OSINT Investigation Suite
Six free OSINT tools: domain footprint, stealer logs, timelines, ATT&CK, IOCs, shadows.
The six tools
| Tool | What it finds | Data | Sources |
|---|---|---|---|
| Step 1Exposure Graph | Subdomains from certificate logs and passive DNS, which of them are live, dangling CNAMEs, hosting, mail posture (SPF, DMARC, MTA-STS), DNSSEC and registration dates. | Public lookups | dns.google, crt.sh, Cert Spotter, HackerTarget, ipwho.is, RDAP |
| Step 2Stealer Exposure Check | Infected staff and customer machines that held logins for a domain, which login pages were hit, stealer families and a cleanup playbook. Compare two domains side by side. | Public lookups | Hudson Rock Cavalier, counts only, through a pwnsy proxy |
| Step 3Breach Timeline Builder | Dated notes become a sorted timeline with severity, observables shared between events, the largest gap and CSV or JSON export. | Stays in browser | Parses 2026-08-13, 13 Aug 2026, Aug 13, 2026, 13/08/2026 and more |
| Step 4ATT&CK Evidence Mapper | Incident notes and log lines become MITRE ATT&CK techniques with the matched phrases shown, a tactic heatmap, extracted indicators and a Navigator layer. | Stays in browser | Local phrase rules on MITRE ATT&CK Enterprise IDs |
| PhotosShadow Locator | Measure a shadow on a photo, then map every place where the sun matched at the capture time, work out the time of day at a known place, or get the longitude from a satellite dish. | Stays in browser | NOAA solar position algorithm, ported from geo-sleuth (MIT) |
| IndicatorsIOC Enrichment | A list of IPs, domains, URLs, CVEs, npm or PyPI packages and hashes gets one verdict each, with evidence lines, pivot links and Markdown or CSV for the ticket. | Public lookups | RDAP, DNS over HTTPS, Tor Onionoo, OSV, CISA KEV, EPSS, CVE.org |
Only the domain is used. An email is cut down to the part after the @.
How the suite works and FAQBackground readingOSINT reconInfostealersMITRE ATT&CK
How the suite works
The launcher trims a URL or email to its domain and opens the tool you pick with it in the address. Exposure Graph and IOC Enrichment query public sources from your browser; the stealer check goes through a pwnsy proxy (six-hour cache).
Timeline, ATT&CK Mapper and Shadow Locator run in the page; only map tiles come from OpenStreetMap.
How to read the results
Each tool opens with a green, amber or red headline card. Check red first, and confirm each item from the evidence it shows before you report it.
OSINT suite FAQ
Do these OSINT tools need an account or API key?
No. All six are free with no sign-in.
Which tools send data off my device?
Exposure Graph sends the domain to public DNS, CT, passive DNS, RDAP and IP lookups; the stealer check sends it to pwnsy, which asks Hudson Rock. The Mapper and Timeline send nothing.
Can I check an email address?
Only its domain is kept, so the lookup is about the company. Email lookups would return data about one person.
Does a result prove a breach or name an attacker?
No. Labels and scores are triage prompts to confirm against your own logs.
Nothing here proves attribution. Each tool structures evidence for an analyst to validate.