# Fifteen OSINT Tools, Homework Done, One File That Travels

**URL:** <https://onehack.st/t/fifteen-osint-tools-homework-done-one-file-that-travels/325267>\
**Category:** Tutorials & Methods\
**Tags:** hacking, freebies, self-hosted-tools\
**Created:** [September 3, 2026, 4:45pm UTC](https://onehack.st/t/fifteen-osint-tools-homework-done-one-file-that-travels/325267 "2026-09-03T16:45:05Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BCBC](https://onehack.st/user_avatar/onehack.st/bcbc/32/179606_2.png) [@BCBC](https://onehack.st/u/BCBC)\
**Post date:** [September 3, 2026, 4:45pm UTC](https://onehack.st/t/fifteen-osint-tools-homework-done-one-file-that-travels/325267/1 "2026-09-03T16:45:06Z")

</div>

### 🔍 Skip the afternoon of digging — fifteen OSINT tools already researched, ✏ and whatever you add 📤 goes with the file to whoever opens it next.

_OSINT — open-source intelligence: finding out about a person, company or domain from public data. This is a registry of the tools that do it._

```plaintext
Download
   ↓
Open HTML
   ↓
Use it

```

📎 **[BCBC-OSINT-Tools-Evaluation-Registry-v3-PUBLIC-2026-09-02.zip](https://onehack.st/uploads/short-url/A3QoCOew4OhMftEzMYvM38nrTM0.zip)** — 12.7 KB · MIT · nothing to install

```auto
What's in the file
──────────────────
15 tools already researched — site, docs, repo, licence, auth, alive-or-dead, evidence link
a lifecycle for each: NEW → REVIEW → TESTING → APPROVED / REJECTED / DEPRECATED
edit anything, add your own, then EXPORT — the new file carries everything you added

```

```auto
Below, three lanes — open the one you came for
──────────────────────────────────────────────
📦 THE FILE what it is · what a record holds · the 15 inside · search/edit
                   · why edits travel with the file · runs offline
🧠 THE THINKING evidence ≠ interpretation · privacy & authorization
                   · correlation ≠ proof · where this fits
🤝 WHAT'S NEXT what he wants from you · status · MIT · what's in the zip

```

I have been doing a lot of research lately into OSINT tools, APIs, agents, scanners, data providers, and the rapidly growing number of AI-assisted investigation projects appearing everywhere.

After looking at enough of them, I realized something:

> **We probably do not need another giant OSINT scanner.**
> 
> We need a better way to evaluate, organize, compare, document, and eventually integrate the good tools that already exist.

So I built this.

* * *

## 📦 THE FILE

> **📋 What it is — the evaluation flow**
>
> ### ➜ What is the BCBC OSINT Tools Evaluation Registry?
> 
> The **BCBC OSINT Tools Evaluation Registry** is a completely standalone HTML application designed to help researchers evaluate OSINT tools and providers before integrating them into a larger workflow.
> 
> It is not a scanner.
> 
> It does not automatically investigate anyone.
> 
> It does not phone home to BCBC.
> 
> It is essentially an **evidence-oriented research and engineering notebook that runs in your browser**.
> 
> The idea is simple:
> 
> ```plaintext
> OSINT tool discovered
> ↓
> Identify what it actually does
> ↓
> Find the OFFICIAL project
> ↓
> Find the documentation / API
> ↓
> Find the source repository
> ↓
> Check license / terms
> ↓
> Determine authentication requirements
> ↓
> Check whether the project is still alive
> ↓
> Record evidence
> ↓
> Evaluate it
> ↓
> TEST
> ↓
> APPROVE / REJECT / DEPRECATE
> ↓
> Only THEN consider integration
> 
> ```
> 
> That last part became very important to me.
> 
> There are a tremendous number of excellent projects available already.
> 
> Instead of constantly rebuilding mature plumbing, I want BCBC projects to sit **above proven tools** , preserve their evidence, and make their output easier for humans and AI systems to understand.

> **🗂️ What every record holds, and the lifecycle**
>
> ### ➜ What v3 Includes
> 
> The current release contains **15 researched provider/tool records**.
> 
> Each record can contain:
> 
> → Tool / provider name  
> → Current evaluation status  
> → Intended role  
> → BCBC integration decision  
> → Official website  
> → Documentation / API link  
> → Source repository  
> → License / terms information  
> → Authentication / access requirements  
> → Project activity / maintenance notes  
> → Evidence/reference URL  
> → Last verified date  
> → Free-form evaluation notes  
> → Searchable tags
> 
> ### ➜ Current Evaluation States
> 
> Every tool can move through a simple lifecycle:
> 
> ```plaintext
> NEW
> │
> ▼
> REVIEW
> │
> ▼
> TESTING
> │
> ├──────────────► REJECTED
> │
> ├──────────────► DEPRECATED
> │
> ▼
> APPROVED
> 
> ```
> 
> This keeps “interesting project I found on the Internet” separate from:
> 
> > **“We actually evaluated this and are comfortable depending on it.”**

> **🔍 The 15 tools inside — and why the dead ones stay**
>
> ### ➜ Some of the Tools Currently in the Registry
> 
> The release currently contains research records covering projects/providers such as:
> 
> ### Orchestration / Automated OSINT
> 
> → OpenOSINT  
> → SpiderFoot  
> → Taranis AI
> 
> ### Social / Identity Supporting Evidence
> 
> → OWASP SocialOSINTAgent
> 
> ### Phone Research
> 
> → PhoneInfoga
> 
> ### Domain / DNS / Infrastructure
> 
> → SecurityTrails  
> → RIPEstat  
> → BGPView — retained as a **deprecated historical entry**
> 
> ### Exposure / Breach Information
> 
> → Have I Been Pwned
> 
> ### Graph / Correlation
> 
> → Maltego
> 
> ### Network Discovery
> 
> → Nmap
> 
> ### Tool Discovery / Taxonomy
> 
> → OSINT Framework
> 
> ### Domain / Company Recon
> 
> → theHarvester
> 
> ### Website Technology Evidence
> 
> → BuiltWith
> 
> ### Internet-Facing Asset Context
> 
> → Shodan
> 
> ### ➜ An Important Example: Dead Projects Matter Too
> 
> One thing I specifically wanted this registry to handle is **tool decay**.
> 
> An OSINT list from two years ago may point you toward something that no longer exists.
> 
> That is exactly the kind of thing that wastes hours when building automation.
> 
> For example:
> 
> ```plaintext
> BGPView
> ↓
> Previously useful BGP / ASN provider
> ↓
> Service discontinued
> ↓
> Registry status = DEPRECATED
> ↓
> Replacement candidate = RIPEstat
> 
> ```
> 
> Instead of quietly deleting BGPView, I intentionally preserve the record.
> 
> Why?
> 
> Because this tells the next developer or AI agent:
> 
> > **We already investigated this. Do not waste another afternoon rediscovering why it doesn’t work.**
> 
> That is institutional memory.

> **✏️ Search it, edit it, it's yours**
>
> ### ➜ Search and Filtering
> 
> The registry can be searched instantly.
> 
> You can search things such as:
> 
> ```plaintext
> DNS
> 
> ```
> 
> ```plaintext
> API
> 
> ```
> 
> ```plaintext
> social
> 
> ```
> 
> ```plaintext
> graph
> 
> ```
> 
> ```plaintext
> open-source
> 
> ```
> 
> ```plaintext
> authorized-only
> 
> ```
> 
> You can also filter the complete registry by status:
> 
> → New  
> → Review  
> → Testing  
> → Approved  
> → Rejected  
> → Deprecated
> 
> ### ➜ Every Record is Editable
> 
> The supplied entries are not intended to be a sacred database.
> 
> They are starting research.
> 
> You can:
> 
> → Edit existing records  
> → Add providers  
> → Delete providers  
> → Change status  
> → Add notes  
> → Add evidence  
> → Update links  
> → Add tags  
> → Record new licensing information  
> → Change architectural decisions
> 
> It becomes **your own research registry**.
> 
> ### ➜ It Saves Locally
> 
> Edits can be stored locally by the browser.
> 
> There is no BCBC server required.
> 
> No account.
> 
> No database.
> 
> No installation.
> 
> Open the HTML file.
> 
> Use it.

> **📤 Why your edits travel with the file**
>
> ### ➜ But There Was a Problem With Browser-Local Storage…
> 
> This is something I specifically fixed before releasing it.
> 
> Originally the registry stored edits using browser `localStorage`.
> 
> That is great while working locally…
> 
> …but terrible if you spend hours editing the registry and then email the original HTML file to somebody.
> 
> Your changes stay in YOUR browser.
> 
> They do not magically travel with the file.
> 
> So v3 now includes:
> 
> ### ➜ EXPORT STANDALONE HTML
> 
> This is probably my favorite feature in the release.
> 
> You can edit the registry…
> 
> ```plaintext
> Original Registry
> ↓
> Add tools
> ↓
> Change statuses
> ↓
> Add research
> ↓
> Add evidence
> ↓
> Add notes
> ↓
> CLICK:
> Export Standalone HTML
> ↓
> New HTML file generated
> ↓
> CURRENT REGISTRY DATA IS EMBEDDED
> ↓
> Give that file to somebody else
> 
> ```
> 
> Now the research actually travels with the document.
> 
> That makes this useful as a portable research artifact rather than merely a browser application.
> 
> ### ➜ Other Export Options
> 
> The registry also supports:
> 
> ### JSON Export
> 
> Useful for:
> 
> → automation  
> → scripts  
> → databases  
> → APIs  
> → AI agents  
> → future BCBC Workbench integration
> 
> ### Markdown Report Export
> 
> Useful for:
> 
> → Discourse  
> → GitHub  
> → documentation  
> → project handoff  
> → research notes
> 
> ### Standalone HTML Export
> 
> Useful for:
> 
> → sharing  
> → archiving  
> → offline use  
> → transferring your current registry state
> 
> ### Print
> 
> Useful for:
> 
> → PDF  
> → hard-copy review  
> → audit trail  
> → project documentation

> **🔌 Runs offline, nothing to install**
>
> ### ➜ It Is Designed To Work Offline
> 
> The application itself is just HTML + CSS + JavaScript.
> 
> No framework.
> 
> No npm install.
> 
> No Docker container.
> 
> No server.
> 
> No database.
> 
> No cloud account.
> 
> No login.
> 
> ```plaintext
> Download
> ↓
> Open HTML
> ↓
> Use it
> 
> ```
> 
> That is the deployment procedure. 😄

## 🧠 THE THINKING

> **📐 Evidence is not interpretation — the core rule, and why**
>
> ### ➜ The Core Design Rule
> 
> The most important rule in this project is:
> 
> > **Evidence production and AI interpretation are two different things.**
> 
> A tool may tell us:
> 
> ```plaintext
> Domain registered: 2012-04-18
> 
> ```
> 
> An AI might interpret that as:
> 
> ```plaintext
> The domain has existed for more than a decade,
> which is generally more consistent with an established organization.
> 
> ```
> 
> Those are NOT the same thing.
> 
> The original evidence should remain intact.
> 
> So the BCBC model looks more like:
> 
> ```plaintext
> ┌──────────────────────┐
> │ OSINT PROVIDER │
> │ API / TOOL / DATA │
> └──────────┬───────────┘
> │
> ▼
> ┌──────────────────────┐
> │ RAW EVIDENCE │
> │ │
> │ Provider │
> │ Timestamp │
> │ Version │
> │ Result │
> └──────────┬───────────┘
> │
> ▼
> ┌──────────────────────┐
> │ BCBC EVIDENCE LAYER │
> │ │
> │ VERIFIED │
> │ CONTRADICTED │
> │ UNKNOWN │
> └──────────┬───────────┘
> │
> ▼
> ┌──────────────────────┐
> │ AI INTERPRETATION │
> │ │
> │ Explanation │
> │ Correlation │
> │ Suggested next check │
> └──────────────────────┘
> 
> ```
> 
> The AI should never silently replace the original evidence.
> 
> ### ➜ Why I Built It
> 
> One of the problems I keep seeing with AI-assisted research is that a system can produce an extremely convincing answer while hiding where the underlying facts came from.
> 
> That becomes dangerous very quickly.
> 
> I want a research system where somebody can ask:
> 
> **“Why did the system say that?”**
> 
> And the answer can actually be shown.
> 
> ```plaintext
> CLAIM
> ↓
> SOURCE
> ↓
> PROVIDER
> ↓
> RAW RESULT
> ↓
> TIME COLLECTED
> ↓
> INTERPRETATION
> 
> ```
> 
> That chain matters.
> 
> Especially when OSINT is eventually used for things like:
> 
> → recruiter verification  
> → company verification  
> → domain research  
> → infrastructure research  
> → fraud detection  
> → security work  
> → threat intelligence  
> → technical due diligence

> **🛡️ Privacy · authorization · correlation is not proof**
>
> ### ➜ Privacy
> 
> The registry itself does not investigate targets.
> 
> It is an evaluation database for tools.
> 
> That distinction is intentional.
> 
> ```plaintext
> REGISTRY
> │
> ├── Stores research
> ├── Stores evaluation decisions
> ├── Stores links
> ├── Stores evidence references
> └── DOES NOT automatically investigate targets
> 
> ```
> 
> If you later launch or integrate one of the listed third-party tools, then that tool has its own behavior, privacy implications, licenses, and terms.
> 
> Those should be evaluated separately.
> 
> ### ➜ Authorization Matters
> 
> Some OSINT tools are passive.
> 
> Some are not.
> 
> Some query third-party datasets.
> 
> Some perform active network discovery.
> 
> So the registry deliberately includes an authorization boundary.
> 
> For example:
> 
> ```plaintext
> Public information lookup
> ↓
> Generally passive research
> 
> versus
> 
> Network scanning
> ↓
> Only systems you own
> OR
> systems you have explicit authorization to test
> 
> ```
> 
> Putting everything under the label “OSINT” does not magically make every activity passive or authorized.
> 
> ### ➜ Correlation Is NOT Identity Proof
> 
> This is another BCBC rule I care about.
> 
> Suppose we discover:
> 
> ```plaintext
> Same name
> +
> Same company
> +
> Same username
> +
> Similar photograph
> 
> ```
> 
> That may be useful evidence.
> 
> It is NOT automatically proof that two records represent the same human being.
> 
> So BCBC tries to preserve three states:
> 
> ```plaintext
> VERIFIED
> CONTRADICTED
> UNKNOWN
> 
> ```
> 
> instead of forcing every result into:
> 
> ```plaintext
> TRUE
> FALSE
> 
> ```
> 
> The real world is usually messier than that.

> **🏗️ Where this fits — one evidence layer, many tools**
>
> ### ➜ Why This Exists Alongside the Recruiter Reality Check
> 
> Some people here may remember the **BCBC Job & Recruiter Reality Check** project I have also been working on.
> 
> That project was actually part of what pushed me toward this architecture.
> 
> Instead of building:
> 
> ```plaintext
> Recruiter Tool
> ↓
> 500 hard-coded OSINT integrations
> 
> ```
> 
> I would rather eventually have:
> 
> ```plaintext
> BCBC OSINT WORKBENCH
> │
> ┌─────────────┼──────────────┐
> │ │ │
> ▼ ▼ ▼
> Domain Data Social Data Phone Data
> │ │ │
> └─────────────┼──────────────┘
> │
> ▼
> EVIDENCE LAYER
> │
> ┌────────────┼─────────────┐
> │ │ │
> ▼ ▼ ▼
> Recruiter Security Research
> Reality Tools Tools
> Check
> 
> ```
> 
> One evidence architecture.
> 
> Many specialized applications.
> 
> That is the direction.
> 
> ### ➜ The Bigger Idea
> 
> I am increasingly convinced that the important part of AI systems is not merely:
> 
> > “Which model are you using?”
> 
> It is the machinery surrounding the model.
> 
> ```plaintext
> TOOLS
> ↓
> EVIDENCE
> ↓
> PROVENANCE
> ↓
> MEMORY
> ↓
> REASONING
> ↓
> HUMAN REVIEW
> 
> ```
> 
> Models will change.
> 
> APIs will change.
> 
> Companies will change.
> 
> Projects will disappear.
> 
> What should survive is the evidence and the reasoning trail explaining:
> 
> > **What did we know, where did we get it, and why did we make that decision?**
> 
> That is what I am trying to build toward.

## 🤝 WHAT’S NEXT

> **🙋 What he wants from you**
>
> ### ➜ What I Would Like From the Community
> 
> This is being released because I would rather people **use it, improve it, and tell me where it is wrong** than have it sitting on my drive forever waiting for some imaginary perfect version.
> 
> If you know of:
> 
> → a better provider  
> → a dead provider I missed  
> → a better API  
> → an incorrect license entry  
> → a free alternative  
> → a stronger open-source project  
> → a useful OSINT category  
> → something that should absolutely NOT be integrated  
> → a privacy concern  
> → a provenance problem  
> → an architectural improvement
> 
> Please post it.
> 
> That is exactly what the registry is for.
> 
> ### ➜ I Especially Want Help Finding Good Deterministic Providers
> 
> AI is great at interpretation.
> 
> But whenever possible, I want the evidence underneath it to come from something deterministic.
> 
> For example:
> 
> ```plaintext
> QUESTION:
> "When was this domain registered?"
> 
> BAD ARCHITECTURE:
> Ask AI to guess from Internet context.
> 
> BETTER ARCHITECTURE:
> RDAP / WHOIS provider
> ↓
> Raw registration date
> ↓
> Preserve evidence
> ↓
> AI explains what the date may mean
> 
> ```
> 
> That separation is extremely important to me.

> **✅ Status · MIT · what's in the zip**
>
> ### ➜ Free To Use / Modify / Improve
> 
> The registry application code is released under the **MIT License**.
> 
> Use it.
> 
> Modify it.
> 
> Fork it.
> 
> Add your own providers.
> 
> Teach with it.
> 
> Turn it into something better.
> 
> Give it away again.
> 
> Third-party tools, APIs, trademarks, documentation, and services naturally remain under their respective licenses and terms.
> 
> No third-party binaries are bundled with the registry.
> 
> ### ➜ Included With the Release
> 
> The downloadable package contains:
> 
> ```plaintext
> BCBC-OSINT-Tools-Evaluation-Registry-v3-PUBLIC-2026-09-02.html
> │
> ├── Standalone application
> │
> ├── Built-in research registry
> │
> ├── Search / filters
> │
> ├── Record editor
> │
> ├── JSON export
> │
> ├── Markdown export
> │
> ├── Standalone HTML export
> │
> └── Print / PDF support
> │
> ├── README
> │
> └── MIT License
> 
> ```
> 
> ### ➜ Current Status
> 
> ```plaintext
> [✓] Standalone browser application
> [✓] Search
> [✓] Status filtering
> [✓] Editable records
> [✓] Local persistence
> [✓] JSON export
> [✓] Markdown export
> [✓] Portable standalone HTML export
> [✓] Print / PDF
> [✓] Research/provider links populated
> [✓] License/access fields added
> [✓] Maintenance/activity fields added
> [✓] Deprecated-provider tracking
> [✓] Public-use warning
> [✓] MIT release
> [] Community testing
> [] More provider research
> [] Provider adapter prototype
> [] OSINT Workbench integration
> 
> ```
> 
> That last part is where you guys come in.

* * *

# ➜ Download

**The BCBC OSINT Tools Evaluation Registry v3 standalone HTML / release package is attached to this post.**

Download it.

Open it in your browser.

No installation required.

And if you improve it, please share what you changed so everybody can benefit.

## BCBC Technology

**Evidence before confidence.**

**Do not rebuild the plumbing if good plumbing already exists.**

**Preserve the WHY.**

* * *

### Credits

Built through ongoing BCBC research and development.

**Mikey\_LikesIT + ChatGPT**

Released freely for the community to use, study, modify, test, and improve.

Enjoy it. 🙂

[BCBC-OSINT-Tools-Evaluation-Registry-v3-PUBLIC-2026-09-02.zip](https://onehack.st/uploads/short-url/A3QoCOew4OhMftEzMYvM38nrTM0.zip) (12.7 KB)