Escalating a suspicious image to a commercial AI/deepfake detection provider

The public site presents a request-demo route rather than a self-service free allowance

Assessing local browser-fingerprint exposure before research

The project collects browser configuration data, uses a returning-visit cookie, and publishes aggregated statistics under its stated policy

Finding AngelPad-published alumni portfolio context for a company lead

The portfolio is publisher-curated rather than a corporate registry and may be historical, incomplete, changed, or unavailable

Comparing manually selected historical World Imagery basemap releases at a location

Wayback publication dates can differ from image acquisition dates and coverage or resolution varies by place

Manually reviewing a multi-chain wallet, transfer, entity, or token-context lead

Provider labels and entity associations can be incomplete, disputed, changed, or insufficient to prove identity, control, ownership, relationship, intent, misconduct, or a legal conclusion

Checking an upload-date lead for an authorized TikTok video URL before independent source review

The utility requires a user to disclose a URL to the page manually; OSINT Index never submits a URL

Documenting a Bitcoin address or transaction observation

Documented simple-query coverage is Bitcoin-specific; do not assume identical endpoints or fields for every chain

Following connected on-chain transaction paths

AutoTrace does not replace investigator judgment or independent validation

Reviewing local browser exposure before an analyst-controlled research session

The provider receives ordinary request data and can access browser/API-visible properties during a chosen test

Historical stack timelines

Detailed reports are expensive

Finding a Business Wire-distributed, issuer-attributed release with exact source and date context

The newsroom is a distribution service, not a corporate registry or independent verification source

Certificate pivots to hidden infrastructure

Free query quota is small

Checking an address against victim reports

Unverified user submissions

Reviewing Ukrainian party-finance donor, expense, report, or political-advertising leads

CHESNO is a civil-society analysis layer, not a substitute for primary NACP records, party filings, payment evidence, or legal findings

Checking a UK company, filing history, or officer lead against the official register

Companies House warns that it does not check the accuracy of filed information

Reviewing available provenance metadata before making a media-authenticity claim

The analyst must deliberately select a local asset in a third-party verifier; assess sensitivity before doing so

Reviewing Copernicus satellite product or visualization context for an analyst-defined location

Current provider documentation requires a free account and provider-side AOI, time, collection, and download interactions

Free subdomain discovery

Includes expired and never-deployed hosts

Starting a manual Cyprus company-record or filing-context check

Search, document access, certificates, orders, workspace, and filing workflows have separate portal conditions and possible fees

Finding source-attributed Ukrainian public datasets by publisher or place

Coverage, schema, update cadence, completeness, and accuracy vary by publishing authority and dataset

Reverse pivots from a leaked field

Subscription required for full records

Building a bounded DNS and subdomain lead set for an authorized domain

Submitting a domain discloses the target to a third-party service

Identifying the likely official business-register destination for a country or jurisdiction

Directory links can be stale, incomplete, unavailable, language-specific, or subject to destination controls and fees

Checking local browser privacy posture before manual research

The manual test collects browser and configuration data under EFF's published privacy notice

Google account footprint via Gmail address

Free tier limits daily lookups

Reviewing a manually supplied Ethereum address, transaction, token, or contract with chain context

An address, label, transaction, balance, contract, or transfer observation does not establish the controller's identity, intent, ownership, relationship, or legality

GPS and timestamp extraction

Social platforms strip EXIF on upload

Reviewing 3D building or terrain context around a candidate location

Rendered geometry can be stale, incomplete, approximate, or absent

Finding collection-scoped historical-record leads for lawful genealogy or historical research

Collections vary by place, period, indexing quality, image access, language, and rights; some features can require sign-in or affiliate access

Finding US federal candidate, committee, filing, receipt, or spending records with official source context

FEC data is limited to published US federal-election record types and can be amended, delayed, incomplete, or context-dependent

Separating local browser-session context for an analyst-defined lawful research workflow

Requires a supported Firefox environment and acceptance of the extension's requested browser permissions

Favicon-hash pivots

Account verification is awkward outside China

Reviewing an authorized image for provider-side forensic indicators

Use requires sending an image or URL to the provider, which can disclose media and metadata

Comparing a visible clue against a public regional reference page

Clues can be ambiguous, regionally overlapping, outdated, misread, or missing from the reference

Getting a first-pass regional lead from a permitted image with no GPS or EXIF

Public results are probabilistic and are strongest at country or region level rather than an exact street

Resolving place-name and alternate-name candidates to attributed geographic records

GeoNames integrates multiple sources and permits user edits, so records can be incomplete, stale, disputed, or imprecise

Finding a GlobeNewswire-distributed, issuer-attributed release with exact date and source context

The newsroom is a distribution service, not a corporate registry or independent verification source, and release content can be promotional, incomplete, amended, removed, restricted, or inaccurate

Dating construction or damage via imagery history

Imagery refresh varies wildly by region

Finding published fact-checking coverage of a public claim or source

Search coverage is limited to participating and indexed ClaimReview publishers

Finding web pages and similar images from a supplied image

It is not a people-identification operation

Checking Google's published Safe Browsing status for a manually chosen website

Entering a URL transmits it and ordinary browser-request data to Google

Fast breach confirmation

No plaintext credentials

Checking suspicious public media or a media URL for synthetic-content signals

Free detection tools and commercial API access have different capabilities and terms

Mapping an email to service accounts

Detection modules break as sites change

Preserving authorized web research with source, capture-time, and integrity context

Requires a supported local installation, browser extension, license, storage, and an analyst-managed case workflow

Deriving an org's email format

Sparse coverage for small firms

Recovering deleted pastes

Free tier heavily rate limited

Reviewing what a research browser exposes before beginning a lawful investigation

Opening the page exposes IP address, request headers, and browser-observable data to the provider

Triage of a public image or URL for possible AI generation

A detector verdict and confidence score are not proof of image origin or authorship

Finding official US lobbying registrations and quarterly activity reports with filing context

LDA records are limited to published statutory filing types and can be amended, delayed, incomplete, or context-dependent

Corporate exposure sweeps

Coverage differs from HIBP — cross-check both

Finding a public takedown-notice lead with sender, recipient, affected URL, and notice context

Notice presence is not proof of claim validity, authentication, wrongdoing, or provider action

Recursive alias expansion

Slow on full site lists

Visual link analysis across disparate investigative data

Connector data is third-party and is not guaranteed accurate, complete, available, or timely

Manually opening a multi-chain address or transaction lead for source-context review

Provider labels, risk signals, inferred paths, and entity associations require independent source, identity, and method review

Checking whether lunar direction or phase is plausible for a candidate place and time

Calculator output depends on the analyst's selected place, date, time, timezone, and interpretation

Reviewing publicly published Ukrainian asset declarations

Publication and search coverage can be restricted during martial law

Reviewing documented fire or thermal-anomaly observations around an analyst-defined location

Near-real-time detections can be revised or replaced by standard science-quality data

Reviewing source-attributed Earth-observation layers around a bounded location

Layer availability, latency, spatial resolution, cloud cover, processing level, and temporal coverage vary

Finding a company profile, publication, status, or register-context lead across supported jurisdictions

Profiles aggregate source material and can be incomplete, outdated, merged, split, privacy-masked, or jurisdiction-limited

Obtaining a second, source-attributed safety signal for a manually reviewed website

The analyst manually discloses the URL to Norton; OSINT Index does not submit or inspect it

Sanctions and PEP screening

Some collections require accreditation

Officer and director mapping

Registry freshness varies by country

Finding a documented sanctions or PEP lead for primary-source verification

A possible match is not a confirmed identity, designation, or legal conclusion

Selecting a specialized utility or curated bookmark collection

It is a launcher and collection, not a single data source

Narrowing candidate locations from visible features

Requires Overpass QL syntax

Exhaustive subdomain maps

Active modes are loud and detectable

Finding declared network, exchange, and facility presence by name or place

Records are user-maintained and do not independently establish current presence, ownership, control, routing, or operational status

Validating and classifying a number

No subscriber identity

Verifying whether a profile photo is reused

Source URLs hidden without a subscription

Finding Ukraine political-party, quarterly-report, election-fund, or bank-operation disclosures with statutory context

Published register records can be delayed, amended, incomplete, under review, or limited to statutory reporting periods and filing categories

Finding a publisher-distributed, issuer-attributed release with exact date and source context

The archive is a distribution service, not a corporate registry or independent verification source, and release content can be promotional, incomplete, amended, removed, restricted, or inaccurate

Reviewing US nonprofit Form 990 and audit context by organization, person, EIN, or filing period

IRS and ProPublica processing can lag the fiscal period, omit amended returns, duplicate filings, or lack extracted fields

Reviewing published Ukrainian procurement records

Tender participation does not prove beneficial ownership, collusion, or wrongdoing

Repeatable, module-specific recon after prerequisites are reviewed

The framework ships without modules; coverage depends on installed modules, dependencies, and third-party credentials

Finding official US SBIR/STTR award records with agency, program, phase, and fiscal-year context

Recent award data can be incomplete or change as agencies report, correct, and publish program records

Finding US public-company filings and issuer disclosures

EDGAR coverage concerns SEC filings and does not represent a complete global company registry

Proving past hosting relationships

Free plan gives ~50 queries/month

Finding public Canadian issuer profiles and securities filings with official source context

Only public-access documents are available to all users, and availability can change with filing status or corrections

Comparing scene shadows against a candidate location and time

Model quality depends on building and terrain data, local obstructions, perspective, selected time, and provider coverage

Alias sweeps across platforms

False positives on sites with soft 404s

Exposed service inventory

Scan data can be weeks stale

Finding Ukraine market-participant and issuer records with public securities-market context

Coverage is limited to SMIDA's published market-information records and can change with record status, publication, or regulatory context

Fast discovery of indexed public profiles from a name or username

It is not a social-network firehose or proof of completeness

Broad first-pass recon

Noisy output requires manual triage

Estimating capture time from shadows

Needs a known location and object height

Finding exact or altered copies

TinEye's First Found date is crawler discovery, not publication or first appearance

US address history

US-only coverage

Checking the public procedural status of a Ukrainian court matter

A party-name result can collide with another person or entity

Documenting the official Ukrainian property-record request route before an authorized request

The public information page is not proof that the full request flow is currently available

Checking a Ukrainian sanctions lead against the official register

Sanctions status is not a criminal conviction

Checking a Ukrainian legal entity or entrepreneur

A name match alone does not establish identity or control

Reading visible structural clues from an authorized URL or string before independent source review

The online page requires manual disclosure of a string or URL; sensitive identifiers and tokens must not be exposed without authorization

Checking public Ukrainian advocate registration details

A name match can collide with another person

Finding public Ukrainian court decisions for a lead

Published decisions are anonymized where required

Safely inspecting suspicious links

Public scans are visible to everyone — use unlisted mode

Manually triaging a suspicious but lawfully reviewable URL or host

A submitted host or URL is disclosed to URLVoid and can be shared under its published service terms

Checking US federal trademark application or registration context by mark, owner, serial, registration, or goods/services

Search results are not a clearance opinion and do not cover every common-law, foreign, state, domain, marketplace, or unregistered use

Finding a VAT ID, company name, address, or status lead for legitimate business-verification research

Results can involve sole traders and personal data, and may be fuzzy, stale, inactive, partially validated, or privacy-sensitive

Fast one-off DNS and reverse-IP pivots

API terms permit changing tool availability, functions, limits, and results

Passive DNS history

Uploads may be visible to other subscribers

Stack fingerprinting

Misses server-side tech

Comparing a site's historic claims with a current version

Coverage is not guaranteed: pages can be absent, excluded, login-protected, or blocked

No-install username checks

Browser CORS limits some checks

Finding a community-attributed place label or outline for a candidate location

User-contributed places can be stale, disputed, incomplete, duplicated, mislabeled, or privacy-sensitive

Finding international and participating-office trademark records

The database does not cover every national or regional register

Finding a Y Combinator-published startup profile with visible publisher context

The directory is publisher-curated rather than a corporate registry, and profile content or availability can change

Finding exact and similar images

Yandex does not guarantee complete or accurate results; ranking and index selection are automatic

Current banner and service fingerprint comparison

Search timestamps show the latest retained update, not a complete historical snapshot