Every open-source OSINT tool. One command.Every open-source OSINT tool.One command.

Good for

• A first pass on a handle before deeper work.
• Spotting which platforms a brand or project name is already taken on.
• Feeding profile URLs into socid-extractor or Maigret for details.

Before you run it

• Sites change their responses often, so expect a few false positives; open each hit.
• Rate limits on popular sites can mark a profile as missing when it exists. Re-run with --timeout raised.

Good for

• A fuller dossier than Sherlock on one handle.
• Finding the same person under a slightly different name through the extracted links.
• Reports you can hand to someone who does not read terminals (--html, --pdf).

Before you run it

• The full site list is slow. Use --top-sites for a quick pass.
• Some sites need cookies to return profile fields; Maigret still reports the match without them.

Good for

• A second username sweep next to Sherlock, from a different site list.
• Checking which services an email address has an account on.
• CSV or PDF exports (--csv, --pdf) to attach to a case.

Before you run it

• Sites change their responses, so treat each hit as a lead and open it before relying on it.
• The optional --ai profile sends the names of matched sites to Blackbird's own service and needs a free key from --setup-ai. Leave it off if that is a problem for your case.
• The project moved from p1ngul1n0/blackbird to antoniaci/blackbird and ships no licence file, so the registry lists its licence as Other.

Good for

• One run for both a handle and the email behind it.
• Agent workflows: the same checks over MCP.
• A second source next to Sherlock and Holehe.

Before you run it

• otlite never runs it with --allow-loud, which would notify the target.

Good for

• A cross-check on Sherlock and Nexfil output.
• Handles on smaller regional sites.

Before you run it

• Treat results as leads; the detection rules are community maintained.

Good for

• Another username pass next to Sherlock and Maigret.
• Fast checks in scripts with the original -u flag.

Before you run it

• Detection rules are updated less often than Sherlock's; verify hits by hand.

Good for

• A reliable yes or no on the big platforms.
• Checking whether a handle is free before registering it.
• Verifying Sherlock hits on the platforms socialscan covers.

Before you run it

• Covers roughly a dozen platforms; use it for precision, not reach.

Good for

• Turning one handle into the set of accounts that link to each other.
• Finding an email published on a profile page.
• Exporting the link graph for a case.

Before you run it

• Crawling linked profiles takes longer than a plain username check.

Good for

• A Sherlock-style sweep when you want spreadsheet output (--csv, --xlsx).
• Trying spelling variants in one run with the {?} placeholder, which swaps in _, - and .

Before you run it

• The README describes a much larger web console and a commercial reporting service. otlite installs the project but runs only its username scanner.
• It fetches Sherlock's current site list at run time and shares Sherlock's false positives. Add --local to use the bundled copy instead.

Good for

• Finding the commit email behind a developer's GitHub handle.
• Listing contributor addresses for a repository (url:https://github.com/owner/repo).
• Organisation-wide sweeps with the original --org flag.

Before you run it

• Unauthenticated GitHub API calls are capped at 60 an hour, which a large organisation or busy repository uses up quickly.
• Upstream has not changed since 2019. It only reads GitHub's public API, so nothing reaches the person or their own sites.

Good for

• Confirming a Gmail address belongs to a live account.
• Finding the display name and photo behind an address.
• Pivoting from an address to public Maps reviews.

Before you run it

• Needs a one-time login (ghunt login) with your own Google cookies. Use a dedicated research account.
• Google changes endpoints often; if a module fails, update with otlite update ghunt.

Good for

• Confirming an address is real and active before spending credits on it.
• Seeing which platforms to look at next for a given email.
• Bulk checks from a file with the original --only-used flag.

Before you run it

• Several services rate limit quickly; a rate-limited row is unknown, not absent.
• otlite runs Holehe with its password-recovery modules switched off by default.

Good for

• A quick breach check on an address.
• Searching your own local dump files with -lb.
• Chaining into reverse lookups on discovered passwords with the original flags.

Before you run it

• The useful sources need API keys. Add them with otlite keys set NAME; otlite keys check verifies them.
• Breach data is sensitive. Store results under a case and restrict the folder.

Good for

• Broad registration checks on one address.
• A second opinion next to Holehe.

Before you run it

• Newer project; verify surprising hits by hand.

Good for

• Confirming a Proton address is live before spending time on it.
• Testing one username across proton.me, protonmail.com, pm.me and the other Proton domains.
• Spotting business domains hosted on Proton.

Before you run it

• The keyless light mode allows roughly 100 lookups an hour. After that, answers are unreliable until the limit resets.
• The date belongs to the account's current PGP key, which changes if the owner regenerates keys, so it is not always the sign-up date.
• The heavier mode signs in to a Proton account of your own through Chrome. otlite's e: input uses the light mode.

Good for

• Confirming a number is in use on messaging apps.
• Pairing with Holehe when you have both an email and a number.

Before you run it

• Covers only a few services. Use the international format with the country code.

Good for

• Checking whether a phone number from a case is registered on Telegram.
• Getting the stable numeric ID for a Telegram username.
• Batch checks with comma-separated numbers in one run.

Before you run it

• Needs your own Telegram API ID and hash from my.telegram.org plus your account's phone number (otlite keys set API_ID, API_HASH, PHONE_NUMBER) and a login code on first run. It is interactive, so otlite run --all and otlite auto skip it.
• Use a dedicated account, not your personal one. Telegram can restrict accounts that look up many numbers, and residential connections fare better than VPNs.
• No response means either no account or a user who hides their number from lookups. It is not proof the number is unused.

Good for

• Activity timelines for a number you are authorised to monitor.

Before you run it

• Needs a logged-in WhatsApp Web session and a browser driver. It runs until stopped.
• This is monitoring of a person. Confirm your legal basis before you start it.

Good for

• Preserving a public profile before it changes or disappears.
• Pulling captions and geotags into a case file.
• Downloading by hashtag or location with the original flags.

Before you run it

• Instagram throttles anonymous downloads hard. Log in with a dedicated account for anything beyond a profile or two.
• Private profiles need a logged-in account that follows them.

Good for

• The numeric Instagram ID for a handle.
• The masked recovery email or phone hint for a profile.

Before you run it

• Requires a sessionid cookie from a logged-in Instagram account, passed with the original -s flag. Use a dedicated account.

Good for

• Preserving a channel before it is taken down.
• Tracking title and description edits over time.

Before you run it

• Large channels take hours and disk space. Archive one channel per folder.

Good for

• Documenting changes to a profile during an investigation.
• Alerts when a watched account posts.

Before you run it

• It never exits on its own, so --all and auto skip it. Run it in tmux or as a service.
• Instagram throttles unauthenticated polling. Configure a dedicated account as the project documents.

Good for

• Archiving a public channel's messages before they are deleted.
• Mapping which channels forward into a chat (-f writes an edge list for Gephi).
• Collecting member usernames to check with Maigret or Sherlock.

Before you run it

• Needs your own Telegram API ID and hash from my.telegram.org and a login code on first run, so otlite run --all and otlite auto skip it. Use a dedicated account.
• Requires Python below 3.13. The project has not been maintained since mid-2024; otlite installs the last PyPI release, 2.3.4.
• Comprehensive scans with media (-c -m) download everything the chat posted and can run for hours. Check what you are storing.

Good for

• Getting the numeric user ID behind a profile, which survives username changes.
• Structured fields from one URL without a full Maigret run.
• JSON output for scripts.

Before you run it

• Some sites only return fields with cookies; pass them with the original --cookies flag.

Good for

• Finding the location pages people tag around an event or building.
• Feeding location IDs (--ids) to a scraper that pulls posts from those places.
• A quick map (--map) of tagged places around a point.

Before you run it

• Needs a logged-in Instagram session: store the sessionid cookie with otlite keys set INSTAGRAM_SESSION_ID. Without it the tool tries to open a Chrome window for you to log in.
• Treat the session ID like a password and use a dedicated account. Instagram can invalidate sessions that are used from several places.
• It relies on an undocumented Instagram endpoint, which can change without notice.

Good for

• Early recon on a domain you are authorised to assess.
• Collecting staff addresses that show a company's email naming pattern.
• Choosing sources with -b to stay passive or to add keyed ones.

Before you run it

• Needs Python 3.12 or later. otlite pins a tested commit; current upstream has moved on to Python 3.14.
• Several sources only answer with an API key. Add the common ones with otlite keys set SHODAN_API_KEY and otlite keys set HUNTER_API_KEY.
• DNS resolution, brute force, and screenshot options contact the target directly. Leave them off for passive work.

Good for

• A quick passive subdomain list for a domain you are assessing.
• Cross-checking ctfr or theHarvester output against different sources.
• Saving hostnames to a file (-o) for resolution or screenshots later.

Before you run it

• Upstream changes slowly and some of its sources have shut down or block scripted queries, so expect several engines to return nothing.
• Brute forcing (-b) and port checks (-p) send traffic to the target's DNS servers and hosts. Leave them off for passive work.

Good for

• Subdomain enumeration that keeps going as it finds new names.
• Passive recon with the subdomain-enum preset when you must stay quiet.
• Exports to JSON or CSV for a spreadsheet or a case.

Before you run it

• Active presets probe the target. Only run them with written authorisation.
• The first run installs module dependencies, which can take a few minutes.

Good for

• Brand and phishing monitoring for your own domain.
• Checking a suspicious domain for the brand it imitates.
• Scheduled diffs with otlite diff to catch newly registered lookalikes.

Before you run it

• Resolution is live DNS traffic from your machine. Use --registered to keep the output short.

Good for

• Quick passive subdomain lists.
• Seeding BBOT or dnsgen with known names.

Before you run it

• crt.sh is sometimes slow or rate limited; retry later rather than hammering it.

Good for

• Finding non-contiguous IP ranges tied to a domain.
• Zone transfer checks on your own name servers.

Before you run it

• Brute force and zone transfer attempts are visible to the target's DNS operators.

Good for

• Expanding ctfr or BBOT output into more names to resolve.
• Finding staging and dev hosts that follow a naming pattern.

Before you run it

• Pipe the output into a resolver such as the one in BBOT or secator; dnsgen only generates.

Good for

• Passive endpoint discovery before an authorised test.
• Finding old parameters a site may still accept.

Before you run it

• Installed from the repo's main branch, so otlite update paramspider tracks it.

Good for

• A first look at a site before deeper tools.
• A single report with the basics for a case.

Before you run it

• Directory search and port scan are active. Use the passive modules on targets you do not own.
• Some modules take API keys in its own config.

Good for

• Building a staff list for an authorised assessment.
• Guessing the email format of an organisation.

Before you run it

• Takes a company name and a format string such as {first}.{last}@example.com with the original flags; the typed prefixes only cover the simple cases.
• Search engines rate limit scraping. Keep runs small.

Good for

• Preserving posts and videos before they are deleted.
• Building an evidence log with a hash for each archived item.
• Batch archiving from a Google Sheet once credentials are set.

Before you run it

• Requires Python below 3.13. Video downloads also need ffmpeg installed on the system.
• Google Sheets or Drive storage needs GOOGLE_CREDENTIALS (otlite keys set GOOGLE_CREDENTIALS), and S3 storage needs the AWS keys. Local storage works without any key.
• It fetches each URL from your machine, so the site sees your IP address. Some platforms only return full content to a logged-in session, set in its config file.

Good for

• Checking where a company name or domain appears across paste and code sites.
• Bug bounty scope discovery with the built-in program lists.

Before you run it

• It opens browser tabs rather than scraping, so there is no file output to keep. Use otlite run --case for the command record.

Good for

• Extracting Brazilian identifiers from text and search output.
• Validating CPF and CNPJ formats in a case.

Before you run it

• It is a pattern library, not a scanner. Use the patterns with grep, otlite extract, or your own scripts.

Good for

• Finding every US filing that mentions a person or company name.
• Narrowing by form type, date range, or place of incorporation.
• Pulling recent filings for a list of tickers with edgar rss.

Before you run it

• The q: input runs edgar text-search, and a filing must contain every word you give, so shorter queries return more.
• Searches cover the last five years by default. Add --date-range all or --start-date for older filings; SEC full-text search starts in 2001.
• edgar rss with --every-n-mins keeps polling until you stop it. Run it on its own rather than under otlite run --all.

Good for

• Mapping an onion site's structure.
• Harvesting contact addresses published on it.

Before you run it

• Start Tor first (sudo systemctl start tor on Debian and Ubuntu).
• Crawling is slow over Tor; limit depth.

Good for

• Finding onion sites that mention a term, name, or brand.
• Seeding TorBot with URLs to crawl.

Before you run it

• Needs Tor running locally. The search term goes in with q:, which becomes the tool's positional argument.

Good for

• Attack-surface mapping of a domain you are authorised to assess.
• Pivoting from one seed into related hosts, emails, and names.
• Passive-only runs (-u passive) when you must not touch the target.

Before you run it

• Installed from git rather than PyPI, so the first install takes longer.
• Many modules need their own API keys; without them SpiderFoot still runs but with fewer sources.
• A full scan can run for hours. Start with a passive scan and a module subset.

Good for

• Keeping large scan datasets searchable.
• Passive DNS and flow analysis from your own sensors.

Before you run it

• Needs MongoDB or another supported database and the scanners themselves. Follow the project's setup before the first run.

Good for

• A menu over tools you already know.
• Teaching environments.

Before you run it

• Interactive by design, so it does not fit --json pipelines. Much of it is offensive tooling: authorisation first.

Good for

• Exploratory sessions where you do not know which tool to run first.
• Wiring open-source lookups into an agent over MCP.

Before you run it

• Needs a model provider configured; read the project's setup first.

Good for

• Standardised JSON output across many scanners.
• Repeatable recon workflows for authorised targets.

Before you run it

• Its workflows can be active scans. Check what a workflow does before pointing it at a host.
• Installing the wrapped tools pulls in Go and other runtimes.

Good for

• AD enumeration during an authorised internal assessment.
• Mapping group membership without a Windows host.

Before you run it

• Needs domain credentials and network access to a domain controller. This is internal network tooling, not open-source intelligence in the public sense.