OSINT Investigator’s Toolkit - Full Tool Catalogue

reference

Jump to a section:

Blockchain · Infrastructure · Email OSINT · Username · Phone OSINT · Face Search · Image OSINT · Geolocation · Breach & Exposure · Threat Intel · Documents & Metadata · Social, Twitter/X · Social, Telegram · Social, Discord · Social, Reddit · Social, Instagram/TikTok · Social, Meta · Social, LinkedIn · Social, General · Darknet · Corporate & Records · Search & Dorking · Investigator Toolkit · Additional Tracing & Attribution Platforms · Cross-Chain Bridge Explorers · Bridge Resolution APIs · Instant-Swap / Instant-Exchange Services · Additional Infrastructure & Domain OSINT · Scam & Phishing Databases · Case Documentation · Freezing, Blacklisting & Recovery · Law Enforcement Liaison & Cross-Sector Coalitions · The three-piece investigator workflow (framing) · Bridge & cross-chain explorers / utilities · Tracing / case tooling · Email / domain OSINT · Corporate Registries by Country (Europe) · OSINT Handbooks, Guides & Curated Stacks · Self-hosted chain analysis (build your own graph) · Address risk, attribution & community reports · CoinJoin coordinator discovery · Event Signature & Selector Lookup · Privacy-Coin & CoinJoin Explorers

A curated, field-tested directory of open-source intelligence tools for crypto forensics, digital investigations, and threat hunting. Catalogue version v2026.05; 170 tools across 23 categories (all entries verified 2026-05 unless a note says otherwise).

OPSEC legend: Safe = low exposure; Caution = the tool transmits/logs your query to a third party (source tag “OPSEC”); High = strong exposure (hostile-jurisdiction hosting, contact upload, face search, etc.). Tool inclusion is not endorsement; OPSEC tags are advisory, not guarantees; verify findings independently.

Blockchain (33 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
Arkham Intelligence	Entity-based blockchain intelligence with wallet attribution, alerts, and visual fund-flow.	freemium	Intermediate	Caution	Passive	Web wallet tx	platform.arkhamintelligence.com
MetaSleuth	Visual blockchain investigation tool for tracing cross-chain fund flows.	freemium	Intermediate	Caution	Passive	Web wallet tx	metasleuth.io
Breadcrumbs	Graph-based transaction visualiser with clustering and tagging.	freemium	Intermediate	Caution	Passive	Web wallet tx	breadcrumbs.app
Nansen	On-chain analytics with smart-money wallet labels across major chains.	paid	Advanced	Caution	Passive	Web wallet	nansen.ai
MistTrack	AML & address risk scoring from SlowMist; designed for compliance and investigations.	paid	Intermediate	Caution	Passive	Web wallet tx	misttrack.io
Chainalysis Reactor	Industry-standard enterprise blockchain investigation platform (LE/compliance).	enterprise	Enterprise	Caution	Passive	Web wallet tx	chainalysis.com
TRM Labs	Enterprise crypto risk and investigations platform; growing LE adoption.	enterprise	Enterprise	Caution	Passive	Web wallet tx	trmlabs.com
Elliptic Investigator	Enterprise blockchain analytics with strong UK/EU compliance footprint.	enterprise	Enterprise	Caution	Passive	Web wallet tx	elliptic.co
GraphSense	Open-source blockchain analytics platform (Iknaio/AIT). Strong alternative to commercial tools.	free	Advanced	Safe	Passive	Self-host wallet tx	graphsense.info
Bubblemaps	Visualises token holder clusters, essential for memecoin and rug investigations.	freemium	Beginner	Caution	Passive	Web wallet	bubblemaps.io
Dune Analytics	SQL-based on-chain analytics platform with thousands of community dashboards.	freemium	Advanced	Caution	Passive	Web/SQL wallet tx	dune.com
Lookonchain	Curated on-chain investigation feed (whales, exploits, suspicious flows).	free	Beginner	Safe	Passive	Web wallet	lookonchain.com
Etherscan	Canonical Ethereum explorer; transactions, contracts, tokens, labels.	free	Beginner	Caution	Passive	Web wallet tx	etherscan.io
Blockchair	Multi-chain explorer & search engine (BTC, ETH, BCH, LTC and more).	free	Beginner	Caution	Passive	Web wallet tx	blockchair.com
OKLink Explorer	Multi-chain explorer with address tagging and tracing tools.	free	Beginner	Caution	Passive	Web wallet tx	oklink.com
Solscan	Solana explorer and analytics dashboard.	free	Beginner	Caution	Passive	Web wallet tx	solscan.io
Subscan (Polkadot)	Polkadot / Kusama / parachain explorer.	free	Beginner	Caution	Passive	Web wallet tx	subscan.io
TronScan	TRON explorer; vital for USDT-TRC20 investigations.	free	Beginner	Caution	Passive	Web wallet tx	tronscan.org
Mempool.space	Bitcoin mempool intelligence, fee analytics, and address explorer.	free	Intermediate	Safe	Passive	Web wallet tx	mempool.space
Whale Alert	Tracks large on-chain transactions and exchange movements in real time.	free	Beginner	Safe	Passive	Web/Twitter wallet	whale-alert.io
Bitquery	Comprehensive on-chain data API and explorer across many blockchains.	freemium	Advanced	Caution	Passive	API/Web wallet tx	bitquery.io
DEXTools	Real-time DEX trading data, wallet tracking, and liquidity analysis.	freemium	Beginner	Caution	Passive	Web wallet	dextools.io
Tenderly	Smart contract debugger and transaction simulator.	freemium	Advanced	Caution	Passive	Web wallet tx hash	tenderly.co
BlockSec Phalcon	Transaction explorer with attack detection and post-exploit analysis.	free	Advanced	Caution	Passive	Web tx wallet	phalcon.blocksec.com
GoPlus Security	Token & contract risk API/UI. Useful for fast scam screening.	freemium	Intermediate	Safe	Passive	API/Web wallet	gopluslabs.io
Webacy	Wallet risk scoring and threat exposure analysis.	freemium	Beginner	Caution	Passive	Web wallet	webacy.com
Chainabuse	Community scam/abuse reports across major chains.	free	Beginner	Safe	Passive	Web wallet	chainabuse.com
ScamSniffer	Phishing & scam address tracker across multiple chains.	freemium	Intermediate	Caution	Passive	Web/Extension wallet domain	scamsniffer.io
OFAC SDN Search	US Treasury Specially Designated Nationals list, sanctions screening (incl. crypto addresses).	free	Intermediate	Safe	Passive	Web wallet	sanctionssearch.ofac.treas.gov
OpenSanctions	Aggregated sanctions, PEP, and watchlist data with crypto address coverage.	free	Intermediate	Safe	Passive	Web/API wallet	opensanctions.org
Revoke.cash	Audit and revoke ERC-20/721 approvals. Defensive, use with caution post-incident.	free	Beginner	Caution	Active	Web wallet	revoke.cash
Zapper	Portfolio and DeFi position visualiser; useful for mapping interactions.	freemium	Beginner	Caution	Passive	Web wallet	zapper.xyz
Blockchain.com Explorer	BTC/ETH explorer for transactions and addresses.	free	Beginner	Caution	Passive	Web wallet tx	blockchain.com

Infrastructure (20 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
Shodan	Search engine for internet-connected devices; surfaces open ports, banners, services.	freemium	Intermediate	Caution	Passive	Web/API ip domain	shodan.io
Censys	Internet-wide host and certificate search; mapping exposed assets.	freemium	Intermediate	Caution	Passive	Web/API ip domain hash	search.censys.io
FOFA	Chinese internet asset search engine. Often surfaces assets Shodan/Censys miss.	freemium	Intermediate	High	Passive	Web ip domain	en.fofa.info	Hosted in China; OPSEC-sensitive.
ZoomEye	Alternative internet asset search engine. Complementary visibility to Shodan.	freemium	Intermediate	High	Passive	Web ip domain	zoomeye.org	Hosted in China; OPSEC-sensitive.
Criminal IP	Threat-scored IP/asset search engine with risk indicators.	freemium	Intermediate	Caution	Passive	Web/API ip domain	criminalip.io
GreyNoise	Distinguishes targeted scans from internet background noise. SOC essential.	freemium	Intermediate	Safe	Passive	Web/API ip	greynoise.io
urlscan.io	Sandboxed URL analysis: DOM, screenshot, requests, certs, ASN. Critical tool.	freemium	Beginner	Caution	Passive	Web/API domain	urlscan.io	Public scans are visible to others, use private mode for sensitive cases.
crt.sh	Certificate transparency log search; subdomain enumeration goldmine.	free	Intermediate	Safe	Passive	Web domain	crt.sh
SecurityTrails	Historical DNS, subdomains, WHOIS, gold standard for infrastructure pivoting.	freemium	Intermediate	Safe	Passive	Web/API domain ip	securitytrails.com
DNSDumpster	Passive DNS recon for subdomain discovery and infrastructure mapping.	free	Beginner	Safe	Passive	Web domain	dnsdumpster.com
ViewDNS.info	Multi-tool DNS suite: reverse IP, DNS history, port checks, propagation.	freemium	Beginner	Caution	Passive	Web domain ip	viewdns.info
IPinfo	IP geolocation, ASN, ISP, hostname enrichment with API.	freemium	Beginner	Safe	Passive	Web/API ip	ipinfo.io
AbuseIPDB	Community-reported IP abuse database with reputation scoring.	freemium	Beginner	Safe	Passive	Web/API ip	abuseipdb.com
RIPE / ARIN / APNIC / LACNIC / AFRINIC	Regional internet registries for IP allocation and registrant lookup.	free	Beginner	Safe	Passive	Web WHOIS ip	iana.org
Netcraft Site Report	Site profiling: hosting, tech stack, history, phishing/malware flags.	free	Beginner	Caution	Passive	Web domain	sitereport.netcraft.com
SpiderFoot	Automated OSINT recon and attack surface mapping from many sources.	freemium	Intermediate	Caution	Active	Python/Self-host domain ip email	spiderfoot.net
Maltego	Visual link analysis platform with transforms for entity mapping.	freemium	Advanced	Caution	Passive	Desktop domain ip email	maltego.com
theHarvester	Email/subdomain/host collection from public sources (CLI).	free	Intermediate	Caution	Active	Python CLI domain	github.com
Amass	OWASP attack surface mapping & external asset discovery.	free	Advanced	Caution	Active	CLI domain	github.com
ProjectDiscovery Suite	subfinder, httpx, katana, nuclei, modern recon CLI toolkit.	free	Advanced	Caution	Active	CLI domain ip	projectdiscovery.io

Email OSINT (7 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
Hunter.io	Email-finding service: domain to verified addresses, with role/firm metadata.	freemium	Beginner	Caution	Passive	Web/API email domain	hunter.io
Epieos	Email/phone reverse lookup; pulls Google services, Skype, recovery hints.	freemium	Beginner	Caution	Passive	Web email phone	epieos.com
EmailRep.io	Email reputation & risk lookup. Reveals known leaks, services seen, suspicious profile.	freemium	Beginner	Safe	Passive	Web/API email	emailrep.io
Holehe	CLI: checks if an email is used on 120+ sites without alerting the user.	free	Intermediate	Caution	Passive	Python CLI email	github.com
Mosint	Automated email OSINT framework chaining many sources.	free	Intermediate	Caution	Passive	Go CLI email	github.com
Castrick Clues	Combined identifier lookup (email, phone, username) with helpful pivots.	free	Beginner	Safe	Passive	Web email phone username	castrickclues.com
EmailHippo	Email validation and risk scoring.	freemium	Beginner	Safe	Passive	Web/API email	tools.emailhippo.com

Username (4 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
WhatsMyName	Up-to-date username discovery across hundreds of sites. Modern Sherlock alternative.	free	Beginner	Caution	Passive	Web/JSON username	whatsmyname.app
Sherlock	CLI username search across many platforms. Stale on newer sites, pair with WhatsMyName.	free	Intermediate	Caution	Passive	Python CLI username	github.com
Maigret	Username search with profile parsing; more sources than Sherlock.	free	Intermediate	Caution	Passive	Python CLI username	github.com
Namechk	Username availability across many platforms.	free	Beginner	Safe	Passive	Web username	namechk.com

Phone OSINT (5 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
PhoneInfoga	Phone-number recon: format, carrier, footprint across OSINT sources.	free	Intermediate	Caution	Passive	Go CLI phone	github.com
Truecaller	Crowdsourced caller-ID and reverse phone lookup. OPSEC warning: app uploads your contacts.	freemium	Beginner	High	Passive	Mobile/Web phone	truecaller.com	App uploads your address book by default. Use only on a burner identity.
NumLookup	Web-based reverse phone lookup with CNAM/carrier info.	free	Beginner	Safe	Passive	Web phone	numlookup.com
Sync.Me	Reverse lookup and spam-id services for phone numbers.	freemium	Beginner	Caution	Passive	Web/Mobile phone	sync.me
IPQualityScore	Phone/IP/email fraud scoring with risk indicators.	freemium	Intermediate	Safe	Passive	Web/API phone ip email	ipqualityscore.com

Face Search (4 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
PimEyes	Facial-recognition search across public web. Powerful and ethically fraught, use responsibly.	paid	Advanced	High	Passive	Web image	pimeyes.com	Ethically sensitive. Subject consent and jurisdiction matter.
FaceCheck.ID	Aggressive face search engine; often finds matches PimEyes misses.	freemium	Advanced	High	Passive	Web image	facecheck.id
Search4Faces	Face search optimised for VK and Eastern European sites.	freemium	Advanced	High	Passive	Web image	search4faces.com
OSINT.Industries	Real-time identity enrichment across many platforms. Strong phone/email/username modules.	paid	Intermediate	Caution	Passive	Web email phone username	osint.industries

Image OSINT (7 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
InVID/WeVerify	Industry standard verification toolkit: keyframes, magnifier, metadata, reverse-image.	free	Intermediate	Safe	Passive	Browser extension image	weverify.eu
Forensically	Web image forensics: ELA, clone detection, noise/metadata analysis.	free	Intermediate	Safe	Passive	Web image	29a.ch
Google Lens / Reverse Image	Broad reverse-image search; strongest for objects and recent web content.	free	Beginner	Caution	Passive	Web image	images.google.com
Yandex Images	Best reverse-image engine for faces and Eastern-European content. OPSEC-sensitive.	free	Intermediate	High	Passive	Web image	yandex.com	Russian infrastructure; consider a clean browser profile.
TinEye	Image-origin and duplicate finder. Strongest ‘oldest seen’ pivot.	freemium	Beginner	Safe	Passive	Web image	tineye.com
Bing Visual Search	Microsoft’s reverse image search; strong for landmarks and products.	free	Beginner	Caution	Passive	Web image	bing.com
Aperisolve	Layered steganography analysis: zsteg, steghide, exiftool, binwalk in one.	free	Intermediate	Caution	Passive	Web image	aperisolve.com

Geolocation (16 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
GeoSpy.ai	AI-powered photo geolocation. 2025-26 game-changer; verify with shadow/weather data.	freemium	Intermediate	Caution	Passive	Web image	geospy.ai
Picarta.ai	Neural-network image geolocation; complementary to GeoSpy.	freemium	Intermediate	Caution	Passive	Web/API image	picarta.ai
Google Earth Pro	High-res satellite imagery, 3D terrain, historical layers.	free	Intermediate	Safe	Passive	Desktop	google.com
Sentinel Hub Playground	Free Copernicus Sentinel satellite imagery, often more recent than Google.	free	Intermediate	Safe	Passive	Web	sentinel-hub.com
Mapillary	Crowdsourced street-level imagery, useful where Street View is limited.	free	Intermediate	Caution	Passive	Web	mapillary.com
OpenStreetMap + Overpass Turbo	Query OSM data for specific features (e.g. churches with red roofs in 2km).	free	Advanced	Safe	Passive	Web	overpass-turbo.eu
SunCalc	Sun/shadow position calculator for verifying photo timestamps.	free	Intermediate	Safe	Passive	Web	suncalc.org
Shadow Finder (Bellingcat)	Automated shadow-to-time geolocation analysis.	free	Intermediate	Safe	Passive	Web image	shadowfinder.streamlit.app
Ventusky	Historical weather verification; cross-check claims of rain/wind/temperature.	free	Beginner	Safe	Passive	Web	ventusky.com
ADSBexchange	Unfiltered ADS-B flight tracking; does not block ‘blocked’ tail numbers.	freemium	Intermediate	Safe	Passive	Web	adsbexchange.com
FlightRadar24	Mainstream flight tracking with strong historical playback.	freemium	Beginner	Caution	Passive	Web	flightradar24.com
MarineTraffic	Vessel tracking with AIS data and port-call history.	freemium	Beginner	Caution	Passive	Web	marinetraffic.com
VesselFinder	Alternative maritime tracker; sometimes covers vessels MarineTraffic misses.	freemium	Beginner	Caution	Passive	Web	vesselfinder.com
Strava Heatmap	Global activity heatmap. Famously useful for sensitive-site discovery.	free	Intermediate	Safe	Passive	Web	strava.com
WiGLE.net	Crowdsourced Wi-Fi network database; geolocate by SSID/BSSID.	freemium	Intermediate	Safe	Passive	Web/API	wigle.net
Wikimapia	Collaborative map annotations. Coverage uneven but unique.	free	Beginner	Safe	Passive	Web	wikimapia.org

Breach & Exposure (8 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
Have I Been Pwned	Authoritative breach database for email/phone with notifications.	freemium	Beginner	Safe	Passive	Web/API email phone	haveibeenpwned.com
DeHashed	Large searchable breach DB. Investigator-favourite, paid tiers.	paid	Advanced	Caution	Passive	Web/API email phone username	dehashed.com
Snusbase	Searchable breach data and paste sites.	paid	Advanced	Caution	Passive	Web email username ip	snusbase.com
LeakCheck.io	Modern, fast breach search alternative to DeHashed.	paid	Intermediate	Caution	Passive	Web/API email username phone	leakcheck.io
Leak-Lookup	Competitor to DeHashed; different coverage. Use both.	freemium	Intermediate	Caution	Passive	Web email username	leak-lookup.com
Intelligence X	Archive + search engine for leaks, pastes, darknet, and historical content.	freemium	Intermediate	Caution	Passive	Web email domain phone	intelx.io
HudsonRock Cavalier	Stealer-log intel. The 2024-26 evolution of breach data, essential.	freemium	Advanced	Caution	Passive	Web/API email domain username	hudsonrock.com
Constella Intelligence	Enterprise identity exposure intel; used by enterprise IR teams.	enterprise	Enterprise	Safe	Passive	Web email username phone	constellaintelligence.com

Threat Intel (10 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
VirusTotal	Aggregated malware/URL/IP/hash intelligence across 70+ engines.	freemium	Beginner	Caution	Passive	Web/API domain ip hash	virustotal.com	Uploads become visible to VT community/customers.
AlienVault OTX	Open Threat Exchange: pulses, IOCs, passive DNS.	free	Beginner	Safe	Passive	Web/API domain ip hash	otx.alienvault.com
MISP	Open-source threat intelligence platform, self-hosted IOC sharing.	free	Advanced	Safe	Passive	Self-host domain ip hash	misp-project.org
Abuse.ch (URLhaus, ThreatFox, MalwareBazaar, FeodoTracker)	Industry-essential malware/phishing/IOC feeds.	free	Intermediate	Safe	Passive	Web/API domain ip hash	abuse.ch
Pulsedive	Threat intelligence search and enrichment.	freemium	Intermediate	Safe	Passive	Web/API domain ip hash	pulsedive.com
ThreatMiner	Free threat-intel search with passive DNS and malware context.	free	Intermediate	Safe	Passive	Web domain ip hash	threatminer.org
Hybrid Analysis	CrowdStrike-backed public malware sandbox.	freemium	Intermediate	Caution	Passive	Web hash domain	hybrid-analysis.com
Joe Sandbox	Deep malware sandbox with strong reporting (community + paid).	freemium	Advanced	Caution	Passive	Web hash	joesandbox.com
ANY.RUN	Interactive malware sandbox, you drive the VM in-browser.	freemium	Advanced	Caution	Active	Web hash domain	app.any.run
MS Defender Threat Intelligence	Formerly RiskIQ PassiveTotal, passive DNS, WHOIS history, crawled web.	freemium	Advanced	Safe	Passive	Web/API domain ip	ti.defender.microsoft.com

Documents & Metadata (8 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
ExifTool	The standard CLI for reading/writing metadata across images, docs, files.	free	Intermediate	Safe	Passive	CLI image hash	exiftool.org
Metagoofil	Scrape and extract metadata from documents hosted on a target domain.	free	Intermediate	Caution	Active	Python CLI domain	github.com
MAT2	Metadata anonymisation, strip identifying data before publishing files.	free	Intermediate	Safe	Passive	CLI	0xacab.org
pdfid / pdf-parser	Inspect PDF structure: scripts, embedded objects, suspicious elements.	free	Advanced	Safe	Passive	Python CLI hash	blog.didierstevens.com
Tesseract OCR	Open-source OCR engine for images and scanned PDFs.	free	Intermediate	Safe	Passive	CLI image	github.com
OCRmyPDF	Adds a searchable OCR text layer to scanned PDFs.	free	Intermediate	Safe	Passive	Python CLI	github.com
Tabula	Extract tables from PDFs into CSV/Excel.	free	Beginner	Safe	Passive	Desktop	tabula.technology
MediaInfo	Detailed metadata for audio and video files.	free	Beginner	Safe	Passive	Desktop/CLI	mediaarea.net

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
Twitter/X Advanced Search	Operators for from/to/since/until, language, geocode, exact phrases.	free	Beginner	Caution	Passive	Web username	twitter.com
Memory.lol	Historical handle to user ID mapping; recover renamed/deleted accounts.	free	Intermediate	Safe	Passive	Web username	memory.lol
Communalytic	Academic-grade Twitter/X (and Reddit, Telegram) community analysis.	freemium	Advanced	Safe	Passive	Web	communalytic.org

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
TGStat	Telegram channel analytics, search, and trend tracking.	freemium	Intermediate	Caution	Passive	Web username	tgstat.com
Telegago (CSE)	Google Custom Search Engine focused on indexed Telegram content.	free	Beginner	Safe	Passive	Web	cse.google.com
Lyzem	Telegram public channel/message search engine.	free	Beginner	Caution	Passive	Web	lyzem.com
Telemetr.io	Channel statistics, audience overlap, growth tracking.	freemium	Intermediate	Caution	Passive	Web	telemetr.io
Telepathy	CLI for archival, scraping, and analysis of public Telegram channels.	free	Advanced	Caution	Active	Python CLI username	github.com	Active scraping; use a sock-puppet Telegram account.

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
Discord.id	Discord user ID lookup and timestamp inference.	free	Beginner	Safe	Passive	Web username	discord.id
DISBOARD	Public Discord server directory with search.	free	Beginner	Safe	Passive	Web	disboard.org

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
Camas (Reddit)	Recover deleted Reddit posts/comments via Pushshift-style archives.	free	Beginner	Safe	Passive	Web username	camas.unddit.com
Redective	Reddit user analytics: subreddit activity, posting patterns.	free	Beginner	Safe	Passive	Web username	redective.com

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
Imginn	Browse public Instagram profiles without an account; story/post archive.	free	Beginner	Caution	Passive	Web username	imginn.com
Picuki	Anonymous Instagram viewer and search.	free	Beginner	Caution	Passive	Web username	picuki.com

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
WhoPostedWhat	Date-bounded Facebook keyword search via Graph search techniques.	free	Intermediate	Caution	Passive	Web	whopostedwhat.com	Coverage degraded since Graph search removals.

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website	Notes
Crosslinked	Generate LinkedIn employee permutations for further enumeration.	free	Intermediate	High	Active	Python CLI domain	github.com	Uses Google scraping, burn account required.

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
Shadow Dragon	Enterprise OSINT platform for digital investigations.	paid	Intermediate	Caution	Passive	Web email phone username	shadowdragon.io
Shadow Dragon FREE Tools	Free supplementary OSINT tools from Shadow Dragon.	free	Beginner	Safe	Passive	Web	shadowdragon.io
Social Searcher	Real-time multi-platform social search for keywords and mentions.	freemium	Beginner	Caution	Passive	Web username	social-searcher.com

Darknet (4 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
Ahmia	Clearnet search engine for .onion sites; safe research entry point.	free	Beginner	Caution	Passive	Web	ahmia.fi
Tor Metrics	Official Tor network statistics: relays, exits, bandwidth.	free	Intermediate	Safe	Passive	Web	metrics.torproject.org
Onion.live	Onion service directory with uptime tracking.	free	Intermediate	Caution	Passive	Web	onion.live
Hunchly	Forensic web-capture browser tool with chain-of-custody. Strong for darknet investigations.	paid	Intermediate	Safe	Passive	Desktop	hunch.ly

Corporate & Records (6 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
OpenCorporates	Largest open database of corporate entities globally.	freemium	Beginner	Safe	Passive	Web/API	opencorporates.com
SEC EDGAR	US public company filings, primary source for listed-entity research.	free	Intermediate	Safe	Passive	Web	sec.gov
Companies House (UK)	UK official company registry with full filing history.	free	Beginner	Safe	Passive	Web/API	find-and-update.company-information.service.gov.uk
GLEIF (LEI Search)	Global Legal Entity Identifier search, links companies across jurisdictions.	free	Intermediate	Safe	Passive	Web	search.gleif.org
ICIJ Offshore Leaks DB	Panama/Pandora/Paradise Papers searchable database.	free	Intermediate	Safe	Passive	Web	offshoreleaks.icij.org
OpenSanctions (Corporate)	Sanctions, PEPs, watchlists, aggregated and queryable.	free	Intermediate	Safe	Passive	Web/API	opensanctions.org

Search & Dorking (8 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
Google Hacking Database	Canonical Google dork repository. Many dorks are stale, verify before relying.	free	Beginner	Caution	Passive	Web	exploit-db.com
DorkSearch	Web app to construct Google dorks with suggestions.	free	Beginner	Caution	Passive	Web	dorksearch.com
Marginalia Search	Non-SEO indie web search; surfaces content Google buries.	free	Beginner	Safe	Passive	Web	search.marginalia.nu
Wayback Machine	Internet Archive, historical snapshots of websites.	free	Beginner	Safe	Passive	Web domain	web.archive.org
Archive.today	On-demand archival of pages; bypasses some paywalls and JS.	free	Beginner	Safe	Passive	Web domain	archive.ph
GDELT Project	Global event/news/tone analytics across thousands of sources.	free	Advanced	Safe	Passive	Web/API	gdeltproject.org
Wayback Google Analytics	Bellingcat tool, pulls historical GA/GTM IDs from Wayback to pivot to other sites.	free	Intermediate	Safe	Passive	Python CLI domain	github.com
AnalyzeID	Pivot on GA/AdSense IDs, WHOIS, registrant emails across sites.	freemium	Beginner	Caution	Passive	Web domain	analyzeid.com

Investigator Toolkit (11 tools)

Tool	Description	Cost	Skill	OPSEC	Mode	Accepts	Website
Tor Browser	Anonymity browser; baseline OPSEC tool for sensitive research.	free	Beginner	Safe	Passive	Desktop	torproject.org
Whonix	VM-based OPSEC environment forcing all traffic through Tor.	free	Advanced	Safe	Passive	VM	whonix.org
Tails	Amnesic live OS routing all traffic through Tor. Strong baseline OPSEC.	free	Advanced	Safe	Passive	Live OS	tails.boum.org
Tracelabs OSINT VM	Curated OSINT VM (the modern successor to Buscador).	free	Intermediate	Safe	Passive	VM	tracelabs.org
EFF Cover Your Tracks	Browser fingerprinting test, verify your OPSEC browser is uniqueness-resistant.	free	Beginner	Safe	Passive	Web	coveryourtracks.eff.org
OSINT Framework	Massive curated directory of OSINT resources by category.	free	Beginner	Safe	Passive	Web directory	osintframework.com
Scrapy	Python framework for building scalable web scrapers.	free	Advanced	Caution	Active	Python framework	scrapy.org
Playwright	Modern browser automation, replaces Selenium for most use cases.	free	Intermediate	Caution	Active	Library	playwright.dev
Beautiful Soup	Python HTML parser; building block for custom scrapers.	free	Intermediate	Safe	Passive	Python library	crummy.com
Apify	Cloud scraping/automation platform with prebuilt actors for many sites.	freemium	Intermediate	Caution	Active	Cloud	apify.com
IOC Web Scraper	Intelligence on Chain’s open-source scraping framework, links & images.	free	Advanced	Caution	Active	Python framework domain	github.com

Consolidated additions

Merged from the BlockchainUnmasked article “The Investigator’s Stack: The Tools Every Team Should Know” (2026-06). These extend the catalogue above with tracers, bridge/swap explorers, scam databases, and a Freezing/Recovery category the base catalogue did not cover. Lighter column schema (no OPSEC/Skill ratings invented for these entries).

Additional Tracing & Attribution Platforms

Tool	What it does	Access	Website	Notes
Global Ledger	Proprietary tracer with strong datasets & attribution	paid	globalledger.io	Praised for clean UI, node customization, color-coding (graph readability)
CipherOwl	Tracer that adds counterparties directly onto the graph	paid	cipherowl.ai	Paste a node and it auto-connects to others on the canvas
Crystal Intelligence	Institutional analytics	enterprise	crystalintelligence.com	Cross-chain coverage, behavioral typologies
Merkle Science	Institutional analytics	enterprise	merklescience.com	Cross-chain coverage, behavioral typologies
Nominis	Proactive entity tagging/labelling	freemium/paid	nominis.io	”Shadow Intelligence” links Web3->Web2 footprints; depth on terrorism data

Cross-Chain Bridge Explorers

Tool	What it does	Access	Website	Notes
Range Cross-Chain Explorer	Single view across many bridges	freemium	range.org	Stitch a source-chain tx to its destination leg
NEAR Intents Explorer	Intent/solver bridge explorer (31+ chains)	free web; API needs JWT	explorer.near-intents.org	Keyed by settlement tx; resolves source chain/asset + deposit tx + user intent account. Solver acct is NOT the suspect
Bridge Explorer (unbridge)	Free multi-bridge correlation	free	unbridge.xyz
Wormholescan	Wormhole bridge explorer	free	wormholescan.io
LayerZeroScan	LayerZero messaging explorer	free	layerzeroscan.com
deBridge Explorer	deBridge transfers	free	explorer.debridge.finance
THORChain / Runescan	THORChain swaps	free	thorchain.net / runescan.io
Mayan Explorer	Mayan cross-chain swaps	free	explorer.mayan.finance	Mayan swaps emit Wormhole VAAs, so they also resolve on Wormholescan
Allbridge	Allbridge transfers	free	allbridge.io	Core explorer at core.allbridge.io/explorer; search by sender, recipient, tx or transfer ID
Axelarscan	Axelar general message passing	free	axelarscan.io	message_id = source tx hash + log index, from the Gateway ContractCall event. Squid routes resolve here too
Circle CCTP (CCTPScan)	Native USDC burn-and-mint transfers	free	developers.circle.com	The cleanest bridge to trace. DepositForBurn + MessageSent -> MintAndWithdraw. V1 and V2 use separate contracts and nonce spaces
Synapse Explorer	Synapse liquidity-network transfers	free	explorer.synapseprotocol.com	GraphQL. Liquidity network, so match amount minus fee and timestamp. Lookalike front ends circulate: use this domain only
Hop Explorer	Hop transfers	free	explorer.hop.exchange	Extract the TransferSent event and its transferId
Celer cBridge	cBridge transfers	free	cbridge.celer.network	transferId (keccak256). Status API returns both legs in one response, see Bridge Resolution APIs
Across	Intent/solver bridge fills	free	across.to	V3FundsDeposited -> FilledV3Relay (V4 renamed both). The relayer fronts the funds: the destination payer is the solver, NOT the suspect
Socketscan (Socket/Bungee)	Aggregator route lookup	free	socketscan.io	Confirm the current post-rebrand domain. Do NOT treat the aggregator as the bridge: identify each leg’s underlying bridge
LI.FI / Jumper status	Meta-router status by tx hash	free	li.fi / jumper.exchange	Returns PENDING/DONE/FAILED/PARTIAL/REFUNDED. PARTIAL and REFUNDED flag a failed hop that may have returned funds to a DIFFERENT address
Orbiter Explorer	L2-to-L2 Maker-model transfers	free	explorer.orbiter.finance	No event log to parse: transfers go to a Maker EOA. Routing is encoded in the trailing digits of the amount, so preserve full precision
Chainflip Scan	Native cross-chain DEX swaps	free	scan.chainflip.io	Swap ID + deposit channel, e.g. 6543210-Ethereum-1933. Intent-style, so vendor coverage is weak
Everclear Explorer	Intent-based clearing (ex-Connext)	free	explorer.everclear.org	intentId + Hyperlane message_id; cross-check the Hyperlane explorer. Legacy: connextscan.io
Hyperlane Explorer	Interchain messaging	free	explorer.hyperlane.xyz	message ID = keccak256(message) via Mailbox.dispatch. Often the transport layer BENEATH another protocol: identify what is riding on it
Chainlink CCIP Explorer	CCIP messages and token transfers	free	ccip.chain.link	messageId generated on the source chain; shows both legs and status
Mintscan	Cosmos IBC packets	free	mintscan.io	Packet sequence + channel IDs, port “transfer”. The denom encodes the path (transfer/channel-X), so multi-hop routes reconstruct from the denom alone
Nine Realms THORChain tracker	THORChain swap tracking	free	track.ninerealms.com	Paired with the Midgard and THORNode APIs below

~80-90% of bridge use is ordinary infrastructure, not obfuscation. Most bridges maintain their own dedicated explorer, search the bridge name.

Vendor tools auto-resolve the deterministic message-identifier bridges (Wormhole, CCTP, LayerZero/Stargate, Axelar, CCIP, IBC, native rollup bridges). Coverage is weak or absent for intent/solver bridges (Across, deBridge, Chainflip, Relay, Everclear), where the legs are linked only by an off-chain order ID: a vendor tool showing no link does not mean no link exists. Full breakdown: “Operational Tracing Runbook: Live Mixers Bridges and No-KYC Swaps” (04-laundering-obfuscation).

Bridge Resolution APIs

Programmatic endpoints that bind a source leg to a destination leg. Prefer these over screenshots where you can: the raw JSON response is a citable, reproducible exhibit, and several dead bridges prove you cannot re-derive what you did not capture.

API / endpoint	What it returns	Access	Where	Notes
Circle Iris attestation API	The attestation for a CCTP message hash, binding burn to mint	free	developers.circle.com	Hash the MessageSent body to get the message hash, then resolve. Confirm V1 vs V2 for your period
cBridge status API	Source AND destination block tx links in one response	free	cbridge-docs.celer.network	POST the transfer_id. One of the cleanest single-response exhibits available from any bridge
LayerZero Scan API	GUID, DVN set, executor, destination tx, delivery status	free	layerzeroscan.com	Query by source tx hash. Note the v1 to v2 transition when working historical periods
Wormholescan global transaction endpoint	VAA lookup by (emitter_chain, emitter_address, sequence)	free	wormholescan.io	Also resolves Mayan swaps. Token Bridge yields a wrapped asset, NTT yields native
THORNode API	Current and historical Asgard inbound vault addresses	free	thornode.ninerealms.com	`/thorchain/inbound_addresses`. Vaults churn circa every 3 days, so NEVER cache a vault address: resolve it for the relevant date
Midgard API	THORChain swap records linking inbound to outbound	free	midgard.ninerealms.com	Often the only reliable link: the legs are separate txs on different chains joined only by THORChain state. Read the memo, which frequently carries the destination address in clear text
deBridge DLN stats / orders API	Order records searchable by tx, sender or receiver	free	app.debridge.finance/orders	Deterministic orderId. The destination filler is a solver, not the subject
Across API	depositId, originChainId, indexed relayer	free	across.to	Confirm the contract version: V4 renamed the deposit and fill events
Synapse explorer GraphQL	Transfers by tx hash, chain and token	free	explorer.synapseprotocol.com	Liquidity network, so match amount minus fee and timestamp rather than following a coin
Relay API	Order records	free	relay.link	No public event schema verified, so treat the API record as the primary artefact and corroborate on amount and timing
LI.FI status endpoint	Route status + explorer link for the underlying leg	free	li.fi	Then trace the underlying bridge leg with that bridge’s own identifier logic

Instant-Swap / Instant-Exchange Services

Increasingly an obfuscation layer of choice; several are cooperative with investigators and LE. See “Cooperating Instant Exchanges as Pivot Points” (02-tracing).

Tool	What it does	Access	Website	Notes
FixedFloat	No-account instant swap	open	fixedfloat.com	Common obfuscation hop
ChangeNOW	Instant swap	open	changenow.io	Cooperative in many cases
Changelly	Instant swap	open	changelly.com
SimpleSwap	Instant swap	open	simpleswap.io

Additional Infrastructure & Domain OSINT

Tool	What it does	Access	Website	Notes
Silent Push	Domain/infrastructure intelligence	freemium	silentpush.com
DomainTools	WHOIS, historical & reverse WHOIS	paid	domaintools.com
WhoisXML API	WHOIS/DNS data via API	freemium	whoisxmlapi.com
Netlas	Internet asset scan engine	freemium	netlas.io	Second pass when Shodan/Censys come up short
Validin	Pivot on favicon/CSS/HTML hashes, TLS/JARM, HTTP banners, passive DNS to cluster domains	freemium	validin.com	Favorite for infra clustering; one reused favicon can crack a phishing network
BuiltWith	Tech-stack & analytics-ID fingerprinting	freemium	builtwith.com	Surfaces GA/tracking IDs operators forget to scrub
Wappalyzer	Tech-stack detection	freemium	wappalyzer.com

Scam & Phishing Databases

Cross-reference artifacts against reported data. (Chainabuse, ScamSniffer, and URLhaus already appear in the catalogue above.)

Tool	What it does	Access	Website
GASO (Global Anti-Scam Org)	Reported scam domains & infrastructure	free	globalantiscam.org
PhishDestroy	Phishing & wallet-drainer intelligence	free	phishdestroy.io
CryptoScamDB	Crypto scam address/domain database	free	cryptoscamdb.org
ScamAdviser	Website trust / scam scoring	free	scamadviser.com
PhishTank	Community phishing URL database	free	phishtank.org
OpenPhish	Phishing feed	freemium	openphish.com

Case Documentation

(Hunchly and Maltego already appear in the catalogue above.)

Tool	What it does	Access	Website	Notes
Obsidian	Local-first linked-markdown case notes	free	obsidian.md	See “Obsidian Case-Management Workflow” (06-casework-method)
Notion	Structured case notes / collaboration	freemium	notion.com	Cloud-hosted, mind OPSEC for sensitive cases

Freezing, Blacklisting & Recovery

Investigators/LE drive the reporting, blacklisting, and freezing half (in partnership with LE); recovery sits with LE and specialist firms. Freezes are actioned at law-enforcement request.

Tool / Channel	What it does	Access	Website	Notes
Tether (USDT issuer freeze)	Token-level freeze of USDT	LE request	tether.to	Route the request to the issuer directly or via the right intermediary
Circle (USDC issuer freeze)	Token-level freeze of USDC	LE request	circle.com
T3 Financial Crime Unit (T3 FCU)	Tether/TRON/TRM initiative; freezes illicit USDT-on-TRON, often within 24h	LE request	t3fcu.org	T3+ brings exchanges into real-time coordination; the channel for USDT-on-TRON
TRM Beacon Network	Real-time network to coordinate freezing stolen funds during a live incident	free for verified LE & exchanges	trmlabs.com	Speed-oriented
Exchange LE portals	Dedicated law-enforcement request channels at major exchanges	verified LE	,	Learn each exchange’s “front door”
MistTrack stablecoin blacklist lookup	Check whether an address is already frozen/blacklisted	free	misttrack.io	Quick pre-check before chasing
Deconflict	Tells you whether another agency is already working the wallet/case	verified LE only	deconflict.com	Avoids duplicated effort / colliding with a live op
Kodex	Secure, auditable data requests from agencies to exchanges/institutions; verifies LE-agent identity against a global network (roughly 15k agencies, 140k+ agents, 190 countries) to block fraudulent requests	verified LE / institutions	kodexglobal.com	Founded 2020 by former FBI agent Matt Donahue; used by major exchanges (Coinbase, Crypto.com). Also under “Law Enforcement Liaison & Cross-Sector Coalitions” below. Verified 2026-07-12
Asset Reality	Specialist asset recovery & management	firm	assetreality.com	Recovery-side
DigitalMint	Recovery / ransom-settlement services	firm	digitalmint.io	Recovery-side

Law Enforcement Liaison & Cross-Sector Coalitions

Bodies and channels that connect investigators, the private sector, and law enforcement to share intelligence, make warm introductions, deconflict, and route requests. See “Working with Law Enforcement: Capacity, Speed, and Cross-Sector Coalitions” (05-evidence-legal). Kodex, Deconflict, and T3 FCU also appear under “Freezing, Blacklisting & Recovery” above.

Org / Channel	What it is	Access	Website	Notes
Operation Shamrock	Nonprofit coalition uniting law enforcement, industry, and the public to disrupt pig-butchering scams; founded by former Santa Clara DDA Erin West. Runs the “Crypto Coalition”, a 2,400+ member network of local/state/federal/international partners sharing crypto crime-fighting technique	free / membership (Coalition is verified LE)	operationshamrock.org	Verified 2026-07-12
IAFCI	International Association of Financial Crimes Investigators. 501(c)(6) global body of public and private financial-crime, fraud, cyber, and LE professionals; intelligence exchange, chapters, conferences, and certifications. Lineage: ACCI 1968, IACCI 1974, renamed IAFCI 1996	membership	iafci.org	Verified 2026-07-12
Kodex	Verified LE-to-institution request channel (see “Freezing, Blacklisting & Recovery” above)	verified LE / institutions	kodexglobal.com	Cross-listed

The three-piece investigator workflow (framing)

Every investigation breaks into three pieces (per the stack article):

Investigation & Tracing, heavyweights (TRM, Chainalysis, Elliptic) + next-tier tracers (Global Ledger, CipherOwl, MistTrack) + freemium graphs (Breadcrumbs, MetaSleuth) + free attribution/clustering (Arkham, Bubblemaps) + base-layer explorers (Etherscan, OKLink, mempool.space). Bridges/swaps via dedicated + aggregate explorers; instant-swaps often need temporal+amount matching or direct outreach.
Identification & OSINT, the hardest half: link on-chain address -> entity -> real person (Web3 -> Web2). Exchange KYC is the gold standard but LE-gated. When it is not available, pivot via domain/infra intel (Validin, Silent Push, Shodan/Censys, crt.sh), tech-stack IDs (BuiltWith/Wappalyzer), person pivots (Epieos, OSINT Industries, Holehe), and scam DBs; preserve with Wayback/archive.today. Document everything (Obsidian/Notion/Hunchly/Maltego).
Freezing, Blacklisting & Recovery, report/blacklist/flag wallets so institutions can freeze; issuer freezes (Tether/Circle), T3 FCU, TRM Beacon; LE-only coordination via Deconflict/Kodex; recovery via Asset Reality/DigitalMint.

Additions from IOC Level 2 (June) Session 1

Tools shown in Intelligence on Chain’s Level 2 (June) Blockchain & OSINT Investigations course, Session 1. Lighter schema (no OPSEC/Skill ratings). Confirm current URLs before relying on them. The instructor demonstrated an OP_RETURN decoder site but explicitly flagged it as low-trust, so it is deliberately not listed here.

Bridge & cross-chain explorers / utilities

Tool	What it does	Access	Website	Notes
Relay Explorer	Relay.link cross-chain transfer lookup	free	relay.link	Search by tx hash or address; seen routing via a Bitcoin OP_RETURN memo
chainlist.org	Resolve an EVM chain ID to its chain	free	chainlist.org	Decode the “destination chain ID” field found in bridge input data
Arbiscan	Arbitrum explorer (Etherscan family)	free	arbiscan.io	The L1-deposit vs L2-withdrawal tabs expose the bridge legs
TronScan address converter	Convert an EVM-hex recipient into a Tron (T…) address	free	tronscan.org	Keep the 0x, strip the leading zeros after it; see “Decoding a Cross-Chain Destination Address from Input Data”

Tracing / case tooling

Tool	What it does	Access	Website	Notes
Spectra (IOC)	Intelligence on Chain’s own tracer plus a terminal case manager	paid/community	intelligenceonchain.com	Auto-exchange time-and-value matching with a configurable tolerance (~$200 default)
IOC OSINT Toolkit	IOC-hosted, filterable directory of 170+ investigation tools	free	osint.intelligenceonchain.com	The live version of much of this catalogue

Email / domain OSINT

Tool	What it does	Access	Website	Notes
MXToolbox	Email header analysis; SPF/DKIM/DMARC checks; return-path vs sender for spoof detection	freemium	mxtoolbox.com	Paste a raw email header to expose routing and spoofing
Whoxy	WHOIS lookup plus reverse/historical WHOIS for registrant-email pivots	freemium	whoxy.com	Registrant data is privacy/GDPR-limited in many regions

Additions from OSINT Excellence Cheat-Sheet Collection (Alex Lozano / cibergy), ingested 2026-07-12

Source: “OSINT Excellence - Cheat Sheet Collection” (Alex Lozano, cibergy.com / osintexcellence.org). Most of the collection duplicated notes and tools already here and was discarded; the genuinely additive, non-duplicative resources are the country-level corporate registries below and the OSINT handbooks/curated stacks. Every URL was link-checked 2026-07-12: 200 = live; 403 = live but bot-protected (open in a real browser); egrul/bizstats block automated checks entirely but are confirmed real (see notes). Lighter schema (no OPSEC/Skill ratings). Registries marked “official” are government/court sources; the rest are commercial aggregators. Confirm the current URL before relying on any entry.

Corporate Registries by Country (Europe)

For FININT / due-diligence / entity-attribution work: following fiat off-ramps, shell companies, directors, and beneficial owners behind a crypto case. Complements the cross-jurisdiction sources in “Corporate & Records” above (OpenCorporates, GLEIF, ICIJ Offshore Leaks). OpenCorporates and North Data both span multiple countries and are listed once.

Country	Registry / resource	What it is	Website	Notes
Germany	Handelsregister	Official German commercial register	handelsregister.de	Court-operated; the primary DE source
Germany	Bundesanzeiger	Federal Gazette, official company financial filings	bundesanzeiger.de	Where DE annual accounts are published
Germany	Unternehmensregister	Official consolidated company-register portal	unternehmensregister.de	Single entry point across DE registers
Germany	Creditreform (Firmeneintrag)	Commercial credit / company data	firmeneintrag.creditreform.de	403 to bots; opens in a browser
DE/EU	North Data	Commercial company-data aggregator (DE + wider EU)	northdata.de	Cross-jurisdiction; strong ownership graphs
UK	Companies House	Official UK company registry + full filing history	find-and-update.company-information.service.gov.uk	Also in “Corporate & Records” above
UK	The Gazette	Official public record (insolvency/statutory notices)	thegazette.co.uk	Official
UK	Company Check	Commercial UK company & director data	companycheck.co.uk
UK	BizStats	Free UK company info (Open Government Licence data)	www.bizstats.co.uk	Blocks automated checks; confirmed live via search
France	Infogreffe	Official registry of the French commercial courts	infogreffe.fr	Official
France	BODACC	Official bulletin of civil & commercial announcements	bodacc.fr	Official
France	Pappers	Free/freemium FR company data	pappers.fr	Good free tier
France	Societe.com	Commercial FR company data	societe.com
France	Verif	Commercial FR company data	verif.com
Italy	Registro delle Imprese	Official Italian business register	registroimprese.it	Official
Italy	InfoCamere	Chambers-of-commerce registry operator	infocamere.it	Runs the IT register infrastructure
Italy	Empresite	Commercial IT company directory	empresite.it
Italy	Pagine Gialle	Business directory (yellow pages)	paginegialle.it	Directory, not a legal register
Russia	EGRUL (Federal Tax Service)	Official unified state register of legal entities	egrul.nalog.ru	Official; typically geo-restricted to RU IPs
Russia	Rusprofile	Company-data aggregator	rusprofile.ru	403 to bots; opens in a browser
Russia	Zachestnyi Biznes	Company-data aggregator	zachestnyibiznes.ru	403 to bots; opens in a browser
Russia	List-Org	Company directory	list-org.com
Russia	Kontur Focus	Commercial due-diligence platform	focus.kontur.ru	403 to bots; opens in a browser
Spain	Registro Mercantil Central	Official central commercial registry	rmc.es	Official
Spain	BORME (via BOE)	Official Mercantile Registry gazette	boe.es	Official
Spain	Librebor	Free access to BORME filings	librebor.me	Free BORME mirror
Spain	Axesor	Commercial company / credit data	axesor.es
Spain	Datoscif	Company financial data	datoscif.es
Netherlands	KvK	Official Dutch Chamber of Commerce business register	kvk.nl	Official
Netherlands	OpenKvK	Open access to KvK data	openkvk.nl
Netherlands	Drimble	Public-records / company-info aggregator	drimble.nl
Netherlands	DNB public register	De Nederlandsche Bank register of licensed financial institutions	dnb.nl/en/public-register	Official; NB this is the central bank (not Dun & Bradstreet)
Global	Dun & Bradstreet	Global business-data / DUNS	dnb.com	403 to bots; distinct from dnb.nl above
Switzerland	Zefix	Official central business-name index	zefix.ch	Official
Switzerland	SHAB	Swiss Official Gazette of Commerce	shab.ch	Official
Switzerland	Moneyhouse	Commercial CH company data	moneyhouse.ch
Switzerland	SIX Swiss Exchange	Listed-company disclosures	six-group.com	For listed entities
Switzerland	Swissreg	Official trademark / patent register (IP, not companies)	swissreg.ch	IP register, use for brand/IP links, not company filings

OSINT Handbooks, Guides & Curated Stacks

Free reference / learning resources. Verified 2026-07-12.

Resource	What it is	Access	Website	Notes
Toddington OSINT cheat sheets	Free library of OSINT cheat sheets & resources	free	toddington.com/resources/cheat-sheets/	OCR in the source mangled this as “toddinton”, corrected
AJMI Open Source Investigation Handbook	Al Jazeera Media Institute OSINT handbook (EN/AR)	free	institute.aljazeera.net/en/node/2111	Ethics, geolocation, ships/planes, satellite, corporate ownership
Blackdot Solutions, The OSINT Handbook	Vendor OSINT handbook	free (email gate)	blackdotsolutions.com/the-osint-handbook	Anti-Financial-Crime edition is more crypto-relevant: blackdotsolutions.com/osint-handbook-for-afc
Recorded Future, The Intelligence Handbook (4th ed.)	198-page intelligence-led security program guide	free (email gate)	go.recordedfuture.com/the-intelligence-handbook-fourth-edition	Includes fraud/identity/attack-surface intel chapters
OSINT Handbook (osinthandbook.com)	Independent OSINT reference site	free	osinthandbook.com
OSINT Combine, OSINT Bookmark Stack	Curated importable browser bookmark set of OSINT tools	free	osintcombine.com/free-osint-tools/osint-bookmark-stack
OSINT Combine, Dark Web Bookmark Stack	Curated dark-web research bookmark set	free	osintcombine.com/free-osint-tools/darkweb-bookmark-stack	Pair with the Darknet tools above

Additions from DFRWS EU 2025 mixer research, ingested 2026-07-28

Sources: Zavrel et al., “Tumbling down the stairs” (FSI:DI 52 (2025) 301869) and Tippe & Deckers, “Unmixing the mix” (FSI:DI 52 (2025) 301876). Tooling used to build and query a local Bitcoin transaction graph, plus the attribution and reporting sites the two teams pivoted through. Lighter schema (no OPSEC/Skill ratings). Bitcoin Core, Mempool.space, Crystal Intelligence, and Chainabuse already appear above; only the additive detail is recorded here.

Self-hosted chain analysis (build your own graph)

Tool	What it does	Access	Website	Notes
Neo4j	Graph database; import the Bitcoin chain as blocks, transactions, and addresses, then query it in Cypher	freemium / self-host	neo4j.com	The 2025 study imported 2 billion+ nodes. Bulk import is far faster than per-transaction inserts. Shortest-path queries surface links that a visual graph hides
btc-csv (Sommer, 2019)	Extracts raw Bitcoin blockchain data into CSV shaped for Neo4j bulk import	free	files.ifi.uzh.ch (UZH thesis)	Address decoder library is stale (2020) and cannot parse Taproot; the authors had to patch it. Budget time for that
BlockSci	Open-source blockchain analysis platform (Kalodner et al., USENIX Security 2020)	free	github.com/citp/BlockSci	Unmaintained since 2020; rejected by the 2025 study for that reason. Still the reference implementation to read
Bitcoin Core	Full node; the primary source of raw chain data and of forward/backward input-output links	free	bitcoincore.org	Paired with mempool.space in the fingerprinting study
transactionfee.info	Charts of Bitcoin transaction statistics, including the share of 1-input/2-output transactions	free	transactionfee.info	Source of the “roughly 75 percent of transactions are `<1:2>`” baseline

Address risk, attribution & community reports

Tool	What it does	Access	Website	Notes
AMLBot	Address risk scoring and taint percentage for BTC and other chains	freemium	amlbot.com	Used as the cross-check against Crystal. Does not publish its data sources or methodology. See “Vendor Risk Scores Disagree, and a Mixer Lowers Them”
Crystal Blockchain / Crystal Intelligence	Institutional analytics with taint scoring and entity attribution	freemium / enterprise	crystalintelligence.com	Also listed under Additional Tracing & Attribution Platforms above. Free tier ran to 15 checks per day as of the 2025 study
TokenScope	Address attribution and OSINT lookups on BTC addresses	free / freemium	tokenscope.com	Used to attribute peel-chain inputs to a named darknet market
CheckBitcoinAddress	Community-reported scam and ransomware reports tied to BTC addresses	free	checkbitcoinaddress.com	Cross-reference identified customer payout addresses against public reports

CoinJoin coordinator discovery

Tool	What it does	Access	Website	Notes
Wasabist	Public directory of active Wasabi CoinJoin coordinators	free	wasabist.io	Wasabi shut its own coordinator in 2024, so activity moved to third-party coordinators. This is where you find who is running them now
Kukks coordinator list (nostr)	Alternative published list of Wasabi coordinators	free	github.com/Kukks/wasabinostr	Same purpose as Wasabist; different set
Wasabi Nostr announcement feed	Where coordinators announce rounds	free	relay: wss://relay.primal.net	There is NO on-chain coordinator tag. Attributing a WabiSabi round to a coordinator means matching the coinjoin txid and timing to an announcement. Record the relay + announcement event id as the artefact
Liquisabi	Community WabiSabi round tracker	free	see Wasabi community listings	Cross-reference alongside Wasabist when attributing a round

Event Signature & Selector Lookup

The highest-yield free step when you do not know what a contract is: take each log’s topics[0] and reverse it to an event signature. Also reverses a 4-byte function selector from an unverified contract’s input. Both are free and need no key. Recompute rather than trust a copied hex, see “Operational Tracing Runbook: Live Mixers Bridges and No-KYC Swaps” (04-laundering-obfuscation) section 3.

Tool	What it does	Access	Website	Notes
openchain.xyz signature database	Reverse a topic0 or 4-byte selector to its signature	free	openchain.xyz	Primary lookup. Broader coverage than 4byte in practice
4byte.directory	Reverse a function selector or event topic	free	4byte.directory	The original; keep both, coverage differs
Blockscout / Etherscan Logs tab	Read topic0 AND the decoded signature straight off the chain	free	blockscout.com / etherscan.io	The most reliable route: no lookup needed, the chain tells you. Also shows which params are indexed (filterable) vs in `data` (not)
`cast keccak` (Foundry)	Compute a topic0 locally from a canonical signature	free	getfoundry.sh	`cast keccak "Deposit(bytes32,uint32,uint256)"`. Canonical types, no spaces, no param names

Privacy-Coin & CoinJoin Explorers

Free explorers for the chains where the boundary is the only tractable edge. Privacy assets are traced at the transparent boundary (shield/deshield, peg-in/peg-out, mint/spend), never inside the pool.

Tool	What it does	Access	Website	Notes
whirlpoolstats.xyz (Whirlpool.Observer)	Tracks Whirlpool pools, Tx0s and mix cycles	free	whirlpoolstats.xyz	Covers the 0.025 and 0.25 BTC pools. Use to find the Tx0, which is the depositor-linking artefact
litecoinspace.org/mweb	Litecoin MWEB peg-in / peg-out explorer	free	litecoinspace.org/mweb	A peg-out is NOT a standalone tx: it is an output inside the HogEx, the always-last tx in each block. Peg-in amounts are visible
mwebexplorer.com	Alternative MWEB explorer	free	mwebexplorer.com	Second source for MWEB boundary events
Nighthawk zcash-explorer	Open-source Zcash explorer that classifies tx type and pool	free	github.com/nighthawk-apps/zcash-explorer	Tells you which pool (Sapling / Orchard / transparent) a tx touched
zcha.in	Zcash turnstile / pool migration view	free	zcha.in	For turnstile analysis between shielded pools
zkp.baby	Live Zcash shielded pool balances	free	zkp.baby	Size the anonymity set per pool at a point in time
Blockchair (Zcash / Dash)	Multi-chain explorer covering ZEC and DASH	free	blockchair.com/zcash, /dash	For Dash: detect PrivateSend as N equal in / N equal out of one denomination with no change
Firo explorer	Firo / Lelantus Spark explorer	free	explorer.firo.org	Spark addresses are NOT searchable and amounts are hidden. Only the mint and spend-to-transparent boundaries are tractable
Envio Privacy Pools indexer	Open-source indexer for every 0xbow Entrypoint and pool	free / self-host	github.com/enviodev/privacy-pools	Covers Ethereum, Optimism, BSC, Arbitrum. Use the live Merkle leaf count as the anonymity-set ceiling. Beats hand-rolling log queries
kycnot.me	Tracks which no-KYC swap services are actually live and their KYC posture	free	kycnot.me	Verify a swap service is operating BEFORE building a theory on it
SolanaFM	Parsed Solana instructions incl. inner instructions (CPIs)	freemium	solana.fm	Essential: on Solana the real transfer is a CPI under a router, and naive from/to fails
TronGrid API	Tron events and tx info endpoints	free tier	trongrid.io	`/v1/contracts/{address}/events` and `/wallet/gettransactioninfobyid`. Also check energy delegation: the delegator is a lead

Use a Suite of Tools, Not One, PI Response Priority: Freeze, Monitor, Predict, OSINT, Freezing Funds with an Exchange Email, Cooperating Instant Exchanges as Pivot Points, Time-and-Value Analysis, Decoding a Cross-Chain Destination Address from Input Data, Obsidian Case-Management Workflow, Intelligence Discipline Taxonomy, Working with Law Enforcement: Capacity, Speed, and Cross-Sector Coalitions, Monitoring Addresses with Alerts, Operational Tracing Runbook: Live Mixers Bridges and No-KYC Swaps