# Hacker Bookmark List 🔥 Every Free Tool You Actually Need

**URL:** <https://onehack.st/t/hacker-bookmark-list-every-free-tool-you-actually-need/316888>\
**Category:** Tutorials & Methods\
**Tags:** freebies, trading\
**Created:** [January 16, 2026, 7:13pm UTC](https://onehack.st/t/hacker-bookmark-list-every-free-tool-you-actually-need/316888 "2026-01-16T19:13:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SRZ](https://onehack.st/user_avatar/onehack.st/srz/32/146132_2.png) [@SRZ](https://onehack.st/u/SRZ)\
**Post date:** [January 16, 2026, 7:13pm UTC](https://onehack.st/t/hacker-bookmark-list-every-free-tool-you-actually-need/316888/1 "2026-01-16T19:13:20Z")

</div>

# Online Investigation Tools 🕵 Organized By What You Want To Do

> 🗺 **One-Line Flow:** Bookmark this → look stuff up → feel like a hacker → actually stay safe online.

* * *

**Why this matters:**

Your data is already out there. Your passwords have probably leaked. That sketchy link your aunt sent? Could drain your bank account.

These tools let you check all of it — for free — without knowing a single line of code.

Consider this your cheat code to the internet’s security layer.

* * *

> **🗺️ WATCH HACKERS IN REAL TIME (Live Attack Maps)**
>
> Ever wanted to see cyberattacks happening _right now_? These maps visualize global hacking activity like a movie — except it’s real.
> 
> **Why bother:** Screenshots flex, conversation starter, reminds you the internet is a warzone.
> 
> | Map | Vibe |
> | --- | --- |
> | [Kaspersky Cybermap](https://cybermap.kaspersky.com/) | Spinning globe, very Matrix |
> | [Check Point ThreatMap](https://threatmap.checkpoint.com/) | Clean, attack types by country |
> | [Bitdefender ThreatMap](https://threatmap.bitdefender.com/) | Infections + attacks live |
> | [Digital Attack Map](https://www.digitalattackmap.com/) | DDoS visualized (Google-backed) |
> | [NETSCOUT Horizon](https://horizon.netscout.com/) | DDoS deep-dive, filterable |
> | [Radware Live Threat Map](https://livethreatmap.radware.com/) | Botnet activity |
> | [Imperva Threat Map](https://www.imperva.com/cyber-threat-attack-map/) | Bot + DDoS attacks |
> | [Fortinet Threat Map](https://threatmap.fortiguard.com/) | Attack severity + types |
> 
> _Open any of these at a coffee shop. Instant conversation starter._

> **🚨 LIVE RANSOMWARE VICTIM FEEDS (Watch Companies Get Hacked)**
>
> Ransomware gangs post their victims publicly. These sites scrape those leak sites so you don’t have to touch the dark web.
> 
> **Why bother:** See which companies just got breached before the news reports it. Wild entertainment value. Reminds you to back up your files.
> 
> | Tracker | What It Shows |
> | --- | --- |
> | [ransomware.live](https://www.ransomware.live/) | Real-time scraping of leak sites, new victims as posted |
> | [RansomLook](https://www.ransomlook.io/) | Group profiles, stats, API access |
> | [Ransom-DB](https://www.ransom-db.com/real-time-updates) | Live feed with victim details |
> | [DarkFeed](https://darkfeed.io/) | Ransomware monitor + video updates |
> 
> **GitHub bonus:** [ransomware.live source code](https://github.com/JMousqueton/ransomware.live) — see how it works

> **🔓 AM I ALREADY HACKED? (Breach Checkers)**
>
> Your email and passwords have probably leaked in at least one breach. These tools tell you which ones.
> 
> **Why bother:** Find out before someone else uses your credentials. Takes 5 seconds. Could save your bank account.
> 
> | Tool | What It Checks |
> | --- | --- |
> | [Have I Been Pwned](https://haveibeenpwned.com/) | Email in data breaches |
> | [HIBP Passwords](https://haveibeenpwned.com/Passwords) | Is this exact password exposed? |
> | [HIBP Pwned Websites](https://haveibeenpwned.com/PwnedWebsites) | Full breach database list |
> | [DataBreach.com](https://databreach.com) | Email, SSN, phone, address, username |
> | [Mozilla Monitor](https://monitor.mozilla.org/) | Privacy-focused breach scanner |
> 
> **What to do if you’re pwned:** Change password immediately → enable 2FA → check if you reused it anywhere else.

> **🔐 HOW FAST WOULD MY PASSWORD CRACK? (Strength Testers)**
>
> Type your password. Watch it calculate how long a computer would take to guess it. Humbling experience.
> 
> **Why bother:** Most people’s passwords crack in under a second. Find out before a hacker does.
> 
> | Tool | Special Feature |
> | --- | --- |
> | [Security.org Checker](https://www.security.org/how-secure-is-my-password/) | Shows crack time in years/seconds |
> | [Password Monster](https://passwordmonster.com/) | Detailed breakdown of weaknesses |
> | [NordPass Checker](https://nordpass.com/secure-password/) | Also checks against breach database |
> | [Bitwarden Tester](https://bitwarden.com/password-strength/) | Clean, trusted, no BS |
> | [Kaspersky Checker](https://password.kaspersky.com/) | Checks against known leaked passwords |
> | [Enzoic Password Check](https://www.enzoic.com/password-check/) | Billions of compromised passwords checked |
> | [DNS Checker](https://dnschecker.org/password-strength-checker.php) | Simple strength meter |
> 
> **Pro tip:** If it cracks in under 1 year, change it. If under 1 day, panic.

> **🔗 IS THIS LINK SAFE? (URL & Phishing Scanners)**
>
> Got a sketchy link? Paste it here before clicking. These tools scan for malware, phishing, and scam sites.
> 
> **Why bother:** One wrong click = malware, stolen credentials, or ransomware. 30 seconds of checking \> 30 hours of recovery.
> 
> | Scanner | Best For |
> | --- | --- |
> | [urlscan.io](https://urlscan.io/) | Deep scan with screenshots + DOM analysis |
> | [VirusTotal](https://www.virustotal.com/) | 70+ antivirus engines scan the URL |
> | [CheckPhish](https://checkphish.bolster.ai/) | Phishing + typosquat detection |
> | [URLVoid](https://www.urlvoid.com/) | 30+ blocklist engines |
> | [Sucuri SiteCheck](https://sitecheck.sucuri.net/) | Malware + blacklist scan |
> | [NordVPN Link Checker](https://nordvpn.com/link-checker/) | Quick safe/unsafe verdict |
> | [Bitdefender Link Checker](https://www.bitdefender.com/en-us/consumer/link-checker) | Shortened URL expansion |
> | [F-Secure Link Checker](https://www.f-secure.com/en/link-checker) | Fast, reliable |
> | [IPQualityScore](https://www.ipqualityscore.com/threat-feeds/malicious-url-scanner) | Phishing + C2 detection |
> | [EasyDMARC Phishing Checker](https://easydmarc.com/tools/phishing-url) | ML-based detection |
> | [URLert](https://www.urlert.com/) | AI-powered, catches cloaking attacks |
> 
> **How to use:** Copy link → paste → scan → read verdict → proceed (or don’t).

> **👤 FIND ANYONE BY USERNAME (Cross-Platform Search)**
>
> Enter a username. See every platform where that username exists. Works across 500-1500+ sites.
> 
> **Why bother:** Find someone’s other accounts. Check if YOUR username is taken everywhere. OSINT flex.
> 
> | Tool | Sites Searched |
> | --- | --- |
> | [WhatsMyName.io](https://whatsmyname.io/) | 1500+ platforms, web-based, free |
> | [SherlockOSINT](https://sherlockosint.com/) | Sherlock with a web interface |
> | [Namecheckup](https://namecheckup.com/) | Username availability across socials |
> | [OSINT.sh](https://osint.sh/) | Multi-tool: IP, domain, username, hash |
> | [Digital Footprint Check](https://www.digitalfootprintcheck.com/free-username-search) | 500+ platforms |
> | [Aware Online Username Tool](https://www.aware-online.com/en/osint-tools/username-search-tool/) | Custom search queries |
> 
> **CLI tools (for nerds):**
> 
> - [Sherlock (GitHub)](https://github.com/sherlock-project/sherlock) — the OG
> - [Blackbird](https://github.com/p1ngul1n0/blackbird) — 600+ sites + AI profiling
> - [WhatsMyName JSON](https://github.com/WebBreacher/WhatsMyName) — the data source many tools use
> 
> **More username tools:** [Massive list on GitHub](https://github.com/soxoj/osint-namecheckers-list)

> **🌐 IP & DOMAIN LOOKUP (Who Is This?)**
>
> Paste an IP address or domain. Get location, ISP, hosting info, and reputation.
> 
> **Why bother:** Trace where traffic comes from. Check if an IP is malicious. Find out who’s behind a website.
> 
> | Tool | What It Shows |
> | --- | --- |
> | [IPLocation.net](https://iplocation.net/) | Geo, ISP, map visualization |
> | [IPInfo.io](https://ipinfo.io/) | Clean API, ASN data, hostname |
> | [OSINT.sh IP Lookup](https://osint.sh/ip/) | IP + reverse lookup |
> | [Shodan](https://shodan.io/) | Search IoT devices by IP (advanced) |
> | [GreyNoise](https://greynoise.io/) | Is this IP scanning the internet? |
> | [IPVoid](https://www.ipvoid.com/) | Reputation + blocklist check |
> | [VirusTotal](https://www.virustotal.com/) | IP reputation from 70+ engines |
> | [AbuseIPDB](https://www.abuseipdb.com/) | Reported malicious IPs |
> 
> **Domain-specific:**
> 
> - [ViewDNS.info](https://viewdns.info/) — DNS records, reverse IP, history
> - [SecurityTrails](https://securitytrails.com/) — historical DNS data
> - [DNSlytics](https://dnslytics.com/) — domain intelligence

> **📧 WHERE DID THIS EMAIL COME FROM? (Header Analyzers)**
>
> Every email has hidden headers showing the path it traveled. Paste those headers here to trace the sender’s real IP and location.
> 
> **Why bother:** Verify if an email is legit. Trace phishing attempts. Find the actual source, not just the “From” field.
> 
> | Tool | Features |
> | --- | --- |
> | [Email Header Analyzer](https://emailheaderanalyzer.com/) | SPF/DKIM/DMARC checks, IP geolocation |
> | [IPLocation Email Analyzer](https://iplocation.io/email-header-analyzer) | Visual trace + map |
> | [DNS Checker Email Analyzer](https://dnschecker.org/email-header-analyzer.php) | Parse + geolocate sender |
> | [IPVoid Email Tracer](https://www.ipvoid.com/email-tracer/) | Simple, fast |
> | [WhatIsMyIP Analyzer](https://www.whatismyip.com/email-header-analyzer/) | Detailed breakdown |
> | [IP2Location Tracer](https://www.ip2location.com/free/email-tracer) | Geographic tracing |
> | [Trustifi Analyzer](https://trustifi.com/email-analyzer/) | Upload .eml files directly |
> 
> **How to get headers:**
> 
> - Gmail: Open email → 3 dots → “Show original”
> - Outlook: File → Properties → Internet headers
> - Yahoo: More → View raw message

> **📸 WHAT'S HIDDEN IN THIS FILE? (Metadata & EXIF Viewers)**
>
> Every photo, document, and video contains hidden data: GPS coordinates, device info, timestamps, author names.
> 
> **Why bother:** Find where a photo was taken. Check if a document was edited. Privacy check before sharing files.
> 
> | Tool | File Types |
> | --- | --- |
> | [EXIF.tools](https://exif.tools/) | Images — GPS, camera, timestamp |
> | [Metadata2Go](https://www.metadata2go.com/) | Images, docs, video, audio, ebooks |
> | [Jimpl](https://jimpl.com/) | Photo EXIF + map location |
> | [MetadataKit](https://metadatakit.com/metadata-viewer) | 500+ formats, forensic-level |
> | [ExifMeta](https://exifmeta.com/) | 50+ file types, powered by ExifTool |
> | [Online-Metadata](https://online-metadata.com/) | Video, audio, archives |
> | [ExifInfo.org](https://exifinfo.org/) | Media files + documents |
> 
> **What you might find:** Exact GPS coordinates, phone/camera model, software used, edit history, author name, creation date.

> **🎮 LEARN TO HACK (Legally) — Practice Platforms**
>
> These sites let you hack real systems — legally. Puzzles, challenges, virtual machines designed to be broken into.
> 
> **Why bother:** Build actual skills. Prep for cybersecurity careers. Fun hobby that might become a job.
> 
> | Platform | Skill Level | Cost |
> | --- | --- | --- |
> | [picoCTF](https://picoctf.org/) | Total beginner | FREE (CMU-backed) |
> | [TryHackMe](https://tryhackme.com/) | Beginner → Intermediate | Free tier available |
> | [OverTheWire Wargames](https://overthewire.org/wargames/) | Beginner (start with Bandit) | FREE |
> | [Hack The Box](https://www.hackthebox.com/) | Intermediate+ | Free tier available |
> | [Root Me](https://www.root-me.org/) | All levels, 600+ challenges | FREE |
> | [Hacker101](https://www.hacker101.com/) | Web security focus | FREE (HackerOne) |
> | [VulnHub](https://www.vulnhub.com/) | Download VMs to hack offline | FREE |
> | [RingZer0 CTF](https://ringzer0ctf.com/) | Varied challenges | FREE |
> 
> **Roadmap:** [350+ Free TryHackMe Rooms (GitHub)](https://github.com/uttambodara/TryHackMeRoadmap)
> 
> **Where to start:** picoCTF if total beginner → TryHackMe Pre-Security path → OverTheWire Bandit

> **📰 STAY UPDATED (News Without The Corporate Filter)**
>
> Where security researchers actually get their news. No fluff, no PR spin.
> 
> | Source | Format | Why It’s Good |
> | --- | --- | --- |
> | [vx-underground](https://vx-underground.org/) | Website + [Twitter/X](https://x.com/vxunderground) | Breach confirmations before anyone else, malware samples, memes |
> | [Darknet Diaries](https://darknetdiaries.com/) | Podcast | True crime for hackers, 150+ episodes |
> | [BleepingComputer](https://www.bleepingcomputer.com/) | News site | Tech security news, readable |
> | [The Record](https://therecord.media/) | News site | Recorded Future’s journalism arm |
> | [Malicious Life](https://malicious.life/) | Podcast | History of cyberattacks |
> 
> **Twitter/X accounts worth following:**
> 
> - [@vxunderground](https://x.com/vxunderground) — breach news + drama
> - [@malaboratory](https://x.com/malaboratory) — malware analysis
> - [@BleepinComputer](https://x.com/BleepinComputer) — breaking security news

> **🧰 ALL-IN-ONE TOOLKITS (Bookmarks That Do Everything)**
>
> Instead of 50 bookmarks, these sites bundle multiple tools together.
> 
> | Toolkit | What’s Inside |
> | --- | --- |
> | [OSINT.sh](https://osint.sh/) | IP lookup, reverse DNS, tech stack, WHOIS history, hash lookup, username search |
> | [OSINT Combine Tools](https://www.osintcombine.com/tools) | Social media geo-search, content verification, TikTok search, alt-tech platform search |
> | [OSINT Framework](https://osintframework.com/) | Massive categorized link tree of every OSINT tool |
> | [DeepDarkCTI (GitHub)](https://github.com/fastfire/deepdarkCTI) | Curated dark web intel sources |
> 
> **Social Media OSINT collection:** [GitHub mega-list](https://github.com/osintambition/Social-Media-OSINT-Tools-Collection)

> **🔬 MALWARE RESEARCH (For The Curious)**
>
> Want to see what malware looks like? These are educational resources used by actual researchers.
> 
> | Resource | What It Is |
> | --- | --- |
> | [vx-underground](https://vx-underground.org/) | Largest malware sample collection (35M+ samples) |
> | [MalwareSourceCode (GitHub)](https://github.com/vxunderground/MalwareSourceCode) | Source code of historical malware |
> | [ThreatFox (Abuse.ch)](https://threatfox.abuse.ch/) | Open-source IOC sharing |
> | [MalwareBazaar](https://bazaar.abuse.ch/) | Malware sample sharing |
> 
> ⚠ **Don’t download samples unless you know what you’re doing.** These are real malware. Use isolated VMs only.

* * *

## 🚀 Quick Start Guide

**Just got here? Do this:**

1. **Check yourself** → [haveibeenpwned.com](https://haveibeenpwned.com/) (email) + [Passwords](https://haveibeenpwned.com/Passwords) (your go-to password)
2. **Test your password** → [security.org checker](https://www.security.org/how-secure-is-my-password/)
3. **Watch the chaos** → [Kaspersky Cybermap](https://cybermap.kaspersky.com/)
4. **Look someone up** → [whatsmyname.io](https://whatsmyname.io/)
5. **Bookmark for sus links** → [urlscan.io](https://urlscan.io/)

**Want to learn more?** Start with [picoCTF](https://picoctf.org/) — it’s free and built for complete beginners.

**Want daily drama?** Follow [vx-underground on Twitter](https://x.com/vxunderground).

* * *

_All tools listed are free. No signups required for most. No dark web access needed._

---

<div class="post-metadata">

**Author:** ![MattyP](https://onehack.st/user_avatar/onehack.st/mattyp/32/154208_2.png) [@MattyP](https://onehack.st/u/MattyP)\
**Post date:** [January 17, 2026, 8:51pm UTC](https://onehack.st/t/hacker-bookmark-list-every-free-tool-you-actually-need/316888/2 "2026-01-17T20:51:34Z")

</div>

Great stuff. Thank you.