How Do You Investigate Wireless Networks and Internet Infrastructure?
Max Intel's Wireless & Network OSINT tool provides access to 25+ tools for WiFi, cell tower, BGP, and infrastructure reconnaissance. Wireless recon is a core component of NIST SP 800-115 and PTES intelligence gathering methodology.
How Do You Look Up a WiFi Network by Name or Location?
WiGLE (Wireless Geographic Logging Engine) is the world's largest wireless network database, with over 1.2 billion unique network observations from crowdsourced contributors as of 2025. It maps WiFi networks, cell towers, and Bluetooth devices globally. WiFi Map and WiFi Space provide additional databases. WiFi OSINT is useful for geolocation, coverage analysis, and security research.
Cell Tower & Mobile Network Data
CellMapper provides crowdsourced cell tower locations, sectors, and carrier information. OpenCellID offers an open database used for mobile device geolocation. Cell tower data helps verify device locations, understand carrier coverage, and support geolocation investigations. AntennaSearch lists registered US towers and antennas near an address, nPerf maps crowdsourced 3G/4G/5G coverage by carrier, and beaconDB is an open, MLS-compatible Wi-Fi/cell location database that took over after Mozilla Location Service shut down in 2024.
BGP, ASN & Internet Infrastructure
BGP.tools, Hurricane Electric, and RIPE Stat provide Border Gateway Protocol routing data — the routing protocol defined in RFC 4271 that governs how traffic flows between the 75,000+ autonomous systems that make up the internet, AS number lookups, and network peering information. PeeringDB and ASRank offer internet exchange and network ranking data. IPinfo provides ASN-to-organization mapping. These tools are essential for understanding network ownership and routing.
Internet Scanning & Device Discovery
Shodan, Censys, GreyNoise, ZoomEye, and FOFA scan the internet and index connected devices, open ports, and running services. These tools can discover IoT devices, misconfigured servers, exposed databases, and industrial control systems. Submarine Cable Map and DataCenterMap show physical infrastructure. For radio hardware, fccid.io exposes FCC equipment-authorization filings (frequencies, external photos, user manuals) behind any FCC ID printed on a device, RadioReference catalogs public-safety and trunked-radio frequencies, and ReceiverBook maps public WebSDR, KiwiSDR and OpenWebRX receivers you can tune remotely.
Can You Watch Drones, Aircraft and Trackers With a Cheap SDR?
iNTERCEPT is an open-source (Apache-2.0) web interface that runs on your own computer and puts many software-defined radio (SDR) tools behind one screen. Its radio features need an RTL-SDR (a USB TV-tuner dongle used as a general radio receiver), which the project prices at about $25–35. Modes include ADS-B aircraft tracking, AIS ship tracking and drone Remote ID detection (the ASTM F3411 broadcast, over Wi-Fi and Bluetooth). It also offers Bluetooth tracker detection and a counter-surveillance (TSCM) mode that compares the radio environment against a saved baseline iNTERCEPT README (read 16 Oct 2026). The project had about 2,400 stars and 2,100 commits when we read it. Its README says it was developed "using AI as a coding partner".
Legal note: receive and detect only. Use it for signals meant to be public, such as ADS-B, AIS and drone Remote ID broadcasts, and to check for trackers near you. iNTERCEPT can also decode pager messages and run Wi-Fi monitor mode, which goes further. Reading private messages can be a crime. The UK is one example. There it is an offence to use radio equipment "with intent to obtain information as to the contents, sender or addressee of a message" you were not meant to receive. Disclosing such a message is an offence too Wireless Telegraphy Act 2006, s.48. The README itself says the software is "for educational and authorized testing purposes only". Check your local law first. For drones, see our drone Remote ID guide. iNTERCEPT is not a cell-site simulator detector: its README does not mention cellular networks. For that, see IMSI catchers and stingrays.
Network research connects to other OSINT areas. Use the IP address lookup for detailed IP intelligence, the domain OSINT tool for website and DNS analysis, or the threat intelligence tool for security-focused investigation.