Start with a question, not a tool.
Open-source intelligence is the careful collection and analysis of information legally available to the public. Choose the research task below, record where each result came from, and verify important findings with more than one source.
Public does not mean permissionless
Use these resources only for lawful research. Do not bypass access controls, test systems without authorization, upload confidential material, harass people, or publish personal information. A tool result is a lead—not automatic proof.
A repeatable research method
- 1Define the questionWrite down exactly what you are trying to confirm.
- 2Collect carefullySave the URL, date, source, and relevant context.
- 3CorroborateUse an independent second source for important conclusions.
- 4Report uncertaintySeparate confirmed facts, likely inferences, and unresolved questions.
Breach & identity exposure
Check whether contact details or passwords have appeared in known breach data.
Have I Been Pwned
Check whether an email address appears in a known breach.
KEEP IN MIND: A match confirms exposure, not current account access.Pwned Passwords
Check whether a password has appeared in breach data.
KEEP IN MIND: Use this password-specific page; never place a password into an email-search tool.Domains, IP addresses & infrastructure
Identify registration, DNS, certificates, exposed services, and reputation signals.
ICANN Lookup
Review public domain-registration information.
KEEP IN MIND: Privacy services may hide registrant details.crt.sh
Search public certificate-transparency records for domains and subdomains.
KEEP IN MIND: A certificate record does not prove a host is currently active.DNSDumpster
Explore DNS records and related domain infrastructure.
KEEP IN MIND: Confirm findings with another source before drawing conclusions.Shodan
Find internet-connected devices and services visible in Shodan’s index.
KEEP IN MIND: Search only; do not attempt unauthorized access or testing.AbuseIPDB
Review community reports associated with an IP address.
KEEP IN MIND: Reports are signals, not proof of who controlled an address.Files, links & malware
Check suspicious indicators without opening or executing them.
VirusTotal
Review detections and relationships for a file hash, URL, domain, or IP.
KEEP IN MIND: Do not upload private, confidential, client, or case files.URLhaus
Research URLs associated with malware distribution.
KEEP IN MIND: Absence from a feed does not prove a URL is safe.ThreatFox
Search indicators connected to malware and threat campaigns.
KEEP IN MIND: Treat attribution and older indicators with appropriate caution.Joe Sandbox Cloud
Analyze suspicious files and URLs in a controlled sandbox.
KEEP IN MIND: Public submissions may become visible; never submit sensitive material.Vulnerabilities & attacker behavior
Understand known weaknesses, active exploitation, and documented attacker techniques.
CISA Known Exploited Vulnerabilities
See vulnerabilities known to be exploited in the wild.
KEEP IN MIND: Use it to prioritize; it is not a complete list of every important flaw.National Vulnerability Database
Look up CVE descriptions, references, and severity information.
KEEP IN MIND: A severity score alone does not show whether your system is exposed.MITRE ATT&CK
Study documented tactics and techniques used by threat actors.
KEEP IN MIND: ATT&CK describes behavior; it does not prove attribution in a specific incident.Web history & verification
Compare older pages, confirm claims, and preserve the context around a source.
Internet Archive Wayback Machine
View archived versions of public web pages.
KEEP IN MIND: Not every page or date is archived, and captures can be incomplete.TinEye
Find pages containing the same or a closely matching image.
KEEP IN MIND: No result does not prove an image is original.Google Fact Check Explorer
Search fact checks published by participating organizations.
KEEP IN MIND: Read the underlying evidence, not only the rating.Before you act on a finding
Check the timestamp, confirm the identifier belongs to the right person or system, look for a second independent source, preserve the original context, and state what the evidence does not prove.