Non-negotiable. Tor Browser is the gateway to onion services and dark web investigations. Without it, you are operating on the surface of a much deeper threat landscape. Use it as your baseline entry point for any dark web research — never your personal browser.

Pair it with a dedicated, air-gapped or VM-isolated research environment. Operational security starts here.

Telegram has become the operational backbone of cybercrime — from ransomware announcements to data leaks to access broker advertisements. Telemetry allows you to search across Telegram channels at scale, making it invaluable for monitoring threat actors, tracking early leak disclosures, and identifying newly active criminal groups before they appear on threat intel feeds.

A surface-web-accessible search engine that indexes .onion sites. Ahmia is the fastest way to discover onion services without already knowing their addresses — useful for mapping the dark web ecosystem around a specific threat actor, topic, or sector. It filters out known abuse content, making it appropriate for professional research environments.

A commercial darknet intelligence platform that continuously indexes dark web forums, paste sites, Telegram channels, and I2P content. DarkOwl Vision provides searchable access to darknet data without requiring direct Tor access — critical for enterprise SOC teams that cannot expose analysts to raw dark web environments. Keyword alerting and historical data access are its primary operational value.

Troy Hunt's breach aggregation database remains the fastest public reference for checking whether an email address or domain appears in known data breaches. For OSINT practitioners, the domain search and API access make it essential for rapid triage of exposure during incident response. The notification service is also legitimately useful for monitoring client domains passively.

Intelligence X indexes data across the dark web, paste sites, Tor, I2P, and leaked datasets — and crucially, retains historical snapshots that other platforms remove. Its search covers email addresses, domains, IPs, CIDR ranges, Bitcoin addresses, and IBAN numbers, making it one of the most versatile OSINT pivoting tools available. The free tier is limited; the professional API unlocks its full value.

Flare automates continuous monitoring across dark web forums, illicit Telegram communities, and paste sites, surfacing threats relevant to your organisation before they escalate. Its strength is in alerting speed — catching credential posts, access broker listings, and brand mentions hours or days ahead of when they reach mainstream threat intelligence feeds. Built for security teams that need monitoring without manual forum trawling.

The search engine for internet-connected devices, open ports, exposed services, and misconfigured infrastructure. Shodan is essential for attack surface mapping and for identifying infrastructure linked to threat actors — cross-referencing IPs found on dark web forums against Shodan reveals operational patterns that rarely appear in conventional threat reports. The Monitor product provides continuous alerting on your own exposed assets.

A community-maintained aggregator that tracks ransomware group activity, victim announcements, and data leak publications across known ransomware sites. Ransomware.live provides a consolidated view of active ransomware operations without requiring you to monitor each group's onion site individually. It is the fastest public reference for confirming whether a client or sector has been targeted.

Beyond file scanning, VirusTotal is an OSINT pivoting engine. Submitting a URL, IP, or domain returns relationships to other indicators — connected files, referencing URLs, passive DNS history, and community comments from analysts who have investigated the same indicator. Its graph visualisation makes it one of the most effective tools for mapping malware infrastructure and phishing campaign anatomy.

URLScan.io renders and captures a full screenshot, DOM, resource list, and network request log for any URL — without exposing your own infrastructure to the destination. For phishing investigation, it is invaluable: you can analyse a malicious landing page in complete detail without triggering the attacker's tracking pixels or browser fingerprinting. Historical scans from other researchers are also searchable.

Maltego is the industry standard for visual link analysis and entity mapping. It transforms disparate OSINT data points — email addresses, domains, IP addresses, social profiles, company registrations — into interconnected graphs that reveal relationships invisible in raw data. Its transform library connects to dozens of threat intelligence sources, making it the central workspace for complex adversary investigations.

SpiderFoot automates OSINT data collection across hundreds of sources — dark web paste sites, threat feeds, DNS records, certificate transparency logs, social media, and more — from a single seed entity. Its HX (hosted) version removes the infrastructure burden from teams that cannot self-host. Effective for rapid threat landscape mapping at the start of an engagement.

Every TLS certificate issued by a public CA is logged to certificate transparency logs, and crt.sh makes those logs searchable. For OSINT practitioners, this means discovering subdomains, staging environments, and newly registered domains — including phishing domains using wildcard certificates or typosquatted names — days or weeks before they appear in threat feeds. An underused signal for early phishing infrastructure detection.

MISP is the open-source standard for threat intelligence sharing and indicator management. For teams running their own threat intelligence programme, it provides structured storage and sharing of indicators, events, and threat actor profiles — with federation support for sharing across trusted partner networks. Integration with SIEM and SOAR platforms makes it the backbone of a mature CTI operation.

Recorded Future aggregates and analyses threat intelligence across the open, deep, and dark web at scale — surfacing actionable intelligence with context that raw dark web monitoring cannot provide. Its AI-assisted risk scoring and analyst notes turn raw darknet signal into operationally useful intelligence. Expensive, but for organisations with a mature CTI function it is the most comprehensive commercial intelligence platform available.

Censys continuously scans the entire IPv4 address space and indexes certificates, open ports, and service banners — similar to Shodan but with a stronger emphasis on certificate data and a more structured search syntax. It is particularly effective for tracking threat actor infrastructure by pivot: a shared certificate, ASN, or service banner can link dozens of otherwise unconnected IPs into a coherent campaign picture.

A modular, command-line OSINT framework built for web reconnaissance. Recon-ng's module library handles everything from DNS brute-forcing and WHOIS lookups to breach data queries and social profile harvesting — all scriptable, all loggable to a structured database. For analysts who prefer terminal-based workflows and need repeatable, auditable collection procedures, it remains one of the most effective open-source options available.

Where Ahmia indexes the surface-accessible dark web, Torch operates natively within the Tor network — accessible only via Tor Browser. It indexes a broader range of onion content, including sites that block surface-web crawlers. For investigations requiring comprehensive dark web forum discovery or when Ahmia's filtered index is insufficient, Torch provides deeper coverage at the cost of requiring direct Tor access.

Non-negotiable. Tor Browser is the gateway to onion services and dark web investigations. Without it, you are operating on the surface of a much deeper threat landscape. Use it as your baseline entry point for any dark web research — never your personal browser.

Pair it with a dedicated, air-gapped or VM-isolated research environment. Operational security starts here.

Telegram has become the operational backbone of cybercrime — from ransomware announcements to data leaks to access broker advertisements. Telemetry allows you to search across Telegram channels at scale, making it invaluable for monitoring threat actors, tracking early leak disclosures, and identifying newly active criminal groups before they appear on threat intel feeds.

A surface-web-accessible search engine that indexes .onion sites. Ahmia is the fastest way to discover onion services without already knowing their addresses — useful for mapping the dark web ecosystem around a specific threat actor, topic, or sector. It filters out known abuse content, making it appropriate for professional research environments.

A commercial darknet intelligence platform that continuously indexes dark web forums, paste sites, Telegram channels, and I2P content. DarkOwl Vision provides searchable access to darknet data without requiring direct Tor access — critical for enterprise SOC teams that cannot expose analysts to raw dark web environments. Keyword alerting and historical data access are its primary operational value.

Troy Hunt's breach aggregation database remains the fastest public reference for checking whether an email address or domain appears in known data breaches. For OSINT practitioners, the domain search and API access make it essential for rapid triage of exposure during incident response. The notification service is also legitimately useful for monitoring client domains passively.

Intelligence X indexes data across the dark web, paste sites, Tor, I2P, and leaked datasets — and crucially, retains historical snapshots that other platforms remove. Its search covers email addresses, domains, IPs, CIDR ranges, Bitcoin addresses, and IBAN numbers, making it one of the most versatile OSINT pivoting tools available. The free tier is limited; the professional API unlocks its full value.

Flare automates continuous monitoring across dark web forums, illicit Telegram communities, and paste sites, surfacing threats relevant to your organisation before they escalate. Its strength is in alerting speed — catching credential posts, access broker listings, and brand mentions hours or days ahead of when they reach mainstream threat intelligence feeds. Built for security teams that need monitoring without manual forum trawling.

The search engine for internet-connected devices, open ports, exposed services, and misconfigured infrastructure. Shodan is essential for attack surface mapping and for identifying infrastructure linked to threat actors — cross-referencing IPs found on dark web forums against Shodan reveals operational patterns that rarely appear in conventional threat reports. The Monitor product provides continuous alerting on your own exposed assets.

A community-maintained aggregator that tracks ransomware group activity, victim announcements, and data leak publications across known ransomware sites. Ransomware.live provides a consolidated view of active ransomware operations without requiring you to monitor each group's onion site individually. It is the fastest public reference for confirming whether a client or sector has been targeted.

Beyond file scanning, VirusTotal is an OSINT pivoting engine. Submitting a URL, IP, or domain returns relationships to other indicators — connected files, referencing URLs, passive DNS history, and community comments from analysts who have investigated the same indicator. Its graph visualisation makes it one of the most effective tools for mapping malware infrastructure and phishing campaign anatomy.

URLScan.io renders and captures a full screenshot, DOM, resource list, and network request log for any URL — without exposing your own infrastructure to the destination. For phishing investigation, it is invaluable: you can analyse a malicious landing page in complete detail without triggering the attacker's tracking pixels or browser fingerprinting. Historical scans from other researchers are also searchable.

Maltego is the industry standard for visual link analysis and entity mapping. It transforms disparate OSINT data points — email addresses, domains, IP addresses, social profiles, company registrations — into interconnected graphs that reveal relationships invisible in raw data. Its transform library connects to dozens of threat intelligence sources, making it the central workspace for complex adversary investigations.

SpiderFoot automates OSINT data collection across hundreds of sources — dark web paste sites, threat feeds, DNS records, certificate transparency logs, social media, and more — from a single seed entity. Its HX (hosted) version removes the infrastructure burden from teams that cannot self-host. Effective for rapid threat landscape mapping at the start of an engagement.

Every TLS certificate issued by a public CA is logged to certificate transparency logs, and crt.sh makes those logs searchable. For OSINT practitioners, this means discovering subdomains, staging environments, and newly registered domains — including phishing domains using wildcard certificates or typosquatted names — days or weeks before they appear in threat feeds. An underused signal for early phishing infrastructure detection.

MISP is the open-source standard for threat intelligence sharing and indicator management. For teams running their own threat intelligence programme, it provides structured storage and sharing of indicators, events, and threat actor profiles — with federation support for sharing across trusted partner networks. Integration with SIEM and SOAR platforms makes it the backbone of a mature CTI operation.

Recorded Future aggregates and analyses threat intelligence across the open, deep, and dark web at scale — surfacing actionable intelligence with context that raw dark web monitoring cannot provide. Its AI-assisted risk scoring and analyst notes turn raw darknet signal into operationally useful intelligence. Expensive, but for organisations with a mature CTI function it is the most comprehensive commercial intelligence platform available.

Censys continuously scans the entire IPv4 address space and indexes certificates, open ports, and service banners — similar to Shodan but with a stronger emphasis on certificate data and a more structured search syntax. It is particularly effective for tracking threat actor infrastructure by pivot: a shared certificate, ASN, or service banner can link dozens of otherwise unconnected IPs into a coherent campaign picture.

A modular, command-line OSINT framework built for web reconnaissance. Recon-ng's module library handles everything from DNS brute-forcing and WHOIS lookups to breach data queries and social profile harvesting — all scriptable, all loggable to a structured database. For analysts who prefer terminal-based workflows and need repeatable, auditable collection procedures, it remains one of the most effective open-source options available.

Where Ahmia indexes the surface-accessible dark web, Torch operates natively within the Tor network — accessible only via Tor Browser. It indexes a broader range of onion content, including sites that block surface-web crawlers. For investigations requiring comprehensive dark web forum discovery or when Ahmia's filtered index is insufficient, Torch provides deeper coverage at the cost of requiring direct Tor access.