OSINT tools for each job, and one that keeps watch afterwards

The right OSINT tools depend on the job: a search engine to find things, an archive for the past, lookup sites for domains, and a monitor for whatever changes next. AyeWatch covers that last step by watching public pages, topics and social accounts and sending a short summary when something new appears, while free tools handle the one-off lookups.

What OSINT tools are for

OSINT, short for open-source intelligence, is the work of collecting and analyzing information that anyone can access: news, public filings, company websites, public social posts, domain records and archived pages. No single product covers all of it. Most investigators run a small stack with one tool per question, plus something that keeps checking after the first pass is done.

The stack, job by job

Monitoring: AyeWatch

Most OSINT tools answer a question once. The part that eats time is asking it again next week. AyeWatch is built for that repeat work. You describe a subject in plain English, paste a URL, or pick a public source such as an X profile, a subreddit or a YouTube channel. It checks on a schedule, with an Auto mode that speeds up while a topic is busy and slows down when it goes quiet, and alerts you with a summary and links back to the sources. Following a public X account needs no X login.

AyeWatch's guide to a one-person OSINT desk suggests separate monitors for a target's news and filings, a key person's public statements, a company's new job postings in one department, and patent news. Alerts land in the feed and as push notifications on every plan; paid plans add email, Slack, Discord, webhooks and an API. Its glossary says it watches the surface web, so treat it as a public web monitor, not a dark web tool.

Search and archives

Google's operators narrow a search fast: quotes for an exact phrase, site: for one domain, a minus sign to drop a word, filetype: for PDFs or spreadsheets, and before: or after: for dates. The Internet Archive's Wayback Machine shows earlier captures of a URL and lets you save a page yourself, which matters when a page might be edited or taken down.

Domains, infrastructure and images

ICANN Lookup returns the current registration data for a domain name. crt.sh searches Certificate Transparency logs, and the certificate list can reveal subdomains a company never linked from its site. Shodan is a search engine for devices and services connected to the internet; security teams use it to check what their own networks expose. TinEye finds exact and edited copies of an image, which helps trace where a photo first appeared. It does not do facial recognition.

Analysis and automation

When findings pile up, Maltego's graph view links organizations, domains, accounts and people so you can see the connections. SpiderFoot, a free open source program, automates many lookups against one target in a single scan.

Stay on public sources

OSINT works only with public information. Respect each site's terms and your local law, keep the focus on organizations, topics and your own exposure, and do not use any of these tools to track private individuals.

Where to start

Run the free lookups for the first pass, then put the subjects you need to follow into a monitor that alerts you. If you only need a single answer today, a search operator or an archive capture may be all it takes, and a monitor would be overkill.