The honest answer to "what are the best free OSINT tools?" is: the best ones are the boring ones you script yourself, and the free tiers of the famous ones are marketing funnels. Both halves of that sentence cost me real money to learn.
The tier list, from someone who runs collection for a living
Free-and-actually-free:
-
t.me/s/preview — public Telegram channels as plain HTML: posts, view counts, subscriber counts, forward chains. No key, no account. The single most undervalued collection endpoint on the web. - Certificate transparency logs (crt.sh) — subdomain enumeration for free, with history.
-
GitHub code search — leaked configs, internal hostnames, forgotten API endpoints in committed
.envfiles. - Wayback Machine — the past tense of the web. Pages that were deleted still exist; claims that were edited are diffable.
-
Google dorking (
site:,intitle:,inurl:,filetype:) — 25 years old, still finds things Shodan misses.
Free-tier-that-plays-hard-to-get:
- Shodan (169 results, then a wall), Maltego (community edition), GreyNoise, VirusTotal (rate limits), haveibeenpwned (domain searches paid). Fine for spot checks; not for collection at scale. Budget for the moment you cross the wall — that moment always comes.
The pattern that kills hobby projects
Beginners collect tools. Practitioners collect pipelines. A tool list answers "what can I look at once?" A pipeline answers "what will I know every morning without opening a laptop?" Monitoring is the product; tools are components.
The pipeline shape that survives production:
- Poll public endpoints on a jittered cadence (5 min/channel, not 1 second globally).
- Persist raw responses timestamped — parsers improve, raw never changes.
- Key on IDs, not text (
data-postIDs, post IDs, cert serials). - Alert on the delta, on a baseline, with provenance attached.
- Page 503s: degrade a cycle, catch up on the window. Collectors die of drama, not traffic.
Where the free tools stop and paid work starts
Free tools give you data points. What clients pay for is the line through them: change detection that fires on the sentence that changed, coverage ceilings stated honestly, and a report a non-specialist can act on in five minutes. That gap — raw data to decision — is the market.
I sell the collection-layer playbook that fills it: cadence design, cursor pagination (?before= backfill), repost-ring flags, wording-diff alerting — $5: https://heyuhe.gumroad.com/l/poddr. A real sample brief, free, pay-what-you-want, $0 fine: https://heyuhe.gumroad.com/l/ruldgm.
The collector code in the pipeline section is expanded, with the failure modes, here: https://dev.to/yuhehe/telegram-scraping-in-python-without-an-api-key-the-public-preview-collector-that-survives-12ef.
Top comments (1)
tr.ee/dev-to