Role
SearchIn for threat intelligence analysts
Infrastructure, leaks, and actor identifiers without vendor portal fatigue.
Threat intel analysts use SearchIn to enrich IOCs and actor-linked identifiers — domains, IPs, emails, usernames — across WHOIS, DNS, host intel, and breach sources. Keep enrichment in cases and pay only for the queries that advance a report.
Who it's for
Built for threat intelligence analyst work
- CTI analysts enriching IOCs and actor infrastructure
- Managed intel teams supporting SOC escalations
- Researchers tracking phishing and malware C2 domains
- Analysts who want API access to the same providers as the UI
Workflows
Typical workflows
- 01
Domain and DNS enrichment
WHOIS and SecurityTrails-style DNS history to characterize suspicious or actor-controlled domains.
- 02
Host exposure
Shodan lookups for internet-facing services tied to IPs or hostnames in a report.
- 03
Credential and alias context
Breach and identity providers when actor emails or handles appear in reporting.
- 04
Report-linked cases
Group enrichment queries under a case named for the campaign or ticket.
Sources
Where to start
Each source has a full page with inputs, coverage, limits, and per-lookup prices.
- SecurityTrailsCurrent DNS records and subdomain inventory from SecurityTrails.from $0.50
- WhoisXMLLast-known WHOIS, reverse WHOIS, and reverse IP from Domain Research Suite.from $0.40
- WhoxyCurrent WHOIS, ownership history, and reverse WHOIS from Whoxy.from $0.25
- ShodanInternet-facing hosts, open ports, banners, and DNS from Shodan.from $0.10
- BuiltWithTechnology stack, company meta, and contacts detected on a domain.from $0.10
- DeHashedCredential and breach intelligence from the DeHashed dataset.from $0.30
- SnusbaseBreach and stealer-log search across Snusbase leak tables.from $0.30
FAQ
OSINT for threat intelligence analyst, answered
Does SearchIn replace a TIP or MISP?
No. Use SearchIn to enrich identifiers; keep your threat intel platform for storage, sharing, and detection content.
Can enrichment be automated from our pipeline?
Yes. Call the OSINTOne API from enrichment workers using the same provider contracts as the UI.
Which providers are most relevant for CTI?
Domain/DNS (SecurityTrails, WhoisXML, Whoxy), host intel (Shodan), and breach databases for email/username context.
How do we control spend on enrichment?
Prepaid wallet with per-query pricing. Team wallets help CTI squads share a budget without per-seat vendor contracts.
Related
Other teams using OSINTverse
OSINTverse means OSINT
Everything else on OSINTverse
One account covers search, the case map, the API, and MCP. The free tools, the resources, and the community need no account at all.
- SearchSearchInType one email, username, phone, or domain. See everything connected to it.17 sources behind one search box
- AutomateOSINTOne APIThe same 17 sources in your own tools. One key, one schema.17 sources, one key, one schema
- ConnectOSINTverse MCPLet Claude run the same 17 sources and file results into Cases. You set the daily cap.24 tools for Claude, ChatGPT, and Cursor
- Free toolsFree OSINT toolsSherlock, Maigret, Holehe, and more in the browser, plus otinstaller on Linux. No account.9 browser tools and 40 CLI tools
- LearnResourcesCourses, books, ebooks, newsletters, and communities, judged before you pay for one.68 resources and 86 comparisons
- CommunityOSINT CollectiveA free monthly room where people who do OSINT teach what they know. OSINTCon recordings stay open.500 seats a month, 10,000+ OSINTCon attendees
Your first lookup is a minute away
Create a free account with a magic link and add credits when you're ready. Or try the live demo first, no account needed.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days