Part 9: OSINT platforms and data sources

OSINT platforms and data sources worth an investigator’s time, with who owns each, what it costs and where your queries go.

This Part replaces six separate vendor sections from earlier editions. We have removed tools that no longer exist, corrected owners and names, and dropped prices we could not confirm. Appendix A lists everything that was renamed, bought or shut down. Most platforms here are account-bound services that log your queries, which is a compliance feature for their customers and a consideration for you. Where a platform processes your data with AI we say so; where it does not say what model it uses, we say that too.

9.1 Professional OSINT tools

Tool What it does Pricing (October 2026) Data and OPSEC notes
Maltego Link analysis and graphing with transforms to many data sources. Now includes Hunchly (web capture), Monitor and Evidence Basic free with 200 credits a month. Entry €3,000 a year. Professional €7,500 a year for up to five users. Enterprise on request. Billed yearly in euros1 Hunchly joined Maltego in May 2025.2 The AI Assistant is opt-in and asks before critical actions3
Shodan Search engine for internet-connected devices and services Membership $49 one-time. API plans: Freelancer $69, Small Business $359, Corporate $1,099 a month4 Account-bound. The community Shodan MCP server is not a Shodan product5
Censys Internet-wide host and certificate search Free with 100 credits a month. Starter is pay-as-you-go from 500 credits6 Credit-based since 2025
Intelligence X Search over leaks, darknet, document archives and historical records Researcher €2,500 a year. API €7,000. Identity Portal €10,000. Enterprise €20,000. Free tier and trial7 Account-bound; sensitive queries are logged like any SaaS
Lampyre Automated data correlation from an email, phone or name Trial $5. Lampyre 100 at $8 a month. Lampyre 1000 at $77. PLUS from $116 a month; the desktop app comes only with PLUS8 Earlier editions listed a “$32 standard” plan that does not exist
OSINT Industries Email and phone enrichment across platforms Basic £19 a month (30 credits). Intermediate £49. Advanced £99. Enterprise on request9
Epieos Email and phone footprint lookups Free tier. Osinter €29.99 a month10
SpiderFoot Open-source automated reconnaissance Free, open source. The commercial SpiderFoot HX is part of Intel 471 Intel 471 acquired SpiderFoot in November 2022.11 The open-source project still gets commits but its last tagged release is v4.0 from April 2022. Expect broken modules
Babel Street Multilingual search and monitoring for government and enterprise Enterprise on request AI-heavy platform; government customer base
Social Links (SL Crimewall) Investigation workbench across social, darknet and blockchain sources Enterprise on request AI and natural language processing throughout.12 Hosted service
ShadowDragon (Horizon) Social media and identity investigation platform Enterprise on request Multilingual since February 202513
Blackdot Videris Investigation platform for corporate and financial crime Enterprise on request AI features are optional. Hosted on AWS in the UK and EU14
Skopenow Identity and background investigation platform Enterprise on request
Cylect AI Portal that wraps several hundred OSINT tools with an AI layer Community free. Personal $15 a month. Professional $55 a month or a $5 day pass15 Small vendor. Does not disclose which AI provider processes your queries, so treat it as T🔴 R🟡 D🔴 Q🟡

Verified 2026-10-09 against vendor pages. Prices change. Check before you buy.

9.2 Free structured data for illicit trade investigation

These are the sources we use first. They are free or have free tiers and they publish their methods. Several can be downloaded and queried locally, which keeps your targets off anyone’s logs.

Source What it holds Access Notes
OpenSanctions Consolidated sanctions, politically exposed persons and watchlists from hundreds of sources Free for non-commercial use. API €0.10 per search or match; entity lookups free. Bulk download available16 Open-source client includes an MCP server.17 Download the data and screen locally for sensitive cases
OpenCorporates Company registry records from most jurisdictions Web search free. API from £2,250 a year. Free API access for public-benefit users on application18
ICIJ Offshore Leaks Database Entities from the Panama Papers, Pandora Papers and other leaks Free
OCCRP Aleph Documents and datasets from investigative journalism, including company and court records Free account; some datasets restricted to vetted users
GLEIF Legal Entity Identifier records with parent relationships Free Useful for untangling group structures in trade finance
ImportYeti US sea import bills of lading, searchable by company Free search with limits; paid tiers Covers sea freight into the US only
UN Comtrade and ITC Trade Map International trade statistics by product, country and year Free registration, with limits that depend on your user category Aggregate statistics, not shipments. Good for spotting mirror-data gaps

Verified 2026-10-12 for existence and access model.

9.3 Platform and data access is shrinking

Several collection methods that OSINT courses still teach no longer work or now cost money.

  • X (Twitter). TweetDeck became the paid X Pro in 2023. The API moved to pay-per-use pricing in 2026, at $0.005 per post read and $0.010 per user read with a monthly cap. The old free and basic tiers have closed.19 Grok remains the main way to search X conversationally, with the data terms described in Part 2.1.
  • Meta. CrowdTangle shut down in August 2024. Its replacement, the Meta Content Library, is open to approved academic and non-profit researchers only.
  • Search APIs. Microsoft retired the Bing Search APIs on 11 August 2025. It points developers to “Grounding with Bing” inside Azure agents, which does not return raw results.20 Google has announced the closure of the Custom Search JSON API on 1 January 2027.21
  • Search APIs for tool builders. Brave ended its free Search API tier for new users in February 2026 and charges about $5 per 1,000 queries.22 Tavily gives 1,000 free credits a month.23 Exa charges about 7 US dollars per 1,000 queries.24
  • Telegram. Since September 2024 Telegram’s privacy policy says it may share a user’s IP address and phone number with authorities on a valid request. That changed its standing both as a collection target and as a tool.25
  • Reddit, TikTok and others now gate research access behind application processes and licences.

The practical answer is to budget for data and to build on the free structured sources in 9.2. Archive what you collect, because you may not be able to collect it again.

9.4 Geospatial intelligence

Tool What it does Cost Notes
Copernicus Browser Sentinel satellite imagery, current and historical Free account Replaced Sentinel Hub’s EO Browser, which Planet shut down on 20 March 202626
Google Earth Pro (desktop) Historical imagery, measurement, KML Free A Google account is optional for the desktop app
QGIS Open-source GIS for your own analysis Free Everything stays local
OpenStreetMap Community map data, downloadable Free
SunCalc Sun position and shadow length for a place and time Free For dating and timing images
PeakVisor Mountain and skyline matching Free tier For geolocating mountain scenery
Planet Daily commercial satellite imagery and the Insights Platform Paid Also owns Sentinel Hub’s APIs
Vantor (formerly Maxar Intelligence) High-resolution commercial imagery (WorldView, GeoEye) and the TensorGlobe AI platform Government and enterprise Maxar split into Vantor and Lanteris in October 202527

For AI geolocation of photographs see Part 7.3. Physical security monitoring platforms (Dataminr, Liferaft) are in 9.6.

9.5 Corporate, supply chain, trade, sanctions and blockchain

Platform What it does Access Notes (October 2026)
Sayari Corporate ownership, trade and sanctions graph Enterprise Acquired Mirato in 2025; Sayari Map was folded into Sayari Graph28
Kharon Sanctions and export-control risk research Enterprise US Treasury contract since 2024
LSEG World-Check (formerly Refinitiv) Sanctions, PEP and adverse media screening Enterprise World-Check On Demand launched September 202529
Dow Jones Risk and Compliance Screening and due diligence Enterprise RiskCenter uses AI for screening; Integrity Check uses Xapien for automated due diligence
Thomson Reuters CLEAR Public records and identity research (US) Enterprise CLEAR Investigate agentic AI launched 202630
LexisNexis Risk Solutions Identity, fraud and financial-crime compliance Enterprise Includes the former Accuity products (Firco, Bankers Almanac), merged in 2021.31 Earlier editions wrongly listed Accuity under Fiserv
Moody’s Orbis (formerly Bureau van Dijk) Private company financials and ownership Subscription
S&P Capital IQ Pro and Panjiva Supply Chain Intelligence Company data and bill-of-lading trade data Subscription Panjiva is still a live S&P Global brand32
Descartes Datamyne (formerly Zepol) Trade data Subscription Zepol was bought by Datamyne in 2015 and Datamyne by Descartes in 201633
ImportGenius US and international trade data Subscription
Blockchain platform Access Notes
Chainalysis (Reactor) Enterprise; no public price Law enforcement and compliance standard
Elliptic Enterprise
TRM Labs Enterprise Reported $2 billion valuation in September 2026
Crystal Intelligence (formerly Crystal Blockchain) Enterprise Renamed 202434
Arkham Intel Free for individuals with an account Labelled entities and tracing across chains
Breadcrumbs Free entry tier, paid plans Transaction visualisation
MetaSleuth, block explorers (Etherscan, Blockchair) Free First look at an address

CipherTrace, listed in earlier editions, was discontinued by Mastercard in March 2024.35 Bank transaction-monitoring systems (NICE Actimize, SAS, FICO Falcon, SymphonyAI NetReveal) are not OSINT tools and have moved to Appendix A.

Verified 2026-10-09. Enterprise prices are not public; earlier editions’ price ranges were estimates and have been removed.

9.6 Enterprise intelligence and investigation platforms

These platforms log every analyst query by design. That is what their customers’ compliance teams want, and it is why they rate Q🔴 in our rubric even when their data protection is excellent. Choose them for institutional investigations; do not use them for anything you need to keep from your own organisation.

Platform Owner (2026) What it does Notes
i2 Analyst’s Notebook i2 Group (Harris Computer, since January 2022) Link and timeline analysis, on-premises option Earlier editions listed it as an IBM product36
Palantir Gotham, Foundry and AIP Palantir Data integration and analysis; AIP runs language models and agents inside both platforms37 T🟢 R🟡 D🟡 Q🔴. Government and large enterprise only
Cognyte Spun out of Verint in 2021 Intelligence analytics for government Earlier editions said “Verint OSINT”; Verint is now a customer-experience company38
PenLink Tangles (formerly Cobwebs) PenLink Web intelligence Merged in 2023
Babel Street Insights Babel Street Multilingual monitoring
Recorded Future Mastercard (since December 2024)39 Threat intelligence
Flashpoint Ignite Flashpoint Threat and physical security intelligence; absorbed Echosec in 202240
Intel 471 (Verity471) Intel 471 Underground economy intelligence; owns SpiderFoot HX and Cyborg Security
Cybersixgill Bitsight (since December 2024)41 Dark web intelligence
ReliaQuest GreyMatter ReliaQuest Digital risk protection; absorbed Digital Shadows in 202242
Flare Flare Exposure and dark web monitoring Raised $60 million across 2025
Dataminr Pulse Dataminr Real-time event detection from public data; acquired ThreatConnect in 2025 Heavy AI classification; cloud only
Liferaft Navigator Securitas (since March 2026)43 Physical security threat intelligence
Fivecast ONYX Fivecast AI-driven OSINT for government US immigration and customs contracts
Siren Siren Investigation platform marketed as “sovereign AI” Deployable on your own infrastructure
Nuix with Linkurious Nuix (acquired Linkurious in April 2026)44 Document processing and graph visualisation
Kaseware with OSINT Combine Kaseware (merged November 2025)45 Case management and OSINT
Vortimo Vortimo Browser extension that captures and links what you read From the founder of Paterva, Maltego’s original developer

Verified 2026-10-09. We removed the marketing text that earlier editions carried about these platforms. They are expensive, they are good at what they do, and none of them is “essential”. Most illicit trade investigations we know of were done with the free sources in 9.2 and one or two paid tools.

Footnotes

  1. Maltego. “Pricing.” https://www.maltego.com/pricing/. Accessed 2026-10-09.↩︎

  2. Maltego (19 May 2025). “Maltego welcomes Hunchly.” https://www.maltego.com/blog/maltego-welcomes-hunchly-to-expand-osint-capabilities/. Accessed 2026-10-09.↩︎

  3. Maltego Docs. “What is the AI Assistant?” https://docs.maltego.com/en/support/solutions/articles/15000061164-what-is-the-ai-assistant-. Accessed 2026-10-09.↩︎

  4. Shodan. “Billing.” https://account.shodan.io/billing. Accessed 2026-10-09.↩︎

  5. BurtTheCoder. “mcp-shodan” (community project, MIT). https://github.com/BurtTheCoder/mcp-shodan. Accessed 2026-10-09.↩︎

  6. Censys Docs. “Platform credits: Free and Starter.” https://docs.censys.com/docs/platform-credits-free-starter. Accessed 2026-10-09.↩︎

  7. Intelligence X. “Products.” https://intelx.io/product. Accessed 2026-10-09.↩︎

  8. Lampyre. “Pricing.” https://lampyre.io/pricing. Accessed 2026-10-09.↩︎

  9. OSINT Industries. “Pricing.” https://www.osint.industries/pricing. Accessed 2026-10-09.↩︎

  10. Epieos. “Pricing.” https://epieos.com/pricing. Accessed 2026-10-09.↩︎

  11. Intel 471 (November 2022). “Intel 471 acquires SpiderFoot.” https://www.prnewswire.com/news-releases/intel-471-acquires-spiderfoot-301665787.html ; repository, https://github.com/smicallef/spiderfoot. Accessed 2026-10-09.↩︎

  12. Social Links. “SL Crimewall launch.” https://sociallinks.io/newsroom/social-links-sl-crimewall-launch. Accessed 2026-10-09.↩︎

  13. Business Wire (7 February 2025). ShadowDragon Horizon multilingual release. https://www.businesswire.com/news/home/20250207507777/en/. Accessed 2026-10-09.↩︎

  14. Blackdot Solutions. “FAQ.” https://blackdotsolutions.com/faq. Accessed 2026-10-09.↩︎

  15. Cylect. https://ai.cylect.io/. Accessed 2026-10-09.↩︎

  16. OpenSanctions. “API metering.” https://www.opensanctions.org/faq/api/metering/. Accessed 2026-10-09.↩︎

  17. OpenSanctions. “Open source software.” https://www.opensanctions.org/docs/opensource/. Accessed 2026-10-09.↩︎

  18. OpenCorporates. “Pricing.” https://opencorporates.com/pricing/. Accessed 2026-10-09.↩︎

  19. X Developer Platform. “Pricing.” https://docs.x.com/x-api/getting-started/pricing. Accessed 2026-10-09.↩︎

  20. Microsoft (2025). “Bing Search APIs retirement.” https://learn.microsoft.com/en-us/lifecycle/announcements/bing-search-api-retirement. Accessed 2026-10-09.↩︎

  21. Google. “Custom Search JSON API overview.” https://developers.google.com/custom-search/v1/overview. Accessed 2026-10-09.↩︎

  22. Implicator (February 2026). “Brave drops free Search API tier.” https://www.implicator.ai/brave-drops-free-search-api-tier-puts-all-developers-on-metered-billing/. Accessed 2026-10-09.↩︎

  23. Tavily Docs. “API credits.” https://docs.tavily.com/documentation/api-credits. Accessed 2026-10-09.↩︎

  24. Exa. “Pricing.” https://exa.ai/pricing. Accessed 2026-10-09.↩︎

  25. Telegram. “Privacy Policy”, section 8.3 (changed 23 September 2024). https://telegram.org/privacy. Accessed 2026-10-09.↩︎

  26. Planet Community (2026). “Important update: sunset of EO Browser and Sentinel Hub Dashboard.” https://community.planet.com/product-updates/important-update-sunset-of-eo-browser-and-sentinel-hub-dashboard-6426 ; Copernicus Browser, https://dataspace.copernicus.eu/ecosystem/services/copernicus-browser. Accessed 2026-10-09.↩︎

  27. Breaking Defense (October 2025). “Goodbye Maxar, hello Vantor and Lanteris.” https://breakingdefense.com/2025/10/whats-in-a-name-goodbye-maxar-hello-vantor-and-lanteris/. Accessed 2026-10-09.↩︎

  28. PR Newswire (2025). “Sayari acquires Mirato.” https://www.prnewswire.com/news-releases/sayari-acquires-mirato-combining-unrivaled-global-commerce-and-trade-data-with-ai-workflow-automation-302514955.html. Accessed 2026-10-09.↩︎

  29. LSEG (30 September 2025). “LSEG launches World-Check On Demand.” https://www.lseg.com/en/media-centre/press-releases/2025/lseg-launches-world-check-on-demand. Accessed 2026-10-09.↩︎

  30. Thomson Reuters. “CLEAR Investigate.” https://legal.thomsonreuters.com/en/products/clear-investigate. Accessed 2026-10-09.↩︎

  31. LexisNexis Risk Solutions (17 February 2021). Accuity merger announcement. https://risk.lexisnexis.com/about-us/press-room/press-release/20210217-merger. Accessed 2026-10-09.↩︎

  32. S&P Global Market Intelligence. “Panjiva Supply Chain Intelligence.” https://www.spglobal.com/market-intelligence/en/solutions/products/panjiva-supply-chain-intelligence. Accessed 2026-10-09.↩︎

  33. FreightWaves (October 2015). “Datamyne acquires Zepol.” https://www.freightwaves.com/news/datamyne-acquires-zepol-in-major-trade-data-deal ; GlobeNewswire (23 December 2016), “Descartes acquires Datamyne”, https://www.globenewswire.com/news-release/2016/12/23/901547/9197/en/descartes-acquires-datamyne.html. Accessed 2026-10-09.↩︎

  34. Crystal Intelligence. “10 years anniversary.” https://crystalintelligence.com/10-years-anniversary/. Accessed 2026-10-09.↩︎

  35. Fortune (13 March 2024). “Mastercard shuts down CipherTrace blockchain analytics products.” https://fortune.com/crypto/2024/03/13/mastercard-ciphertrace-blockchain-analytics-chainalysis-bitcoin-fog/. Accessed 2026-10-09.↩︎

  36. i2 Group (January 2022). “Harris acquires i2 product portfolio from IBM.” https://i2group.com/articles/harris-acquires-i2-product-portfolio-from-ibm. Accessed 2026-10-09.↩︎

  37. Palantir Technologies, Form 10-Q for the quarter ended 30 September 2025. https://www.sec.gov/Archives/edgar/data/1321655/000132165525000131/pltr-20250930.htm. Accessed 2026-10-09.↩︎

  38. Business Wire (1 February 2021). Cognyte spin-off completion. https://www.businesswire.com/news/home/20210201005948/en ; Thoma Bravo (November 2025), https://www.thomabravo.com/press-releases/thoma-bravo-completes-acquisition-of-verint-a-leader-in-ai-driven-customer-experience-automation. Accessed 2026-10-09.↩︎

  39. Mastercard (20 December 2024). “Mastercard finalizes acquisition of Recorded Future.” https://www.mastercard.com/news/press/2024/december/mastercard-finalizes-acquisition-of-recorded-future. Accessed 2026-10-09.↩︎

  40. Flashpoint (4 August 2022). “Flashpoint acquires Echosec Systems.” https://flashpoint.io/news/flashpoint-acquires-echosec-systems/. Accessed 2026-10-09.↩︎

  41. Bitsight (December 2024). “Bitsight completes acquisition of Cybersixgill.” https://www.bitsight.com/press-releases/bitsight-completes-acquisition-cyber-threat-intelligence-leader-cybersixgill. Accessed 2026-10-09.↩︎

  42. The Record (1 June 2022). “Digital Shadows to be bought by ReliaQuest for $160 million.” https://therecord.media/cybersecurity-firm-digital-shadows-to-be-bought-by-reliaquest-for-160-million/. Accessed 2026-10-09.↩︎

  43. Securitas (18 March 2026). “Securitas completes acquisition of Liferaft.” https://www.securitas.com/en/newsroom/press-releases_list/securitas-completes-acquisition-of-liferaft/. Accessed 2026-10-09.↩︎

  44. Linkurious (December 2025). “Nuix signs agreement to acquire Linkurious.” https://linkurious.com/blog/nuix-signs-agreement-to-acquire-linkurious/. Accessed 2026-10-09.↩︎

  45. Kaseware (4 November 2025). “Kaseware and OSINT Combine join forces.” https://www.kaseware.com/post/new-era-of-investigative-intelligence-kaseware-and-osint-combine-join-forces. Accessed 2026-10-09.↩︎