OSINT tools in Command One

Command One's own username prober checks a handle against a large platform catalogue using per-site detection rules, so results arrive in seconds without a worker.

Turns a person's name into realistic handle candidates you can feed into username modules.

The well-known open-source username hunter, run on Command One's worker fleet across hundreds of sites.

Builds a dossier on a username across thousands of sites and parses public profile details where it can.

Large-scale username enumeration with strong regional platform coverage.

Checks a username against the community-maintained WhatsMyName site list.

Sweeps a username or email across a curated site list and pulls metadata from positive hits.

Finds a username through several search engines at once.

Fast checks on an email address: domain mail records, disposable-provider detection and any public Gravatar profile.

Asks official platform signup endpoints whether a username or email is already taken.

Checks whether an email address is registered on more than a hundred services without alerting the owner.

Looks up public artefacts tied to a Google account, such as profile details and public Google services.

Runs several email intelligence checks in a single pass.

Recovers masked recovery-phone digits that providers reveal during password-reset flows.

Checks an email address against the XposedOrNot breach database through its commercial API+ service and returns full detail for every breach it appears in.

Parses and validates a phone number, then reports its country, number format and likely line type.

Live carrier and routing lookup for a phone number.

Checks whether a phone number is linked to accounts on supported services.

Gathers a phone number's footprint: carrier, country and public search mentions.

Quick passive look at a domain's DNS, mail setup and certificate surface.

Gathers emails, hostnames and subdomains for a domain from public sources.

Passive subdomain enumeration using search engines and public datasets.

Maps a domain's attack surface by discovering subdomains and related infrastructure.

Modular reconnaissance framework that gathers hosts and contacts for a domain.

Recursive attack-surface scanner that keeps expanding from each new discovery.

Searches public GitHub code for leaked secrets and references to a domain or identifier.

Scriptable recon framework that correlates findings from multiple sources.

Fast passive subdomain discovery from many public sources.

Resolves discovered hosts and collects their DNS records.

Probes hosts to find which ones serve web content.

Authorised port discovery against public IP addresses.

Maps an address or organisation to its autonomous system.

Reads Shodan's index of internet-exposed services for an address.

Adds VirusTotal reputation and relationship data to infrastructure findings.

Extracts links, endpoints and parameters from web pages and scripts.

Reads embedded metadata from images and documents.

Pulls every URL the Wayback Machine has recorded for a domain.

Gathers known URLs for a domain from several archive and crawl indexes.

Queries the Internet Archive's capture index for a host.

Looks up public urlscan.io scans for a domain or page.

Builds a set of ready-made search and lookup links so an analyst can verify a lead by hand.

Uses search engines to find mentions of a username or name and correlate them across sources.

Detects profiles for a handle on roughly 350 social sites and rates how well each match fits.

Automated OSINT framework with 200+ modules that collects and correlates data about a target.

Extracts public metadata from an Instagram account.

Collects public posts and profile data from supported social networks.

Sweeps social networks for accounts using a single handle.

Checks a handle against dating and adult platforms.

Searches the Intelligence X index of leaks, darknet pages and archived documents for a selector.

Checks whether a selector appears in known breach collections.

Searches DeHashed breach records by email, handle or phone.

Finds a domain's email patterns and verifies individual addresses.