine-generated text.
**Note:** Similarity scores should be treated as indicators rather than definitive evidence and should always be supported by manual review of matched sources.
| Capabilities | Limitations |
| Detects copied and substantially similar text. | Does not prove authorship or intent. |
| Identifies paraphrased content across multiple sources. | AI detection results are probabilistic and may produce false positives or negatives. |
| Flags likely AI-generated writing. | Cannot identify content that has never been publicly indexed or included in its datasets. |
| Links to matching webpages and publications where available. | Similarity scores require human interpretation and contextual analysis. |
| Produces detailed similarity reports with highlighted passages. | Full functionality requires a paid subscription. |
| Supports document uploads, text input, and API integration. | |
**You can view a timeline of events as well as public comments as in the below:**
**2. Make sure to corroborate findings with additional threat intelligence sources before incorporating them into reporting or incident response.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
(With optional commercial integrations and enterprise services.)
## Data Processing
### Account Required:
* [x] Yes
* [x] No
No (basic searches). Account required for additional features and integrations.
### Cookies:
The site uses essential, functional and analytics cookies, including IBM consent and session cookies, Tealium analytics (utag\_main), and preference cookies to store language, region and privacy settings.
### Use in Reporting
IBM X-Force Exchange is useful for:
* Cyber incident investigations.
* IOC (Indicator of Compromise) validation and enrichment.
* Malware and ransomware investigations.
* Infrastructure attribution and network analysis.
* Threat actor and campaign profiling.
* Vulnerability and exposure assessments.
You can view IBM-published threat analysis reports [here. ](https://exchange.xforce.ibmcloud.com/report/list?type=ThreatAnalysis)
| Capabilities | Limitations |
| Searches IP addresses, domains, URLs, file hashes, and CVEs. | Focused exclusively on cybersecurity rather than general OSINT. |
| Provides reputation scores and risk assessments for indicators. | Reputation data may not reflect real-time changes immediately. |
| Links related malware, infrastructure, and threat activity. | Some intelligence is only available to authenticated or enterprise users. |
| Supports STIX/TAXII threat intelligence sharing. | Attribution of threat actors remains analytical rather than definitive. |
| Includes historical observations via a timeline and contextual threat data. | Coverage depends on available intelligence feeds and reporting. |
| Integrates IBM-X Force research with multiple intelligence sources. |
**2. Review reported scams, associated indicators and supporting information.**
**3. Corroborate findings with additional OSINT sources before including them in investigative reporting.**
**Note:** There is also an AI Scam Checker tool within the platform:
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
(Although an account is required to submit reports).
### Cookies:
The site uses Google Analytics cookies to monitor website traffic and user engagement.
### Use in Reporting
ScamDB is often used in:
* Online fraud investigations.
* Scam website verification.
* Cryptocurrency fraud investigations.
* Business email compromise (BEC) enquiries.
* Romance, investment and impersonation scam investigations.
* Digital due diligence and victim reporting.
**Note:** The platform is primarily used as a community-contributed reference resource and should be treated as a lead-generation tool rather than an evidential source.
| **Capabilities** | **Limitations** |
| ------------------------------------------------------------------- | ------------------------------------------------------------------ |
| Searches websites, domains, and URLS linked to scams. | Relies heavily on user-submitted information. |
| Looks up email addresses and telephone numbers. | Reports may be incomplete, outdated, or unverified. |
| Searches cryptocurrency wallet addresses associated with fraud. | Limited coverage compared to larger threat intelligence platforms. |
| Aggregates community-submitted scam reports. | Absence of an entry does not indicate legitimacy. |
| AI scam checker identifies recurring fraud patterns and indicators. | Does not independently verify every submitted report. |
| Provides supporting context for scam-related investigations. | 
**2. View its current position, orbital path, ground track and predicted passes over a location. E.g. we chose CHINASAT 5:**
**3. Compare satellite timing with imagery, events or other OSINT sources to support analysis.**
### Cost
* [x] Free
* [ ] Partially Free
* [ ] Paid
Free with optional premium subscription.
## Data Processing
### Account Required:
* [ ] Yes
* [x] No
### Cookies:
The site uses essential, consent, advertising and payment security cookies (PHP Session, Google Funding Choices, DoubleClick and PayPal).
**Note:** Be mindful of third-party adverts/pop-ups which are rife on the website.
### Use in Reporting
N2YO Satellite Tracker is useful for:
* Satellite imagery verification.
* Conflict and military activity investigations.
* Environmental and disaster monitoring.
* Maritime and aviation investigations.
* Geolocation and chronolocation analysis.
* Space and aerospace reporting.
The platform is often used and [referenced](https://isprs-annals.copernicus.org/articles/IV-5/109/2018/) in technical research, satellite tracking projects, and open-source space analysis as a satellite position and pass prediction tool.
**Note:** It is primarily used as a supporting source in geospatial investigations, space monitoring, and satellite imagery verification rather than as standalone evidence.
| Capabilities | Limitations |
| Tracks thousands of active satellites in real-time. | Doesn’t provide satellite imagery. |
| Displays orbital paths and ground tracks. | Accuracy depends on the quality and age of available TLE data. |
| Predicts future satellite passes over selected locations. | Some classified or military satellites may have limited/unavailable information. |
| Searches satellites by name, category, or NORAD ID. | Orbital predictions become less accurate over longer time periods without updated elements. |
| Visualises satellite positions on interactive maps. | Primarily designed for tracking rather than intelligence analysis. |
| Supports historical and current orbital analysis using publicly available TLE data. |