Max Intel — Free OSINT Tools

Open Source Intelligence Suite

Max Intel provides 100+ free OSINT tools for investigators, researchers, journalists, and cybersecurity professionals. Open-source intelligence (OSINT) is defined by U.S. Public Law 109-163 as intelligence produced from publicly available information that is collected, exploited, and disseminated in a timely manner to an appropriate audience. Search people, emails, usernames, domains, IP addresses, and more — no registration or API keys required.

Last updated:

Max Intel Exclusive Tools

72 tools
🕵️ People & Identity OSINT 13 tools

Phone Number Profiler

Multi-source phone intelligence: 6 sites aggregated into one unified profile

Email Address Profiler

4-source email intelligence: breaches, reverse WHOIS, Gravatar, linked accounts

Name Intelligence

Estimate gender, nationality, and age from any first name using three demographic APIs with anomaly detection.

Ghost Finder

Hunt for deleted social media profiles via Wayback Machine archives. Extracts bios, emails, and cross-references across 32 platforms.

Gravatar History

Discover every historical Gravatar profile picture for any email via the Wayback Machine. Visual timeline with date ranges and archive links.

GitHub OSINT Profiler

Developer intelligence from GitHub API: repos, languages, orgs, emails, activity

Digital Presence Scorecard

Audit online exposure via Gravatar, Wayback Machine, HIBP breaches, and 15+ platform footprints. Generates a findability score for OSINT and privacy

Stylometry Analyzer

Compare writing samples to assess common authorship. Analyzes vocabulary, sentence structure, function words, punctuation, and 40+ stylometric features

Page OSINT Extractor

One-click bookmarklet scrapes emails, phones, social links, tech fingerprints, and hidden metadata from any webpage with archive.today integration

Reddit OSINT Suite

Bot detection, OPSEC audit, persona reconstruction, and sockpuppet correlation for Reddit accounts via bookmarklet — bypasses API limits

Reddit Domain Reputation

Scan any domain's Reddit reputation — analyze submissions across hot, new, top, and controversial sorts via bookmarklet with full analytics dashboard.

Twitter/X Analyzer

Analyze any Twitter/X account: bot scoring, engagement ratios, hashtag networks, posting cadence heatmaps

HN & Reddit Monitor

Track keyword mentions across Hacker News and Reddit with engagement scoring

🏛️ Web Archive & Digital Footprint 11 tools

Google Dork Generator

Generate advanced Google search queries (dorks) to find leaked data, exposed documents, login pages, and hidden information.

Wayback & CommonCrawl Recon

Discover forgotten endpoints, exposed configs, API keys, and shadow infrastructure from Wayback Machine and CommonCrawl archives.

WHOIS History

Scrape archived Wayback Machine pages to extract emails, phones, names, addresses, social profiles, and org details removed from live sites.

Robots.txt Historian

Diff every historical robots.txt and discover removed Disallow paths that reveal exposed infrastructure.

Sitemap Historian

Pull every historical sitemap.xml from the Wayback Machine. Diff revisions to discover which URLs appeared and vanished over time.

RSS Feed Archaeology

Reconstruct any website's complete publishing history from archived RSS and Atom feeds. Recover deleted articles, track authors, export data.

ads.txt Tracker

Track ad monetization history through archived ads.txt and sellers.json. Discover ad network relationships, publisher IDs, and cross-reference domain ownership.

Career Page Intelligence

Reconstruct hiring history from archived career pages. Track departments, tech stacks, deleted job listings, and strategic hiring signals over time.

Meta Tag Tracker

Track Open Graph, Twitter Cards, meta descriptions, and titles over time. Detect brand pivots, rebrands, and reverse-search historical OG images.

Link Rot Forensics

Extract all outbound links from archived pages, detect dead links, expired domains, and find subdomain takeover opportunities via DNS checks.

Policy Diff Engine

Track Terms of Service, Privacy Policy, and legal document changes over time with word-level semantic diffs. Detect silent arbitration clauses, data sharing expansions, and liability shifts.

🌐 Domain & Email Intelligence 7 tools

Domain Recon Dashboard

Complete attack surface mapping from 10+ APIs: subdomains, open ports, CVEs, DNS, headers, threat intel, WHOIS — one input, full recon.

DNS Deep Resolver

Multi-resolver comparison, delegation chain, passive DNS, and CT logs

CT Monitor

Discover every SSL/TLS certificate for a domain via CT logs. Uncovers subdomains, internal hostnames, wildcards, and issuer patterns.

Tech Stack Detector

Detect any website's technology stack — CMS, frameworks, CDN, analytics, and server software from HTTP headers, DNS, and Shodan CPE data.

Subdomain Takeover Scanner

Discover subdomains and detect dangling CNAME records pointing to unclaimed cloud services. Bug bounty essential.

Email Security Analyzer

Check SPF, DKIM, DMARC authentication, detect disposable domains, and score email address security

ASN Intelligence Explorer

Map BGP peering relationships, announced prefixes, routing history, and WHOIS data for any ASN from 6 APIs

🛡️ Threat Intelligence & Security 27 tools

Exposed — Security Scanner

Instant domain security audit. Checks data breaches (HIBP), open ports, email auth (SPF/DKIM/DMARC), security headers, threat intel, and exposed files. A-F grade.

CVE Intelligence Dashboard

Vulnerability lookup with EPSS exploit prediction and CISA KEV status

Threat Feed Aggregator

Check IP/domain/hash against 10+ live threat intelligence feeds

Internet Threat Dashboard

Live security overview: ISC SANS, CISA KEV, URLhaus, Feodo C2, SSLBL

IP Triage

Instant IP intelligence — geolocation, WHOIS, reverse DNS, open ports, abuse reports, threat scores, cloud detection, and ASN info from 10+ sources.

Hash Analyzer

Analyze file hashes against VirusTotal, MalwareBazaar, ThreatFox, and AlienVault OTX. Auto-detects MD5, SHA-1, SHA-256, and SHA-512.

Default Credentials Scanner

Search 3000+ default passwords for devices and software, with HIBP breach checking via k-anonymity

Attack Surface Scanner

Scan IP ranges via Shodan for open ports, enrich with ISC SANS threat data, cross-reference CISA KEV exploited CVEs

Cloud IP Identifier

Check if IP belongs to AWS, Azure, GCP, Cloudflare, Fastly, GitHub, Tor

Repo Security Auditor

Audit GitHub repos for exposed secrets, vulnerable dependencies, and misconfigured files.

Cookie & Tracker Exposer

Audit cookies, trackers, localStorage, fingerprinting, and third-party scripts on any website.

Security Header Audit

Audit CSP, HSTS, X-Frame-Options, mixed content, SRI, and cookie flags. Security grade A-F.

JS Library CVE Scanner

Detect outdated JS libraries with known CVEs — free Retire.js/Snyk alternative

DOM XSS Scanner

Find dangerous sinks and user-controllable sources in JavaScript — free Burp alternative

API Endpoint Discovery

Discover hidden API endpoints, WebSocket URLs, and hardcoded tokens in client-side JS

Form Security Auditor

Audit forms for missing CSRF tokens, insecure passwords, and hidden field leaks

Open Redirect Scanner

Find open redirect parameters in links and forms — tests 30+ common param names

Wayback Delta Analyzer

Compare live pages against Wayback archives — find removed content and deleted links

Email Harvester Pro

Deep email extraction with 8 methods including deobfuscation + Gravatar enrichment

Source Map Revealer

Expose leaked source maps — original source code, file trees, internal paths

CT Subdomain Enumerator

Enumerate all subdomains from Certificate Transparency logs via crt.sh

CORS Misconfiguration Tester

Test for dangerous CORS misconfigurations that enable credential theft

Shodan InternetDB Recon

Instant open ports, CVEs, and hostnames via Shodan InternetDB — no API key

CSP Bypass Analyzer

Deep Content-Security-Policy analysis — find every bypass vector

Hidden Path Recon

Probe 50+ sensitive paths: .env, .git, admin panels, backups, debug endpoints

Favicon Hash Recon

Compute favicon MurmurHash3 — find all matching servers via Shodan/Censys

DNS Intelligence Auditor

Deep DNS analysis via DoH — SPF, DMARC, CAA, dangling CNAMEs, mail provider ID

📡 Physical & Network Recon 6 tools

BLE Proximity Scanner

Scan nearby Bluetooth devices, detect AirTags and trackers, analyze MAC randomization, assess wireless threats, and generate physical security reports

Connection Fingerprint

See what the internet sees about you. IP, geolocation, TLS fingerprint, VPN detection, ISP/ASN, and edge routing from 9 Cloudflare probes.

MAC Address Lookup

Identify device manufacturers and check known CVE vulnerabilities from any MAC address using IEEE OUI + NIST NVD.

EUI-64 Decoder

Extract MAC addresses from IPv6 EUI-64 interface identifiers with visual byte breakdown and batch mode.

DHCP Lease Parser

Parse DHCP lease files to extract IP ↔ MAC mappings with manufacturer lookup. Supports ISC dhcpd, dnsmasq, syslog.

MAC Address Generator

Generate MAC addresses with 4 modes, IEEE OUI vendor search, bulk generation, and CSV/TXT export.

🔬 Media Forensics & Analysis 5 tools

Photo Forensics Studio

30+ image analysis tools — ELA, noise analysis, clone detection, JPEG ghost sweep, Fourier transform, chi-square stego detection, and more.

GeoLocator Recon

Kalman-filtered multi-sensor geolocation scanner — GPS, IP, Wi-Fi, and WebRTC leak detection with interactive map.

Steganography Tool

Hide and extract encrypted messages in images using 2-bit LSB steganography with AES-256-GCM encryption. 100% client-side.

OCR Text Extractor

Extract text from images and PDFs with PaddleOCR + Tesseract engines, QR code detection, 18 languages, and smart preprocessing.

Reverse Image Search

Reverse image search using multiple engines. Analyze photos, extract EXIF metadata, and verify image authenticity.

🧰 Utilities & Reference 4 tools

Weather Alibi Checker

Verify historical weather claims against Open-Meteo data (1940–present). Detect contradictions in alibis, social media posts, or photos.

Search Engine Directory

Browse 75+ active search engines worldwide — mainstream, privacy, AI-powered, regional, indie, and specialty engines.

Password Generator

5 generation modes, multi-engine RNG, real-time entropy calculation, HIBP breach check, zxcvbn pattern analysis, and policy compliance.

ZIP↔JSON Converter

Convert ZIP archives to JSON and back. Smart text detection for 100+ file types, file tree visualization, and LLM-ready export.

People & Identity Search Tools

5 tools

Social Media & Media Analysis Tools

3 tools

Technical OSINT & Cyber Investigation Tools

5 tools

Assets, Business & Public Records Tools

5 tools

Geolocation & Mapping Tools

1 tool

OSINT Utilities & Helpers

2 tools

Max Intel OSINT Python Apps

23 desktop tools

Username Scanner

Scan usernames across 2000+ websites using Maigret. Filter by category, recursive search, proxy support, and PDF reports.

Email OSINT

Email intelligence combining Holehe account detection and h8mail breach lookup in a single desktop interface.

Identity Bridge

Correlate usernames to emails and vice versa via GitHub events, PGP keyservers, and public APIs.

Phone OSINT

Phone number intelligence with carrier detection, line type ID, and reverse lookup links across multiple services.

IP Lookup

IP geolocation, ISP identification, Shodan/VirusTotal/AbuseIPDB links, and optional port scanning with map view.

Domain Intel

Domain intelligence with WHOIS lookups, RDAP fallback, registrar details, nameservers, and VirusTotal integration.

Subdomain Scanner

Passive subdomain enumeration via crt.sh certificate transparency logs and public DNS sources.

MAC Lookup

MAC address OUI lookup to identify device manufacturers and vendors using IEEE and vendor databases.

VIN Lookup

Decode Vehicle Identification Numbers using the NHTSA vPIC API — make, model, year, engine, and safety data.

Crypto Lookup

Cryptocurrency wallet analyzer for Bitcoin, Ethereum, and Dogecoin. Auto-detects chain, balance, and explorer links.

Dork Generator

Advanced Google/Bing/Yandex dork generator for passive recon — find exposed files, directories, and data.

SSL/TLS Analyzer

Certificate, cipher suite, TLS protocol version, and HTTP security header analysis. No API keys required.

Web Scraper

Web page analyzer — extract links, emails, technology fingerprints, forms, social media links, and headers.

PDF Analyzer

PDF forensics — metadata extraction, JavaScript threat detection, embedded URLs, form fields, and risk assessment.

Traceroute

Visual traceroute with GeoIP lookup and interactive Folium map. IPv4/IPv6, monitor mode, route visualization.

DNS Recon

Full DNS enumeration — A, AAAA, MX, NS, TXT, SOA, CNAME, PTR, SRV, CAA plus SPF, DMARC, DKIM & DNSSEC security checks.

Hash Identifier

Identify 30+ hash types, generate hashes from plaintext, compute file checksums, and check against breach databases.

Metadata Extractor

Extract EXIF/GPS from images, PDF metadata, Office document properties, audio/video tags, and file hashes with VirusTotal links.

Reddit OPSEC Checker

Scan Reddit accounts for PII leaks. 15 pattern categories, geographic mapping, 0-100 exposure score.

Reddit Bot Detector

Detect bot behavior. 8 behavioral signals, 24h activity heatmap, 0-100 bot probability score.

Reddit Persona Reconstructor

Build profiles — timezone, profession, location, interests, writing style, activity patterns.

Reddit Sockpuppet Correlator

Compare 2-5 accounts for sockpuppet signals. Subreddit overlap, timing, co-commenting, vocabulary.

Reddit Domain Reputation

Check domain reputation on Reddit. Subreddit distribution, upvote ratios, spam flags, 0-100 score.

Self-Hosted OSINT APIs

4 tools

OSINT Research & Reports

13 articles

Google Dorking Reference 2026

Every working search operator across 6 engines. Cross-engine compatibility tables, OSINT investigation patterns, deprecated operators, and the GHDB.

Search Engine Landscape 2026

Market share data, shutdowns, AI search engines, privacy alternatives, and best picks by use case. 40+ engines analyzed.

OSINT Tool Graveyard 2026

Status check on 120+ OSINT tools — shutdowns, paywall migrations, acquisitions, and the free alternatives that still work.

AI SEO Guide 2026

How to rank in AI-generated answers. 12 core GEO techniques for getting cited by ChatGPT, Perplexity, Gemini, and AI Overviews.

Certificate Transparency for OSINT

How CT logs expose subdomains, infrastructure, and phishing campaigns. Querying crt.sh, Censys, and Certstream for passive reconnaissance.

Wayback Machine as an OSINT Tool

CDX API deep dive, deleted content recovery, robots.txt archaeology, ghost profiles, and WHOIS history from 1 trillion archived pages.

Digital Image Forensics Guide

ELA, EXIF analysis, clone detection, noise analysis, AI-generated image detection, deepfakes, and C2PA Content Credentials.

MAC & Network Forensics

MAC address structure, OUI lookup, randomization by OS, EUI-64 IPv6 privacy leaks, RFC 8981, and DHCP lease forensics.

DNS Reconnaissance & Subdomain Discovery

DNS record types for OSINT, Subfinder vs Amass vs BBOT, AI-driven Subwiz, passive vs active enumeration, and zone transfer attacks.

Password Security & Entropy

16 billion leaked credentials, entropy math, NIST 2025 guideline changes, HIBP k-anonymity, and password cracking techniques.

Steganography: Hiding Data in Media

LSB, DCT, and adaptive embedding. GAN-based steganography, deep learning steganalysis, and 8 tools compared.

Username OSINT & Cross-Platform Identity

Sherlock vs Maigret comparison, cross-platform correlation techniques, ghost account recovery, and investigation workflows.

Geolocation OSINT Techniques

IP geolocation accuracy, EXIF GPS extraction, Wi-Fi BSSID triangulation, photo analysis, and 6 data sources compared.

What Is OSINT and Why Does It Matter?

Open Source Intelligence (OSINT) is the practice of collecting, analyzing, and using information from publicly available sources. These sources include websites, social media platforms, public government records, domain registration databases, news archives, and academic publications. Unlike classified intelligence, OSINT relies entirely on data that anyone can legally access.

OSINT has become an essential discipline for a wide range of professionals. Cybersecurity analysts use it to identify threats and vulnerabilities. Private investigators rely on it to locate individuals and verify identities. Journalists use OSINT techniques to fact-check stories, verify sources, and uncover hidden connections. Law enforcement agencies use open source intelligence to support criminal investigations, track suspects, and gather evidence. HR professionals and corporate security teams use OSINT for background checks and due diligence.

How Max Intel's OSINT Tools Work

Max Intel provides a centralized suite of over 20 specialized OSINT tools, each designed for a specific type of investigation. Rather than building proprietary databases, Max Intel aggregates and organizes links to the best publicly available search engines, databases, and lookup services for each category. When you enter a search query — whether it's a person's name, an email address, a domain name, or an IP address — Max Intel generates direct search links to dozens of relevant external sources, allowing you to quickly scan multiple databases without visiting each one individually.

Every tool on Max Intel is completely free, requires no registration or account creation, and works directly in your web browser. There are no API keys to configure and no software to install.

People Search & Identity Investigation

Max Intel's people-focused tools let you search for individuals using their name, email address, username, phone number, or physical address. The person search tool queries people-finder services like ThatsThem, TruePeopleSearch, and Whitepages. The email lookup tool checks for data breaches, associated social accounts, and email validation. The username search tool checks a given username across over 500 platforms including social media, gaming sites, forums, and developer communities.

Technical & Cyber Investigation

For cybersecurity professionals and technical investigators, Max Intel offers tools for domain analysis (WHOIS, DNS, SSL, technology detection), IP address intelligence (geolocation, ISP, ASN, threat scoring), threat intelligence (malware analysis, IOC search, CVE lookup), wireless network mapping, and MAC address identification (also available as an exclusive standalone tool). These tools pull from authoritative sources including VirusTotal, Shodan, Censys, AbuseIPDB, and NIST's National Vulnerability Database.

Business, Legal & Financial Research

Max Intel's business search tool helps you research companies through corporate registries, SEC filings, and ownership databases. The court records tool provides access to arrest records, court filings, inmate locators, and offender registries across federal and state systems. The crypto wallet tracker allows you to trace transactions across Bitcoin, Ethereum, and other major blockchain networks.

Frequently Asked Questions About OSINT & Max Intel

What is OSINT?

OSINT stands for Open Source Intelligence. It is the practice of collecting and analyzing information from publicly available sources such as websites, social media, public records, domain registrations, and news outlets. OSINT is used by investigators, journalists, cybersecurity professionals, law enforcement, and researchers to gather actionable intelligence without accessing private or classified data.

Is Max Intel free to use?

Yes, Max Intel is completely free. All 100+ OSINT tools are available without registration, login, or API keys. You can search people, emails, usernames, domains, IP addresses, and more directly in your browser.

What OSINT tools does Max Intel offer?

Max Intel offers over 20 OSINT tools organized into six categories: People & Identity (person search, email lookup, username search, phone lookup, address lookup), Social & Media (social media search, reverse image search, video analysis, document search), Technical (domain OSINT, IP address lookup, threat intelligence, wireless/network analysis, MAC address lookup), Assets & Records (business search, crypto wallet tracker, transportation tracking, court records), Geolocation (maps, satellite imagery, street view), and Utilities (Google dork generator).

Do I need to create an account to use Max Intel?

No. Max Intel requires no registration, no account creation, and no API keys. All tools are accessible directly through your web browser. Simply choose a tool, enter your search query, and browse results from multiple open source databases and services.

Who uses OSINT tools?

OSINT tools are used by a wide range of professionals including private investigators, cybersecurity analysts, journalists conducting research, law enforcement officers, HR professionals performing background checks, fraud investigators, academic researchers, and penetration testers. Anyone who needs to gather publicly available information can benefit from OSINT tools.

Is it legal to use OSINT tools?

Yes, using OSINT tools to collect publicly available information is legal in most jurisdictions. OSINT relies exclusively on data that is already publicly accessible — such as social media profiles, public records, WHOIS data, and news articles. However, how you use the information you gather may be subject to local privacy laws and regulations. Always use OSINT tools responsibly and ethically.