OSINT Framework tools to open first, picked branch by branch
Nine picks from the free tree, with the branch and pricing badge for each, plus AyeWatch for alerts once a lookup becomes something to watch.
By ClaudeGPT Si Newsroom · Editorial team
· 2 min read
The OSINT Framework tools worth opening first are the free, browser-based ones in its busiest branches: WhatsMyName Web for usernames, crt.sh for domains, the Wayback Machine for old pages, TinEye for images and OpenCorporates for companies. Put AyeWatch on top of them for anything you need to follow, because the tree points you to lookups but never tells you when something changes.
How we picked
OSINT Framework lists about 1,170 links in 33 branches (as of November 2026), and every tool panel carries a status badge and a pricing badge. The picks below are marked live and free or freemium in the tree, and all but the last two work in a browser tab. The table gives the short version.
| Pick | Where it sits in the tree | Pricing badge | Runs in |
|---|---|---|---|
| AyeWatch | Not listed; the add-on for alerts | Free preview, paid from $9 a month | Browser, iOS, Android |
| WhatsMyName Web | Username | Free | Browser |
| crt.sh | Domain Name, Certificate Search | Free | Browser |
| Wayback Machine | Archives, Web | Free | Browser |
| TinEye | Disinformation & Media Verification | Freemium | Browser |
| OpenCorporates | Business Records | Freemium | Browser |
| Shodan | Domain Name and IP & MAC Address | Freemium | Browser |
| SpiderFoot | Cloud Infrastructure | Free | Local install (T) |
| Maltego | Tools | Freemium | Local install (T) |
1. AyeWatch, for what comes after the lookup
Every tool in this list answers a question once. AyeWatch asks it again for you. Give it a topic in your own words, a page to watch, or a public account on X, Reddit, YouTube, LinkedIn, Instagram or TikTok, and it reports back with a summary and the sources whenever something new turns up. It is the one we would set up first for any subject you expect to revisit.
2. WhatsMyName Web
Type a username and see which sites have an account by that name. The framework's OPSEC note says the checks run from WhatsMyName's own servers rather than from your browser.
3. crt.sh
Sectigo's free search over Certificate Transparency logs. Search a domain you are researching and the certificate list can show subdomains the main site never links to.
4. Wayback Machine
The Internet Archive's record of earlier captures by URL, with date ranges. Save Page Now stores a single page when you need proof of how it looked today.
5. TinEye
Reverse image search that finds copies and edited versions of a picture. It is free for non-commercial use, and commercial users buy access through its API.
6. OpenCorporates, with SEC EDGAR
OpenCorporates collects company records from official registries in more than 140 jurisdictions. For US public companies, the SEC's EDGAR filings sit in the same Business Records branch and cost nothing to search.
7. Shodan
A search engine for devices and services connected to the internet. Security teams use it to see what their own networks expose. It has a free account and paid plans.
8. SpiderFoot and Maltego
Both carry the (T) marker, so you install them. SpiderFoot is open source under MIT and automates many lookups in one scan. Maltego maps links between entities on a graph, with a free Basic plan and paid plans billed yearly from 3,000 euros.
When to skip this list
For a niche input such as a phone number, a vehicle or a crypto wallet, browse the matching branch yourself; a short list cannot cover 33 of them. And keep everything on public sources: follow each site's terms and the law, and do not use these tools to track private people.