Subfinder

Automated OSINT reconnaissance platform with over 200 data sources. Integrates Shodan, VirusTotal and HaveIBeenPwned.

Full-featured web reconnaissance framework designed to gather information from open sources quickly.

Tool for gathering emails, subdomains, IPs and URLs using multiple public data sources.

Network mapping and attack surface discovery tool. Finds subdomains and IPs.