OSINT Tools for Investigations
Published April 2026 · Last updated April 2026
Open-source intelligence tools turn publicly available data into investigative leads. Corporate registries reveal ownership structures. Shipping data tracks sanctioned vessels. Social media archives document deleted posts. This guide covers the tools investigative journalists use at each stage of an OSINT investigation.
Investigation frameworks and directories
Before reaching for specific tools, you need a map of what's available. These directories organize hundreds of OSINT resources by task and data type.
Bellingcat Online Investigation Toolkit
The single best starting point. A curated directory of OSINT tools organized by category: geolocation, satellite imagery, social media analysis, transportation, and more. Maintained by Bellingcat's investigative team. Free. Updated regularly as tools appear and disappear.
A tree-style directory of OSINT tools organized by data type — usernames, email addresses, domain names, IP addresses, social networks, public records. Less curated than Bellingcat's toolkit but broader in scope. Free. Useful when you know what data point you have and need to find tools that work with it.
Corporate and financial records
Follow the money. These tools reveal who owns what, where money flows, and which entities connect to whom.
A search engine for investigative data maintained by the Organized Crime and Corruption Reporting Project. Cross-references corporate registries, court records, financial disclosures, leaked datasets, and sanctions lists from over 100 countries. Free for journalists. Apply for access through OCCRP. The largest cross-border investigative data platform that exists.
A free database that combines sanctions lists, wanted lists, and politically exposed persons (PEPs) from governments worldwide into one searchable dataset. Check whether a person or entity appears on any sanctions list. Updated daily. API access available. Essential for investigating sanctioned individuals and the companies connected to them.
The largest open database of companies in the world — over 200 million companies from corporate registries in 140+ jurisdictions. Search for a company and see its officers, registered address, filing history, and connected entities. Free for basic searches. Paid plans add bulk access and API. Essential for tracing corporate structures across borders.
Identity and social media
Find connected accounts, verify identities, and trace a person's digital footprint across platforms.
Searches for a username across 400+ social networks and websites simultaneously. Enter a username, get a list of platforms where that username exists. Free, open-source, runs from the command line. Fast way to map someone's online presence. Results require manual verification — matching usernames do not always mean matching people.
PimEyes Free limited + $30/month
A facial recognition search engine. Upload a face, find where that face appears on the public web. Powerful for identifying individuals in photos and videos. Used by Bellingcat and other investigative outlets. Read the ethics section below — facial recognition raises serious privacy concerns and is banned or restricted in some jurisdictions.
Physical tracking and geolocation
Track vessels, verify locations, and monitor physical movement using publicly available data.
Real-time and historical vessel tracking using AIS (Automatic Identification System) data. See where ships are, where they've been, and what routes they've taken. Used extensively in sanctions investigations, environmental reporting, and arms trafficking stories. Free basic access; paid plans add historical data and fleet monitoring.
Evidence capture
Web pages change, get deleted, and disappear. Capture evidence before it does.
Hunchly $130/year
Automatically captures and timestamps every web page you visit during a research session. Builds a searchable, chronological evidence trail. No free equivalent exists for the automatic capture and legal timestamping. Used by journalists, law enforcement, and human rights investigators. Not free, but irreplaceable for serious OSINT work.
Ethical considerations
OSINT tools access public data, but "public" does not mean "fair game." Journalists should apply editorial judgment to every technique.
- Facial recognition (PimEyes). Identifying people without their knowledge raises consent issues. PimEyes has been used to stalk, harass, and dox people. Some newsrooms restrict its use to cases with clear public interest — identifying war criminals, tracking fugitives, or verifying participants in documented events. Never use it casually.
- Username correlation (Sherlock). A matching username across platforms does not prove the accounts belong to the same person. Treat matches as leads, not evidence. Verify through additional signals — content, timing, cross-references.
- Location tracking. Ship and flight tracking data is public. But publishing someone's real-time location can endanger them. Consider what you publish and when.
- Leaked data. Aleph includes datasets from leaks (Panama Papers, Paradise Papers). Using leaked data is legally complex. Consult your newsroom's legal counsel on how to handle and reference leaked material in your jurisdiction.
- Operational security. Investigate from a VPN or Tor. Use dedicated research accounts. Your targets may monitor who's looking at their profiles. Protect yourself and your sources.
Frequently asked questions
What is OSINT?
Open-source intelligence (OSINT) is information gathered from publicly available sources — corporate registries, shipping data, social media, satellite imagery, court records, and government databases. Journalists use OSINT techniques to verify claims, trace assets, identify individuals, and document events without relying on confidential sources.
Is OSINT legal?
Accessing publicly available information is legal in most jurisdictions. However, how you use that information matters. Facial recognition tools like PimEyes raise privacy concerns. Scraping social media may violate terms of service. Tracking individuals' movements could cross ethical lines depending on the story. The information is public; the investigation still requires editorial judgment.
What's the best free OSINT tool for beginners?
Start with the Bellingcat Online Investigation Toolkit — it's a curated directory of hundreds of free tools organized by task. From there, learn Hunchly for evidence capture, OpenCorporates for company research, and Marine Traffic for vessel tracking. Most OSINT tools are free because they're maintained by journalists, researchers, and nonprofits.
Do I need to know how to code for OSINT investigations?
Not for most tools on this list. Sherlock, Hunchly, and Marine Traffic have graphical interfaces. But coding (especially Python) opens up more advanced techniques — scraping, API access, data correlation, and automation. Bellingcat and the Global Investigative Journalism Network offer free OSINT training for journalists.
How do I protect myself during OSINT research?
Use a VPN or Tor Browser to prevent your research targets from seeing your IP address. Create dedicated research accounts separate from your personal identity. Use Hunchly to automatically capture pages — it timestamps everything, creating an evidence trail. Never access private accounts or systems, even if credentials are leaked publicly.