Click any tool for usage notes, input/output, and an OPSEC reminder before you query it.
Email & Domain Investigation
Phase 5 · Phase 6
Trace the sender, the sending domain, and the header path before touching a single link.
ICANN WHOIS Lookup details →
Registration and registrar data for a sending or spoofed domain — age, registrar, and status.
lookup.icann.org
MXToolbox details →
MX records, SPF/DKIM/DMARC lookups, and blacklist checks for the sending domain.
mxtoolbox.com
Message Header Analyzer details →
Pastes raw headers and maps the full relay path — where SPF/DKIM/DMARC actually broke down.
toolbox.googleapps.com
DNSDumpster details →
Maps a domain's DNS records and subdomains — useful for scoping lookalike infrastructure.
dnsdumpster.com
EmailRep details →
Reputation lookup for a sender address — account age, exposure, and known malicious activity.
emailrep.io
Have I Been Pwned details →
Checks whether the target address has appeared in known breaches — helps gauge how it was harvested.
haveibeenpwned.com
SecurityTrails details →
Historical DNS and WHOIS records — spot infrastructure reuse across older phishing campaigns.
securitytrails.com
IP & Infrastructure
Phase 5 · Phase 6
Once a link or attachment resolves to an IP, this is where I check who owns it, what's running on it, and what it's been used for.
VirusTotal details →
Runs a URL, file, or IP against dozens of AV and threat-intel engines at once.
virustotal.com
AbuseIPDB details →
Community-reported abuse history for an IP — spam, brute force, phishing hosting.
abuseipdb.com
Shodan details →
Shows what's actually running on a host — open ports, banners, and exposed services.
shodan.io
Censys details →
Certificate and host-level detail — often surfaces the real hosting behind a redirector.
search.censys.io
GreyNoise details →
Flags whether an IP is mass-scanning the internet — filters noise out of a real lead quickly.
viz.greynoise.io
Criminal IP details →
IP and domain risk scoring with linked phishing and malware detections.
criminalip.io
IPinfo details →
Fast geolocation, ASN, and hosting-provider lookup — good for a first-pass triage read.
ipinfo.io
Hurricane Electric BGP Toolkit details →
Traces an IP's ASN and announced routes — useful for chaining pivots across shared infrastructure.
bgp.he.net
IPVoid details →
Runs an IP across dozens of blacklist engines at once — a fast blacklist-status summary.
ipvoid.com
Talos Intelligence details →
Cisco's reputation lookup for an IP or domain, plus a live global spam/malware map.
talosintelligence.com
crt.sh details →
Searches certificate transparency logs — surfaces lookalike subdomains registered under the same cert.
crt.sh
URL & File Analysis
Phase 5
For when a link or attachment needs to run somewhere that isn't your own machine.
urlscan.io details →
Sandboxes a URL and returns the full page load — screenshot, requests, redirects, and DOM.
urlscan.io
ANY.RUN details →
Interactive malware sandbox — watch a suspicious attachment execute in real time.
any.run
Hybrid Analysis details →
Free automated sandbox for files and URLs, backed by CrowdStrike Falcon detections.
hybrid-analysis.com
CyberChef details →
Decodes and de-obfuscates the payload — base64, URL encoding, and chained transforms in one recipe.
gchq.github.io/CyberChef
Joe Sandbox details →
Deep behavioral analysis for files and URLs, with a detailed signature and IOC report.
joesandbox.com
Triage details →
Fast automated malware sandbox — good second opinion alongside ANY.RUN or Hybrid Analysis.
tria.ge
Wayback Machine details →
Views earlier snapshots of a phishing page — sometimes shows a version before it was taken down.
web.archive.org
Unfurl details →
Visual URL and QR-code parser built by a DFIR researcher — breaks a long or obfuscated URL into its structural parts.
dfir.blog/unfurl
Cloudflare Radar URL Scanner details →
Cloudflare's own URL sandbox and scanner — screenshot, requests, and a security verdict.
radar.cloudflare.com
MalwareBazaar details →
abuse.ch's public repository of shared malware samples, searchable by hash, tag, or signature.
bazaar.abuse.ch
MetaDefender Cloud details →
Multi-engine scanner that also flags files hidden inside documents.
metadefender.opswat.com
Intezer Analyze details →
Identifies the malware family by comparing code reuse, not just signatures.
analyze.intezer.com
Phishing Intelligence & Reporting
Phase 5 · Phase 6
Feeds and scanners built specifically around phishing URLs — check if it's already known, and where to report it.
PhishTank details →
Community-verified database of known phishing URLs — check a link or submit a new one.
phishtank.com
OpenPhish details →
Real-time feed of actively phishing URLs, auto-verified without human review.
openphish.com
CheckPhish details →
Free scanner that screenshots a URL and flags phishing, scam, or brand-impersonation pages.
checkphish.bolster.ai
phish.report details →
Identifies the host and registrar behind a phishing page and drafts the takedown report.
phish.report
Google Safe Browsing details →
Checks whether Google has already flagged the site as unsafe, and since when.
transparencyreport.google.com
URLVoid details →
Runs a domain across dozens of blacklist and reputation engines at once, similar to IPVoid but for URLs.
urlvoid.com
Threat & Breach Intelligence
Phase 6 · Attribution
Wider context once you have an IOC in hand — where it's been seen before and how it fits the bigger picture.
Intelligence X details →
Searches leaked datasets, the dark web, and historical web archives by email, domain, or hash.
intelx.io
CyberGordon details →
Runs one IOC — IP, domain, hash, or email — across dozens of reputation engines in a single pass.
cybergordon.com
BitcoinWhosWho details →
Looks up a Bitcoin wallet's transaction history and scam reports — useful on BEC and crypto-phishing cases.
bitcoinwhoswho.com
NVD (National Vulnerability Database) details →
The U.S. government's official CVE database — severity scoring and affected products for any known vulnerability.
nvd.nist.gov
LOLBAS details →
Catalog of legitimate Windows binaries that can be abused to download, execute, or hide malicious activity.
lolbas-project.github.io
GTFOBins details →
The Linux/Unix counterpart to LOLBAS — legitimate binaries that can be abused to bypass restrictions.
gtfobins.github.io
AlienVault OTX details →
Open threat-intel sharing platform — community-submitted "pulses" bundling IOCs tied to a specific campaign or actor.
otx.alienvault.com
ThreatMiner details →
Pivots a single IOC across passive DNS, malware samples, and related reports in one search.
threatminer.org
Exploit-DB details →
Archive of public proof-of-concept exploits, searchable by CVE or product.
exploit-db.com
IBM X-Force Exchange details →
IBM's threat-intelligence platform — IP/URL reputation plus vulnerability and malware collections.
exchange.xforce.ibmcloud.com
Feodo Tracker details →
abuse.ch's tracker for active botnet command-and-control (C2) servers.
feodotracker.abuse.ch
Pulsedive details →
Free aggregator of open threat feeds with its own IOC risk-scoring.
pulsedive.com
Frameworks & Methodology
Analysis & Reporting
Not lookup tools — the reference models that shape how you weigh an indicator and write the incident up once you've found it.
MITRE ATT&CK details →
Maps the phishing technique back to its ATT&CK ID and the rest of the adversary's likely playbook.
attack.mitre.org
MITRE D3FEND details →
Catalog of defensive countermeasures mapped against ATT&CK techniques — the "what do we do about it" counterpart.
d3fend.mitre.org
Pyramid of Pain details →
Ranks indicator types by how costly they are for an attacker to change — hashes cheapest, TTPs hardest.
sans.org
Diamond Model of Intrusion Analysis details →
Structures an intrusion around four linked elements: adversary, capability, victim, infrastructure.
activeresponse.org
Cyber Kill Chain details →
Lockheed Martin's seven-stage model of how an intrusion actually unfolds, end to end.
lockheedmartin.com
PICERL Incident Response Lifecycle details →
SANS's six-phase cycle for handling an incident start to finish.
sans.org
STIX / TAXII details →
The machine-readable format (STIX) and transport protocol (TAXII) most threat-intel platforms share data through.
docs.oasis-open.org
MISP details →
Open-source threat-intel platform for storing, correlating, and sharing IOCs across a team or community.
misp-project.org
OpenCTI details →
Open-source threat-intel platform built around a knowledge graph of actors, campaigns, and IOCs.
filigran.io
Social & Identity OSINT
Attribution
When an IOC points to a person, not just infrastructure — running down a handle or name across the web.
WhatsMyName details →
Checks a username against 700+ sites at once — the fastest first pass on a handle.
whatsmyname.app
Sherlock details →
Open-source command-line tool that hunts a username across social platforms — the maintained project behind most username-search clones.
github.com/sherlock-project
Namechk details →
Checks username and domain availability side by side — useful for spotting a squatted lookalike handle.
namechk.com
Social Searcher details →
Free real-time search across public social posts and mentions by keyword, hashtag, or user.
social-searcher.com
Whitepages details →
U.S. people-search — name, address, and phone history tied to a target identity.
whitepages.com
SearchPeopleFree details →
Free public-record aggregator — a second data point alongside Whitepages.
searchpeoplefree.com
PimEyes details →
Facial-recognition reverse image search — checks whether a profile photo is a stolen or stock image.
pimeyes.com
Image & Metadata Analysis
Phase 6
Verifying a logo, a screenshot, or a file's origin — where a picture has been before and what it's hiding.
TinEye details →
Reverse image search built for tracing where an image first appeared online.
tineye.com
Google Images details →
Reverse image search with the widest index — good for a fast first check on a logo or brand asset.
images.google.com
Yandex Images details →
Often surfaces matches Google and TinEye miss, particularly for faces and non-Western sources.
yandex.com/images
Metadata2Go details →
Pulls EXIF and file metadata from an image or document — camera, GPS, author, and edit history.
metadata2go.com
No tools match that filter.
Social & Identity OSINT
AttributionWhen an IOC points to a person, not just infrastructure — running down a handle or name across the web.