Check my own domain exposure
Censys + Shodan + SpiderFoot
Start with Censys/Shodan passive lookup, then use SpiderFoot on a narrow authorized domain.
Open full guideAuthorized OSINT field guide · 2026-06-22
Choose the right OSINT tool and run your first safe task
Start with a clear job, a narrow authorized scope, and a tool that matches the evidence you actually need.
Decision helper
What do you need to do?
Choose a task and get a safe starting point.
Find public email or host footprint
theHarvester
Use theHarvester for a light pass; verify every result before reporting.
Open full guideRun a first SpiderFoot scan safely
SpiderFoot
Use a local web UI, a single owned test domain, conservative modules, and a written scope note.
Open full guideMap investigation relationships
Maltego
Use Maltego when links and entities matter more than raw collection volume.
Open full guideBuild a repeatable recon checklist
Recon-ng
Use Recon-ng only after the scope and data sources are well defined.
Open full guideSafe workflow
Start narrow, then widen only with permission
- ScopeOwn or written authorization
- PassiveSearch indexes and public records
- CollectUse the narrowest suitable tool
- VerifyRecord source, date and confidence
All tools at a glance
A compact comparison for authorized defensive work.
On small screens, swipe the table horizontally.
| Tool | Best for | Self-hosted | Cost | Setup | Risk |
|---|---|---|---|---|---|
| SpiderFootautomation framework | broad authorized asset inventory | yes | open source / commercial HX | medium | medium |
| theHarvesterCLI collector | domain, email and host discovery | yes | open source | low-medium | medium |
| Recon-ngrecon framework | repeatable modular reconnaissance workflows | yes | open source | high | medium |
| Maltegograph platform | relationship mapping and investigation graphs | partial | freemium / paid | medium | medium |
| Shodansearch engine | internet exposure lookup | no | limited free / paid | low | medium |
| Censyssearch engine | host and certificate exposure research | no | limited free / paid | low | medium |
Before you run any collection
- Confirm the asset, account, domain or investigation scope is yours or explicitly authorized.
- Prefer passive lookup first. Move to active checks only when permission and rate limits are clear.
- Record sources and checked dates. Do not turn weak public signals into proof.