Of 120+ OSINT tools surveyed in February 2026 and re-checked in July and October 2026, 31 have permanently shut down, 7 moved behind paywalls, and ~27 face reduced functionality or changed access (as of 7 October 2026). Key casualties: BinaryEdge (dead), Clearbit (now $75/month), Pipl ($3K–$130K/year). Counter-trends: Maigret now checks 3,000+ sites, AI-powered OSINT tools are proliferating, and Bluesky's open AT Protocol enables social intelligence that X/Facebook/LinkedIn no longer permit.
Of 120+ OSINT tools surveyed (last re-checked 6–7 October 2026), 31 shut down permanently, 7 moved behind paywalls, and ~27 face reduced functionality or changed access. Counter-trends: AI-powered tools proliferating, Maigret checks 3,000+ sites, and Bluesky's AT Protocol enables social intelligence that X, Facebook, and LinkedIn block.
Update — October 2026
What changed since the September revision, from a re-check of every service wired into Max Intel's tools on 6–7 October 2026 (details in the October 2026 audit table below):
- Three more entries are dead: the Oscobo privacy search engine (homepage still loads, but a query returns the homepage instead of results; offline as a working engine since 2021), Mullvad Leta (shut down 27 November 2025 per Mullvad's announcement, yet still listed as live in several directories) and Google's
cache:operator, which Google no longer documents. Google Search Central (checked 7 Oct 2026) - abuse.ch APIs now require an Auth-Key: URLhaus, MalwareBazaar and ThreatFox API calls return
401 Unauthorizedwithout the free key; some CSV dumps still download openly. URLhaus API documentation (checked 7 Oct 2026) - Five endpoints changed shape or access: Warpcast now redirects to farcaster.xyz; Reddit's
about.jsonrejects generic clients and has no CORS; Proton's username-availability endpoint demands anx-pm-appversionheader; Robtex's free API streams NDJSON; HackerTarget's free tier answers with a plain-text quota error (HTTP 200). All verified 7 October 2026 (links in the table). - One wrong identifier: the Hugging Face model id
onnx-community/wavlm-base-plus-svdoes not exist;Xenova/wavlm-base-plus-svdoes. Hugging Face (checked 7 Oct 2026) - Counts on this page now read 31 dead / 7 paywalled / ~27 reduced or changed; the July figures were 10 / 6 / ~12.
- Four more found in the 8 October guide refresh: XTEA.io (now a blog), Pyrogram and RansomWatch (repositories archived) are dead; AIMSICD is dormant but not archived.
- Twelve more rows from the 8 October directory audit of every link-list page: Radaris (domain transferred by court order), Ask.com (closed 1 May 2026), Stract, EntireWeb, Sentinel Hub EO Browser (20 March 2026), the Open Ownership Register, TruePic Lens, the GLTR demo, Glitch-hosted tools, Montage, Google Podcasts Manager, Infoga, InstaLooter, two Web3 pivot URLs, OpenSky profile pages, UniCourt’s free search and GeoSpy public access; then PeekYou (domain passed to Atlas Data Privacy), CallerIDTest, Homesnap, StalkFace, Creepy, Foundation Directory Online, the Vanderbilt beta archive and Waldo.
Key Findings at a Glance
Of 120+ commonly recommended OSINT tools surveyed, 31 have shut down or gone effectively dead (as of October 2026), 7 have moved behind significant paywalls, and roughly twenty more face reduced functionality, changed APIs or uncertain futures. The dominant forces: platform API lockdowns (Twitter/X, Reddit, Facebook, LinkedIn), corporate acquisitions funneling open tools into enterprise products, and a broader shift toward paid SaaS models. AI-powered OSINT tools are the major counter-trend — proliferating rapidly alongside Bluesky's open protocol as a rare bright spot for social media intelligence.
Methodology: Between January 2026 and follow-up re-checks in July and on 6–7 October 2026, we verified the live status, pricing, ownership, and recent changelog of every tool listed here. Sources include official announcements, vendor changelogs, Bellingcat's Online Investigation Toolkit, Intelligence X tools changelog, industry newsletters (OSINT Newsletter, Indicator), Krebs on Security, and direct URL verification. Where possible, we link to primary sources.
Which Free OSINT Tools Shut Down in 2024–2026?
| Tool | Category | Status | What Happened | Date |
|---|---|---|---|---|
| BinaryEdge | Network Scanning | Dead | Shut down after Coalition acquisition; tech absorbed into Coalition Control | Mar 31, 2025 |
| ThreatCrowd | Threat Intel | Dead | SSL expired Jan 2025, no HTTP response; Palo Alto deprecated integration | ~Mid 2025 |
| Skype | Comms / Data Source | Dead | Retired by Microsoft; OSINT tools lost Skype as a data source | May 5, 2025 |
| Twint | Twitter/X Scraping | Dead | Broken by X's anti-scraping; no updates since 2020 | Effectively 2023+ |
| Illicit Services | Data Search | Dead | Voluntarily shut down due to exploitation concerns | 2024 |
| PeekYou | People Search | Dead | The domain is now controlled by Atlas Data Privacy Corporation after Atlas and PeekYou LLC settled Atlas Data Privacy Corp. v. PeekYou LLC (N.J. Super. Ct., Essex County, ESX-L-003299-25); peekyou.com shows only that notice (peekyou.com) | Confirmed Oct 2026 |
| KnowEm | Username Availability | Dead | Domain no longer resolves; brand/username checker offline | Confirmed Jul 2026 |
| Centeda | People Search | Unverified | Blocks automated access (Cloudflare 403); live status unverified | Re-checked Sep 2026 |
| Castrick | Email / Identity | Dead | Domain no longer resolves; email-lookup service offline | Confirmed Jul 2026 |
| Nitter (nitter.net) / XCancel | Twitter/X Viewer | Dead | Shut down after X Corp served cease-and-desist letters on Nitter and XCancel on 24 Aug 2026 demanding permanent takedown; nitter.net now reads "nitter.net is offline and development has stopped for the time being", xcancel.com reads "The service XCancel is stopped until further notice", and the GitHub repo is archived (TechCrunch, The Register) | Confirmed Sep 2026 |
BinaryEdge is the highest-profile casualty. Acquired by Coalition (a cyber insurance company) in 2020, the standalone platform was permanently shut down on March 31, 2025. All subscriptions — free and paid — were terminated. The scanning technology lives on inside Coalition's products but is no longer independently accessible.
ThreatCrowd went dark around mid-2025 with no formal announcement. The SSL certificate expired in January 2025 and was never renewed, the site returns no HTTP response, and Palo Alto's Cortex XSOAR deprecated its ThreatCrowd integration in June 2025, citing "service is down." The tool should be considered permanently defunct.
Skype's retirement dealt a surprising blow to OSINT. Tools like OSINT Industries and Epieos relied on Skype as a data source for digital footprint mapping. With Skype profiles disappearing by January 2026, those investigative data points are gone. Twint — the once-popular Twitter scraping tool — is effectively dead, broken by X's updated anti-scraping systems. Illicit Services (search.illicit.services) was voluntarily shut down by its operator after evidence of exploitation for malicious purposes.
Additional smaller casualties confirmed by Intelligence X's tools changelog (Oct 2025): Spytox, Matbea (Bitcoin lookup).
Update (July 2026, revised September 2026): Four people-focused link services were flagged in July — Castrick (email lookups) and KnowEm (username availability) stopped resolving at the DNS level, while PeekYou and Centeda still resolved (Cloudflare) but returned 403 to automated clients. October 2026: PeekYou is now dead — its domain passed to Atlas Data Privacy under a settlement — and Centeda remains unverified. Separately, Nitter — the long-standing login-free Twitter/X viewer — is now gone for good: on 24 August 2026 X Corp served cease-and-desist letters on Nitter and XCancel demanding permanent takedown. nitter.net now reads "nitter.net is offline and development has stopped for the time being", xcancel.com reads "The service XCancel is stopped until further notice", and the GitHub repository is archived (TechCrunch, The Register), so it can no longer be relied on for OSINT. All five have been removed from Max Intel's live tools; the open AT Protocol makes Bluesky a far more durable alternative for social OSINT.
What Died, Changed or Was Restricted in the October 2026 Audit?
On 6–7 October 2026 we re-tested every third-party service that Max Intel's own tools call or link to. The entries below use the same scheme as the rest of this page: Dead means the service no longer does its job at all, Restricted means it still works but now needs a key, header or specific client, and Changed means the address or response format moved and old integrations break. Each row ends with what to use instead.
| Tool / endpoint | Category | Status | What Happened | Use Instead | Date |
|---|---|---|---|---|---|
| Oscobo | Privacy Search Engine | Dead | Non-functional since 2021; on 7 Oct 2026 oscobo.com still serves a homepage, but any search returns that same homepage with no results | Startpage, DuckDuckGo or Mojeek — all pre-filled from the engine directory, where Oscobo is now marked defunct | Confirmed Oct 2026 |
| Mullvad Leta | Privacy Search Proxy | Dead | Mullvad announced on 6 November 2025 that it would shut Leta down on 27 November 2025 ("the search industry continues to undergo big changes. Leta will not be able to follow"); leta.mullvad.net no longer answers, yet several tool directories still list it as live (Mullvad blog) | Startpage, DuckDuckGo, Mojeek, or a self-hosted SearXNG instance; see the privacy engines section of the landscape report | Re-confirmed Oct 2026 |
Google cache: | Search Operator | Dead | Cache links left results in early 2024 and the operator left Google's documentation in September 2024; it now runs as an ordinary search (Google Search Central) | Wayback Machine (web.archive.org) or archive.today; see the dorking reference | Re-confirmed Oct 2026 |
| abuse.ch URLhaus / MalwareBazaar / ThreatFox APIs | Threat Intel | Restricted | API calls without the Auth-Key header return 401 {"error": "Unauthorized"}; the key is free but mandatory since 2025 (URLhaus API docs). Some CSV dumps (e.g. URLhaus csv_recent) still download without a key | Register for a free abuse.ch Auth-Key, or use the open dumps; Max Intel's IOC scanner reads the open URLhaus json_recent dump rather than the keyed API | Confirmed Oct 2026 |
| Warpcast (Farcaster client) | Social / Pivot URL | Changed | warpcast.com returns 301 to farcaster.xyz; old profile URLs still redirect | Use farcaster.xyz/<handle>; updated in the URL Pivot Encyclopedia | Confirmed Oct 2026 |
Kick api/v2/channels | Streaming / Pivot API | Restricted | Sat behind a Cloudflare challenge page in the 6 Oct 2026 audit; a plain fetch succeeded again on 7 Oct, so it is not a dependable unauthenticated API | Open the channel page kick.com/<slug> in a browser; treat the JSON endpoint as best-effort | Checked Oct 2026 |
Reddit /r/<sub>/about.json and /user/<name>/about.json | Social / Pivot API | Restricted | Returns 403 to generic clients (needs a descriptive User-Agent and still blocks many datacenter IPs on 7 Oct 2026) and sends no CORS headers, so browser-side tools cannot call it | Server-side fetch with a descriptive User-Agent, or open old.reddit.com/user/<name> directly | Confirmed Oct 2026 |
Proton Mail username check (users/available) | Email / Pivot API | Restricted | Without the x-pm-appversion header the endpoint answers 400 {"Code":5002,"Error":"Missing x-pm-appversion header"} (7 Oct 2026); with a stale version it answers 422, and "taken" is signalled by 409 | Not usable as a plain URL pivot; use Proton's own signup form or an email-permutation tool that keeps up with the header | Confirmed Oct 2026 |
| Robtex free API | Domain / IP | Changed | pDNS endpoints now stream NDJSON (one JSON object per line) rather than a single JSON document; parsers expecting an array break | Parse line by line; Max Intel's IOC scanner and IP triage were updated 6 Oct 2026 | Confirmed Oct 2026 |
| HackerTarget free API | Domain / Network | Restricted | Over quota, the free tier returns the plain-text body API count exceeded - Increase Quota with Membership with HTTP 200, which tools mis-render as a hostname | Check the response text before parsing; crt.sh, Censys (100 free credits) or a paid HackerTarget membership for volume | Confirmed Oct 2026 |
Hugging Face onnx-community/wavlm-base-plus-sv | Voice / Model ID | Changed | The model id does not exist (huggingface.co returns an error page); tools hard-coding it fail to load | Xenova/wavlm-base-plus-sv, used by the Voice Print Matcher since 6 Oct 2026 | Confirmed Oct 2026 |
| XTEA.io | Telegram Search | Dead | Older guides still list it as a Telegram channel index; on 8 Oct 2026 xtea.io is a personal coding blog with no Telegram search | Telegram’s own Posts search (Premium), TGStat, Telemetr or Lyzem; see the Telegram OSINT guide | Confirmed Oct 2026 |
| Pyrogram | Telegram API Library | Dead | The repository was archived on 23 December 2024 and describes itself as no longer maintained, so it will drift out of step with Telegram’s API layers (GitHub) | Telethon, which is actively maintained | Confirmed Oct 2026 |
| RansomWatch | Ransomware Leak-Site Tracker | Dead | The open-source tracker’s repository is archived and no longer updated (GitHub) | ransomware.live; see the dark web OSINT guide | Confirmed Oct 2026 |
| AIMSICD (Android IMSI-Catcher Detector) | Cellular Surveillance Detection | Dormant | Not archived — its README still promises a revival — but development has been dormant for years, and app-based detection cannot see the baseband traffic that matters (GitHub) | EFF’s Rayhunter on supported hotspot hardware; see the IMSI-catcher guide | Checked Oct 2026 |
| Radaris (and Rehold, Trustoria) | People Search | Dead | On 27 August 2026 the Superior Court of New Jersey (Middlesex County, MID-L-000847-24) entered a default judgment and transferred radaris.com to Atlas Data Privacy Corporation; the domain now shows only the court notice (radaris.com) | Other free people-search sites in the people search hub; for removal, its sister site Veripages still has an opt-out (removal guide) | Confirmed Oct 2026 |
| Ask.com | Search Engine | Dead | IAC discontinued its search business; the site says “Ask.com officially closed on May 1, 2026” (ask.com) | Any engine in the engine directory | Confirmed Oct 2026 |
| Stract and EntireWeb | Search Engines | Dead | Both domains now belong to unrelated products (a PR tool and an uptime-status service) | Mojeek or Marginalia for independent indexes | Confirmed Oct 2026 |
| Sentinel Hub EO Browser | Satellite Imagery | Dead | Planet shut down EO Browser and the Sentinel Hub Dashboard on 20 March 2026 (Planet) | Copernicus Browser (free) or Planet Insights (paid); see the geolocation hub | Confirmed Oct 2026 |
| Open Ownership Register | Beneficial Ownership | Dead | The register website closed on 29 November 2024; its bulk datasets remain published | Open Ownership data, UK Companies House PSC search; see the business records hub | Confirmed Oct 2026 |
| TruePic Lens and the GLTR demo Space | AI / Provenance Detection | Dead | The TruePic Lens page returns 404 and the Hugging Face GLTR Space now returns 401 (no longer public) | The C2PA Inspector and detectors listed on the AI provenance hub | Confirmed Oct 2026 |
| Glitch-hosted tools (e.g. the X/Twitter OAuth playground used for post times) | Hosting | Dead | Glitch project hosting ended and old project URLs return HTTP 410 | Read X post times from the ID with the Platform ID Decoder | Confirmed Oct 2026 |
| Montage (Meedan) and Google Podcasts Manager | Video / Podcast | Dead | Montage now redirects to meedan.org; Google Podcasts Manager says it is no longer available | InVID-WeVerify and the video OSINT hub | Confirmed Oct 2026 |
| Infoga and InstaLooter | OSINT Programs | Dead | The Infoga repository no longer exists; InstaLooter describes itself as defunct (last release 2020) | Holehe for email checks; Instaloader for Instagram; see the tools directory | Confirmed Oct 2026 |
Lens {handle}.lens.xyz profiles and the Bonfida .sol proxy | Web3 Pivot URLs | Dead | The lens.xyz profile subdomains no longer resolve and the Bonfida proxy returns 404 | hey.xyz/u/{handle} for Lens; see the URL Pivot Encyclopedia | Confirmed Oct 2026 |
| OpenSky aircraft-profile pages | Flight Tracking | Changed | The aircraft-profile?icao24= URL now returns HTTP 410; the OpenSky network and API remain | airplanes.live or ADS-B Exchange by ICAO hex; see the transport hub | Confirmed Oct 2026 |
| UniCourt free search and GeoSpy public access | Court Records / Geolocation | Restricted | UniCourt no longer offers a free public search; GeoSpy says it is available only to qualified government and enterprise organisations | CourtListener and Justia Dockets for courts; manual geolocation methods in the geolocation guide | Confirmed Oct 2026 |
| CallerIDTest | Phone / Caller ID | Dead | The owner shut the side project down, citing lawsuits under New Jersey’s Daniel’s Law: “Unfortunately this side project has to come to an end” (calleridtest.com) | Free carrier and line-type checks in the phone lookup hub | Confirmed Oct 2026 |
| Homesnap | Real Estate / Address | Changed | homesnap.com now redirects (302) to Homes.com | Homes.com, Zillow, Redfin and county assessor portals via NETR Online in the address hub | Confirmed Oct 2026 |
| StalkFace | Facebook Search | Dead | Its search template returns 404, the site works only through a form, and the links it builds use Facebook Graph Search paths that Facebook retired | Meta Ad Library and the Facebook OSINT link generator | Confirmed Oct 2026 |
| Creepy (geolocation from social posts) | OSINT Program | Dead | Last commit February 2014; the social-media APIs it depended on have been retired | Bellingcat’s ShadowFinder and the methods in the geolocation guide | Confirmed Oct 2026 |
| Foundation Directory Online | Nonprofit Funding | Paywalled | The old address returns an error and the product is now part of Candid’s paid search | ProPublica Nonprofit Explorer and IRS data in the business records hub; Candid Search (paid) | Confirmed Oct 2026 |
| Vanderbilt TV News Archive beta | News Archive | Changed | The beta site now redirects to the main Vanderbilt Television News Archive | The main archive and Internet Archive TV News in the news hub | Confirmed Oct 2026 |
| Waldo | Search Engine | Restricted | Pivoted from a free research search engine to a paid brand-intelligence product | Other engines in the engine directory | Confirmed Oct 2026 |
Takeaway: nineteen of these thirty-four are outright dead and one is dormant; the rest are the quieter failure mode of 2026 — a service that still answers, but with a redirect, a quota message or an authentication error that an unmaintained tool will happily misread as data.
Which OSINT Tools Moved From Free to Paid in 2024–2025?
| Tool | Was | Now Costs | Status | What Changed |
|---|---|---|---|---|
| Clearbit → Breeze Intelligence | Free | $75/mo minimum | Paid | HubSpot acquired; all free tools sunset Apr 30, 2025 |
| Pipl | Free search | $3K–$130K/year | Paid | Enterprise-only; no free tier, no self-signup |
| Phonebook.cz | Free | Paid IntelX account | Paid | Locked due to spam abuse; requires paid Intelligence X |
| GeoGuessr | Free mode | ~$4.99/mo | Paid | Free mode eliminated Feb 2024; Steam version requires sub too |
| MarineTraffic | Generous free | $10–$100/mo | Paid | Jan 2025: eliminated add-ons, 3 free "unlocks" then paywall |
| Etherscan (multi-chain) | Free API | $49/mo per chain | Paid | Free API cut for Avalanche, Base, BNB, Optimism; ETH mainnet still free |
The most dramatic pivot belongs to Clearbit, acquired by HubSpot in December 2023 and rebranded as Breeze Intelligence. Every free Clearbit tool — the platform, Weekly Visitor Report, Connect Chrome extension, TAM Calculator, Slack integration — was sunset on April 30, 2025. The Logo API followed on December 8, 2025. Using Breeze Intelligence now requires a HubSpot subscription ($30/month) plus a credit pack ($45/month), creating a $75/month floor where there was once zero cost. (We built a free, self-hosted replacement: Open Logo API.)
Pipl completed its transformation from free consumer search to enterprise-only identity verification. Custom pricing ranges from $3,000 to $130,000 annually (average ~$58,000/year), with no free tier and no self-signup. For individual OSINT practitioners, Pipl is no longer viable.
Other tools have shifted to restrictive freemium models. Epieos now charges €29.99/month for full access to 140+ modules. OSINT Industries starts at ~£19/month. VirusTotal restructured pricing into four tiers (October 2025) but preserved its free Community tier at 500 requests/day — a key win for the open OSINT community. For the free tools still worth using, see our maintained OSINT tools directory.
How Are Corporate Acquisitions Reshaping the OSINT Landscape?
| Tool | Acquired By | Status | Impact on Free Access |
|---|---|---|---|
| SecurityTrails | Recorded Future → Mastercard ($2.65B) | Acquired | Free tier significantly restricted |
| SpiderFoot | Intel 471 (Thoma Bravo) | Acquired | Open-source version abandoned; 50 open PRs, 265 open issues (Sep 2026) |
| AlienVault OTX | AT&T → LevelBlue (WillJam Ventures) | Acquired | Still free (235K+ members); long-term uncertain |
| Sentinel Hub | Planet Labs | Acquired | EO Browser and the Sentinel Hub Dashboard shut down on 20 March 2026 (announced 5 Feb 2026); free users move to Copernicus Browser, paid users to Planet Insights (Planet) |
| FlightAware | Collins Aerospace (RTX/Raytheon) | Acquired | Consumer tracking still free |
| Netcraft | Spectrum Equity ($100M+) | Acquired | Enterprise focus deepening; acquired FraudWatch |
SecurityTrails underwent a double acquisition — purchased by Recorded Future for $65 million in 2022, then Recorded Future was acquired by Mastercard for $2.65 billion (closed Q1 2025). SecurityTrails now feeds into Recorded Future's Intelligence Graph as a subsidiary of a credit card company. The free tier has been significantly restricted.
SpiderFoot was acquired by Intel 471 (Thoma Bravo portfolio) in November 2022. The open-source version on GitHub has been effectively abandoned — no commits since November 2023, 50 open pull requests, 265 open issues (Sep 2026). Its capabilities were folded into Intel 471's TITAN platform. One caution: an unrelated spiderfoot package (v0.0.1) appeared on PyPI in July 2026 — the real project is not distributed via PyPI.
What Is the Current Status of 120+ OSINT Tools by Category?
People Search
All 20 people search tools surveyed remain operational. PeopleConnect Holdings (H.I.G. Capital) controls TruthFinder, Instant Checkmate, Intelius, and ZabaSearch — all paid at ~$25–30/month. Whitepages Inc. owns 411.com and AnyWho, and launched Property Intel (Dec 2024) and a Pro API (Aug 2025).
A March 2024 Krebs on Security investigation exposed that TruePeopleSearch, FastPeopleSearch, SearchPeopleFree, USPhoneBook, and FamilyTreeNow are interconnected sites registered via Alibaba Cloud in Beijing with fabricated founder identities. Despite this exposure, all remain fully operational and free (ad-supported). The paid/free divide has held stable — no tool has newly moved from free to paid.
Email & Username Tools
Have I Been Pwned is thriving. A major 2.0 redesign launched in May 2025, and the database expanded with 2 billion new email addresses, plus data from Operation Endgame 2.0 (15.3 million victim emails). The free personal search remains intact. DeHashed expanded with WHOIS domain search (April 2025). Intelligence X updated to tools version 18 (October 2025), adding 204+ million DNS records.
Maigret has effectively surpassed Sherlock for username searches, now checking 3,000+ sites versus Sherlock's 400+, with better false-positive handling and MCP server integration for AI assistants. Sherlock remains actively maintained (v0.16.0, included in Kali Linux), but the community has shifted. WhatsMyName covers 640+ platforms. Holehe (v1.61, 120+ platforms) is partially degraded — its X/Twitter and Instagram modules broke when those services tightened anti-enumeration protections in 2024–2025; the rest of the catalog still works. h8mail (v2.5.6) is open-source but most of its high-value sources (Snusbase, Leak-Lookup, etc.) now require paid API keys to return useful data, so the standalone tool is mostly a routing layer for paid services.
Domain, Network & IP
The biggest infrastructure shift: ICANN officially replaced WHOIS with the Registration Data Access Protocol (RDAP) on January 28, 2025. RDAP offers structured data and better internationalization, but many records remain GDPR-redacted. Censys launched a new platform (February 2025) with credit-based pricing, new query language (CenQL), and 100 free credits. Shodan continues its familiar model — limited free tier, one-time $49 lifetime membership, tiered subscriptions. GreyNoise launched Recall, Feeds, and query-based blocklists while maintaining its free Community tier.
Threat Intelligence
The abuse.ch ecosystem (MalwareBazaar, URLhaus, ThreatFox, YARAify, Feodo Tracker) deepened its Spamhaus Technology partnership, adding commercial API access alongside community-free usage. All platforms now require authentication. PhishTank remains online but has had new user registration disabled since 2020; an ML-based redesign is underway. MITRE ATT&CK released version 18 (October 2025) with a defensive overhaul, and the companion ATLAS AI security framework expanded to 15 tactics and 66 techniques. OpenSanctions incorporated as a German GmbH and added ~50 new data sources.
Government & Public Records
The 43-day government shutdown (October 1 – November 12, 2025) — the longest in U.S. history — temporarily disrupted federal OSINT resources. FOIA.gov was hit hardest: beyond the shutdown, FOIA staff have been eliminated at 24+ agencies, and extreme processing delays persist. USAspending.gov emerged as an unexpectedly critical tool during the DOGE initiative. SEC EDGAR remains fully free and unchanged. OCCRP Aleph was rebuilt as "Aleph Pro" (December 2025) with AI-powered risk scoring — free for nonprofit journalists, with commercial licensing for others.
Crypto Investigation
Blockchain.com Explorer, Blockchair (now 48 chains), and core Etherscan web searches remain free. OXT.me technically works but is effectively orphaned — parent company Samourai Wallet was shut down after co-founder arrests in April 2024 (domain expires June 2026). Chainalysis and Crystal remain enterprise-only.
Documents & Archives
Wayback Machine recovered from its 2024 breach and DDoS attacks, reaching 1 trillion archived pages in October 2025 — though archiving frequency dropped 87% for major news sites after May 2025. CourtListener/RECAP launched RECAP Search Alerts (June 2025) and won the 2025 American Legal Technology Award. DocumentCloud shipped a complete UI rebuild (January 2025) with OCR injection. Sci-Hub remains operational but was blocked in India (August 2025) with no new uploads since December 2020.
Transport, Geo & Mapping
FlightRadar24 expanded to ~50,000 ground stations with space-based ADS-B data. Google Earth introduced paid Professional tiers while keeping core features free. Mapillary continues growing under Meta (2+ billion photos). SunCalc remains functional but aging — the developer noted it "hasn't been updated in 15 years."
What New OSINT Tools Launched in 2024–2025?
| Tool | What It Does | Status | Cost |
|---|---|---|---|
| GeoSpy / Picarta | AI image geolocation — estimates geographic origin from photos | New | Free tier + paid |
| Taranis AI | Open-source NLP entity extraction from news items | New | Free (EUPL license) |
| Cylect.io | AI-powered OSINT search engine / modern OSINT Framework | New | Freemium |
| Blackbird | Fast username search across 600+ sites | New | Free / open-source |
| IntelHub | Privacy-first browser extension (all analysis local) | New | Free |
| Bluesky OSINT tools | Multiple tools for AT Protocol (Bluesky Insights, Hoaxy, Open Measures) | New | Free / open-source |
| Bellingcat Toolkit v2 | Redesigned community-maintained OSINT tool directory | Updated | Free |
The most significant trend is AI integration across the OSINT landscape. GeoSpy and Picarta use computer vision to estimate where a photo was taken — increasingly adopted by law enforcement and journalists. Taranis AI applies natural language processing to automate entity extraction from news feeds. Cylect.io positions itself as a next-generation alternative to the classic OSINT Framework site.
Bluesky's open AT Protocol has emerged as the most OSINT-friendly social platform, enabling tools that the locked-down APIs of Twitter/X, Facebook, and LinkedIn no longer permit. Multiple analysis tools already exist for Bluesky, and the community expects this ecosystem to grow substantially in 2026.
Bellingcat launched a completely redesigned Online Investigation Toolkit in late 2024, now receiving 1,000+ daily visitors with community-maintained reviews. DocumentCloud shipped a complete UI rebuild with OCR capabilities. The DW Innovation KID Verification Toolkit was released as a free resource for journalists.
What Does the OSINT Tool Landscape Mean for Practitioners in 2026?
The free OSINT toolkit is fragmenting under three compounding pressures. First, major platforms are systematically closing data access — Twitter/X's API restrictions, Facebook hiding UIDs, LinkedIn removing search filters, Reddit's tighter API rules, and Google restricting account data have collectively degraded the foundation many OSINT tools were built on.
Second, the free-to-paid migration is accelerating: Clearbit, Pipl, GeoGuessr, MarineTraffic, and Phonebook.cz all crossed that threshold in 2024–2025, and tools like Epieos and OSINT Industries have made paid tiers the practical default.
Third, corporate acquisitions funnel open tools into enterprise products — SecurityTrails into Mastercard's empire, SpiderFoot into Intel 471 (open-source version abandoned), BinaryEdge into Coalition (then killed entirely).
The counter-trend is equally clear: open-source community tools like Maigret, WhatsMyName, and Blackbird continue to grow, AI-powered tools are lowering the barrier to sophisticated analysis, and Bluesky's open protocol offers a model for OSINT-friendly platform design.
Practitioners who relied on a static toolkit from 2022 will find significant gaps. Those who track the Bellingcat toolkit, Intelligence X changelog, and GitHub trending projects quarterly will stay ahead of the churn. The era of a free, stable, comprehensive OSINT toolkit is over — replaced by a more powerful but more fragmented landscape that rewards constant adaptation.
The fragmentation of OSINT tools mirrors the broader fracturing of the search engine landscape, where Google's share dropped below 90% for the first time and AI answer engines are absorbing hundreds of millions of queries. For investigators, mastering advanced search operators and maintaining awareness of 80+ active search engines across regions is now as important as maintaining your OSINT tool portfolio. Max Intel provides free, up-to-date access to 79 OSINT tools across every category. Explore all tools →