The array
Tools that still work.
A short shelf, not a junk drawer. Fifty-odd public sources for usernames, mail, infrastructure, pictures, maps, and records.
56 on the table
- Open
WhatsMyName
Username · FreeCommunity list of username checks, kept current by people who actually run them.
- Open
Sherlock
Username · FreeThe usual first sweep. One name, a few hundred public profile URLs.
- Open
Maigret
Username · FreeSherlock's more thorough cousin. Slower, wider, better when the easy sites are empty.
- Open
Namechk
Username · FreemiumQuick look at whether a handle is sitting on the big networks.
- Open
KnowEm
Username · FreemiumBrand and username availability across social and domain names.
- Open
Blackbird
Username · FreeFast username search with a clean report you can actually read.
- Open
Instant Username
Username · FreeBrowser sweep of the obvious networks. Good for a first pass, not a last one.
- Open
Have I Been Pwned
Email · FreemiumWhether an address showed up in a known public breach. Troy Hunt's list, not a dump site.
- Open
Hunter
Email · FreemiumThe pattern a company uses, and the addresses that follow it.
- Open
Holehe
Email · FreeAsks sites that forget to hide the 'this email is registered' response.
- Open
Epieos
Email · FreemiumPivots an address toward accounts that forgot they were public.
- Open
EmailRep
Email · FreemiumReputation sketch of an address: age, profiles, and whether it looks disposable.
- Open
Gravatar
Email · FreeThe old avatar directory. Still keyed off the MD5 of the mailbox.
- Open
Snov.io
Email · FreemiumDomain search and address finder used when Hunter comes back thin.
- Open
Shodan
Domain · FreemiumWhat is actually listening on the internet, not what the homepage claims.
- Open
Censys
Domain · FreemiumHosts, certificates, and services, indexed like a census.
- Open
VirusTotal
Domain · FreemiumReputation for a domain, URL, or file hash, from a pile of scanners.
- Open
crt.sh
Domain · FreeCertificate transparency. Subdomains people issued a cert for and then forgot.
- Open
urlscan.io
Domain · FreemiumOpens a page in a sandbox and shows you what it called, loaded, and redirected.
- Open
DNSDumpster
Domain · FreeA map of DNS records and the hosts hanging off a domain.
- Open
SecurityTrails
Domain · FreemiumCurrent and historical DNS. Useful when the site moved and left the old address behind.
- Open
BuiltWith
Domain · FreemiumThe stack a site is running: analytics, CMS, tag managers, the quiet third parties.
- Open
Netlas
Domain · FreemiumSearch engine for internet-facing assets, responses, and certificates.
- Open
GreyNoise
Domain · FreemiumIs this IP scanning the whole internet, or is it actually interested in you?
- Open
OWASP Amass
Domain · FreeThe heavy subdomain mapper. Slow on purpose.
- Open
theHarvester
Domain · FreePulls emails, names, and hosts from public sources for one domain.
- Open
Whois
Domain · FreeRegistration record. Often a privacy proxy. Sometimes a real name and a phone.
- Open
ViewDNS
Domain · FreeA drawer of small lookups: reverse IP, DNS history, port checks.
- Open
Google Lens
Image · FreeBest first reverse-image search. Finds the page the picture was cropped from.
- Open
TinEye
Image · FreemiumOldest match, not the cleverest. Good when you need the earliest copy.
- Open
Yandex Images
Image · FreeOften beats Google on faces, places, and pictures from outside the US web.
- Open
Bing Visual Search
Image · FreeA third opinion. Sometimes the only one that names the place.
- Open
FotoForensics
Image · FreeError-level analysis. Shows where a JPEG was resaved, edited, or spliced.
- Open
ExifTool
Image · FreeThe full metadata reader. This desk does the common tags; ExifTool does the rest.
- Open
Google Earth
Maps · FreeTerrain, 3D buildings, and historical imagery when the street view is too new.
- Open
SunCalc
Maps · FreeWhere the sun was. Use shadows in a photo to test a claimed time.
- Open
EO Browser
Maps · FreeSentinel satellite imagery. Fresh enough to check whether a site changed.
- Open
OpenStreetMap
Maps · FreeThe map volunteers drew. Often has the alley Google still calls unnamed.
- Open
Wikimapia
Maps · FreeLabeled outlines of buildings, lots, and places that never got a Wikipedia page.
- Open
Flightradar24
Maps · FreemiumLive and recent flights. Tail numbers, routes, and who was overhead.
- Open
ADS-B Exchange
Maps · FreeThe unfiltered flight feed. Includes aircraft the commercial apps hide.
- Open
MarineTraffic
Maps · FreemiumShips, by AIS. Name a vessel or watch a port.
- Open
Reddit search
Social · FreeOld posts survive here longer than people expect. Search the handle, then the phrase.
- Open
X advanced search
Social · FreeFrom, to, since, until. The only way the firehose is usable.
- Open
Social Searcher
Social · FreemiumA cross-network look at a name or phrase, without opening twelve tabs first.
- Open
Wayback Machine
Archive · FreeWhat the page used to say, before someone edited the biography.
- Open
archive.today
Archive · FreeA snapshot you take yourself. Works on pages the Wayback Machine misses.
- Open
OpenCorporates
Records · FreemiumCompany registers from a lot of countries, in one search box.
- Open
OCCRP Aleph
Records · FreeLeaks, gazettes, and corporate records, indexed for cross-border work.
- Open
ICIJ Offshore Leaks
Records · FreePanama, Paradise, Pandora. Officers, intermediaries, and the companies between them.
- Open
OpenSanctions
Records · FreeSanctions, politically exposed people, and wanted lists, in one dataset.
- Open
CourtListener
Records · FreeUS opinions, dockets, and oral arguments that are actually public.
- Open
SEC EDGAR
Records · FreeUS public-company filings. The footnotes are where the names hide.
- Open
Companies House
Records · FreeUK companies, officers, and filing history. Unusually open.
- Open
LittleSis
Records · FreeWho sits on whose board. A map of influence, sourced.
- Open
DocumentCloud
Records · FreePrimary documents journalists already OCR'd. Search the PDF, not the article.
Public sources only. Lawful research. Don't use this to harass anyone.