The OSINT Tools Landscape (2026).
The OSINT tools landscape in 2026: 44 platforms across 10 categories, from Reddit archives to dark web monitoring and threat intel. Mapped by THINKPOL.
In this article
How to read this map
OSINT tooling stacks in four layers. At the base sit public archives (Wayback Machine, Common Crawl) that preserve the open web for free. Above them, web data and scraping APIs (Bright Data, Oxylabs, Zyte) deliver live web content at scale. The third layer is specialist collection: sources too hard to gather generically, including the grey web (pseudonymous public platforms such as Reddit; this is THINKPOL's layer), the dark web (DarkOwl, Aleph Networks), and breach data (SpyCloud, Intelligence X). At the top, analysis platforms (investigation suites, threat intelligence, SOCMINT, narrative intelligence) federate data from the layers below and turn it into decisions. Most professional teams run one analysis platform on top of several specialist sources.
Looking for the Reddit layer specifically? Start with our Reddit OSINT platform overview, the best Reddit OSINT tools ranked, or the free Reddit OSINT tools you can use today. For the deleted-content corner of that layer, see the deleted Reddit comments guide, the Reveddit and Pushshift alternatives, or the field-tested 2026 practitioner's guide.
Jump to a category
- Reddit archive & deleted-content search
- Investigation & link-analysis platforms
- People search & identity resolution
- Breach & leak intelligence
- Dark web monitoring
- Threat intelligence platforms
- Social media monitoring (SOCMINT)
- Narrative & media intelligence
- Web data & scraping APIs
- Public web archives
The grey web, platform by platform.
Vendors are one axis of this map. The other is the platform: what is public on it, what its search can and cannot do, which third-party tools still work, and what happens to deleted content. We maintain one verified guide per platform, each with a tool-by-tool verdict and the Reddit-side trail (invite links, handles and IDs posted on Reddit, including in posts since deleted).
- Telegram OSINT: Username and ID lookup, which search engines and bots work, what persists after deletion.
- Telegram search engines compared: Telegago, TGStat, Telemetry, Lyzem and the in-app bots, tested with verdicts.
- Discord OSINT: Snowflake IDs, user and server lookup, exports, and what the audit log does not show.
- Disboard alternatives: Discord server discovery sites ranked, and why bump listings are weak evidence.
- Instagram OSINT: What renders without an account, username lookup, and which tools survived the login wall.
- Picuki alternatives: The Instagram viewer graveyard (Picuki, Imginn, Dumpor) and what still works.
- Facebook OSINT: Life after Graph Search: ID lookup, dorks, group and Marketplace search, deleted posts.
- WeChat OSINT: ID search rules, official accounts and article search, what Tencent shares.
- LINE OSINT: Why ID search returns nothing, OpenChat rooms, official accounts.
- Decentralized platforms: IPFS, Arweave, Odysee and LBRY, Nostr, Mastodon: what persists and how to search it.
The 10 categories.
Reddit archive & deleted-content search
Tools that preserve and search Reddit content beyond what reddit.com shows, including posts and comments that were deleted, removed, or edited after publication.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| THINKPOL (that's us) | EU (France) | Reddit intelligence API over a private archive of 30+ billion posts and comments since 2005, including deleted and edited content, with sub-300ms full-archive search and a 15-second real-time firehose. | This is us. THINKPOL is the grey-web data layer: the archive Reddit's 2023 API lockdown made impossible to rebuild, delivered as an API that other platforms embed. |
| Reveddit | US | Free web tool that shows which of a user's Reddit comments were removed by moderators, by comparing the user-visible view with the public view. | Covers moderator-removed content only: it cannot show user-deleted content, and it depends on data sources that degraded after Reddit's 2023 API restrictions. |
| PullPush | Community project | Community-run API that reimplements the Pushshift interface for searching archived Reddit posts and comments. | The volunteer successor to Pushshift: useful for hobbyist lookups, but coverage gaps, rate limits, and uptime make it hard to build professional workflows on. |
| Wayback Machine (Internet Archive) | US (non-profit) | The Internet Archive's free archive of hundreds of billions of web page snapshots since 1996, retrievable by URL and date. | Snapshots pages, not platforms: a Reddit thread is only preserved if someone captured that exact URL before deletion; no user-level or full-text coverage. |
Investigation & link-analysis platforms
End-to-end platforms where analysts run investigations: entity graphs, link analysis, case management, and connectors that pull data in from many sources.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| Social Links | EU (NL) | OSINT investigation platform with 500+ data sources and extraction methods spanning social media, messengers, blockchains, and the dark web. | An aggregation layer by design: platforms like this embed specialist sources rather than rebuild them, which is exactly where a deep Reddit archive slots in. |
| ShadowDragon | US | Investigation tooling (SocialNet, Horizon) that maps identities and connections across 200+ online networks for law-enforcement and corporate investigators. | Strong cross-network link mapping; depends on what each source still exposes publicly; archived and deleted grey-web content sits outside its collection model. |
| PenLink (Cobwebs) | US / IL | Digital-intelligence suite combining lawful-intercept analytics with Cobwebs' web intelligence platform for law-enforcement investigations. | Communications-records DNA (call detail, lawful intercept) extended to open sources; grey-web depth comes from partners, not from a native archive. |
| Voyager Labs | US / IL | AI-based investigation platform that analyzes open, deep, and dark web sources to surface behavioral patterns and connections. | AI-first analysis over live collection; like most live-collection platforms, what a subject deleted before the investigation started is out of reach. |
| i2 (Harris) | US / UK | Analyst's Notebook and i2 suite, the long-standing standard for link-analysis charting in law enforcement and intelligence agencies. | The canvas, not the collection: i2 charts whatever data analysts import, which makes machine-readable intelligence APIs its natural upstream. |
| Siren | EU (IE) | Investigative intelligence platform built on Elasticsearch that federates search and link analysis across an organization's internal and external data. | Federated search over data you already have; external grey-web archives enter through connectors: the integration surface specialist APIs plug into. |
| Skopenow | US | Automated open-source reports on people and businesses: social profiles, vehicles, court records, assembled into a single dossier. | Report automation over live public profiles; strong for insurance/legal workflows, not designed for deleted-content forensics or API-first integration. |
| Fivecast | AU | Open-source intelligence collection and AI risk analytics (ONYX) for defence, national security, and law enforcement missions. | Mission-grade multi-platform collection with AI triage; Reddit depth beyond the live API is exactly the kind of source it federates. |
People search & identity resolution
Services that pivot from one identifier (email, username, phone) to accounts, profiles, and records associated with the same person across platforms.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| THINKPOL (that's us) | EU (France) | Reddit intelligence API over a private archive of 30+ billion posts and comments since 2005, including deleted and edited content, with sub-300ms full-archive search and a 15-second real-time firehose. | This is us. THINKPOL is the grey-web data layer: the archive Reddit's 2023 API lockdown made impossible to rebuild, delivered as an API that other platforms embed. |
| Social Links | EU (NL) | OSINT investigation platform with 500+ data sources and extraction methods spanning social media, messengers, blockchains, and the dark web. | An aggregation layer by design: platforms like this embed specialist sources rather than rebuild them, which is exactly where a deep Reddit archive slots in. |
| OSINT Industries | UK | Email, phone, and username enrichment that checks registration footprints across hundreds of online services in real time. | Answers 'where does this identifier have accounts' via live registration checks; deep per-platform history and deleted activity need a longitudinal archive on top. |
| Pipl | US / IL | Identity resolution engine that links emails, phones, addresses, and social handles into person profiles, used heavily in fraud and trust & safety. | Identity graph built on records and profile data; pseudonymous community activity (the grey web's core) is largely invisible to record-based graphs. |
| Skopenow | US | Automated open-source reports on people and businesses: social profiles, vehicles, court records, assembled into a single dossier. | Report automation over live public profiles; strong for insurance/legal workflows, not designed for deleted-content forensics or API-first integration. |
| Constella Intelligence | US / EU (ES) | Identity exposure intelligence over a curated data lake of breached and leaked identity records, used for executive protection and fraud. | Identity-record depth on the breach side; community-behavior depth (what a persona says and does over years) is the complementary axis. |
| Babel Street | US | Multilingual open-source data analytics (Babel X) with 200+ language coverage and identity intelligence for government missions. | Language breadth at government scale; platform-native archival depth is the complementary axis specialist providers supply. |
Breach & leak intelligence
Databases of compromised credentials and leaked datasets, used to check exposure and pivot between identities that share leaked identifiers.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| Intelligence X | EU (CZ) | Search engine and archive for leaked datasets, paste sites, domains, and darknet sources, queryable by selector (email, domain, IP, BTC address). | Leak-selector search with an archival mindset close to ours, applied to breach data rather than platform conversations; the two pivot well together. |
| SpyCloud | US | Recaptured breach and malware-infostealer data (500+ billion assets) powering account-takeover prevention and identity exposure analytics. | Credential exposure at enterprise scale; pairs naturally with conversation-layer intelligence: the leak tells you what, the forum chatter tells you who and why. |
| Constella Intelligence | US / EU (ES) | Identity exposure intelligence over a curated data lake of breached and leaked identity records, used for executive protection and fraud. | Identity-record depth on the breach side; community-behavior depth (what a persona says and does over years) is the complementary axis. |
| DeHashed | US | Low-cost credential and breach search engine with API access, popular with red teams and individual investigators. | The entry-level leak pivot: fast selector checks that feed bigger investigations, including grey-web persona work. |
Dark web monitoring
Crawlers and search engines for Tor hidden services, darknet markets, and criminal forums: the layer below the public (grey) web.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| Intelligence X | EU (CZ) | Search engine and archive for leaked datasets, paste sites, domains, and darknet sources, queryable by selector (email, domain, IP, BTC address). | Leak-selector search with an archival mindset close to ours, applied to breach data rather than platform conversations; the two pivot well together. |
| DarkOwl | US | One of the largest commercially available databases of darknet content, offered through search UI and APIs (Vision). | Tor-layer depth. The grey web sits one layer up: pseudonymous but public communities where actors surface before and after darknet activity. |
| Searchlight Cyber | UK | Dark web intelligence and investigation platform (DarkIQ, Cerberus) that monitors marketplaces, forums, and Tor traffic for enterprise and law enforcement. | Dark-web-native collection with investigation workflows; grey-web history is the adjacent layer such platforms typically source via partners. |
| Flashpoint | US | Threat data and intelligence spanning illicit forums, markets, chat services, and social platforms (acquired Echosec for geosocial monitoring). | Broad illicit-community coverage curated for CTI; a specialist longitudinal Reddit archive adds the mainstream-pseudonymous layer their analysts pivot through. |
| Cybersixgill (Bitsight) | IL / US | Automated deep and dark web collection with threat intelligence feeds and APIs, part of Bitsight since 2024. | API-first delivery philosophy close to ours, pointed at the dark web; the grey web is the complementary collection surface. |
| Web-IQ | EU (NL) | Dutch web intelligence provider that builds curated dark web and open web datasets and APIs for law enforcement and NGOs. | EU-based, data-as-a-service for LEA; structurally similar model to ours on a different layer; natural co-existence in the same platforms. |
| Aleph Networks | EU (France) | French dark web search engine that indexes Tor hidden services (~60,000 sites/year) for government and enterprise clients. | The French dark-web index; with THINKPOL covering the grey web, the two layers together map an actor's public-pseudonymous and hidden presence. |
| Intel 471 | US | Cybercrime intelligence built on human source networks inside underground communities plus automated malware and forum monitoring. | HUMINT-grade underground access; the public-pseudonymous layer (where actors recruit, brag, and leak) is the adjacent surface an archive covers systematically. |
Threat intelligence platforms
Platforms that turn collected data into finished threat intelligence: actor tracking, IOC feeds, alerting, and analyst reporting for security teams.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| Searchlight Cyber | UK | Dark web intelligence and investigation platform (DarkIQ, Cerberus) that monitors marketplaces, forums, and Tor traffic for enterprise and law enforcement. | Dark-web-native collection with investigation workflows; grey-web history is the adjacent layer such platforms typically source via partners. |
| Flashpoint | US | Threat data and intelligence spanning illicit forums, markets, chat services, and social platforms (acquired Echosec for geosocial monitoring). | Broad illicit-community coverage curated for CTI; a specialist longitudinal Reddit archive adds the mainstream-pseudonymous layer their analysts pivot through. |
| Cybersixgill (Bitsight) | IL / US | Automated deep and dark web collection with threat intelligence feeds and APIs, part of Bitsight since 2024. | API-first delivery philosophy close to ours, pointed at the dark web; the grey web is the complementary collection surface. |
| Recorded Future | US (Mastercard) | The largest commercial threat intelligence provider: the Intelligence Graph correlates open web, dark web, and technical sources into finished intelligence. | Category-defining breadth. Specialist archives exist because breadth platforms sample the grey web rather than preserve it; depth is the complement they buy in. |
| Intel 471 | US | Cybercrime intelligence built on human source networks inside underground communities plus automated malware and forum monitoring. | HUMINT-grade underground access; the public-pseudonymous layer (where actors recruit, brag, and leak) is the adjacent surface an archive covers systematically. |
| ZeroFox | US | External cybersecurity platform for brand protection, impersonation takedowns, and dark web monitoring across social and digital channels. | Protection and takedown workflows over live platforms; historical and deleted-content forensics is the layer beneath its alerting. |
| Silobreaker | UK / SE | Intelligence platform that aggregates and analyzes open web, news, and social data for threat, risk, and geopolitical teams. | Cross-source situational awareness; per-platform depth (full history, deleted content) comes from specialist upstream sources. |
Social media monitoring (SOCMINT)
Platforms that monitor mainstream social networks at scale for security-relevant signals: real-time alerting, geofencing, and multi-platform collection.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| ShadowDragon | US | Investigation tooling (SocialNet, Horizon) that maps identities and connections across 200+ online networks for law-enforcement and corporate investigators. | Strong cross-network link mapping; depends on what each source still exposes publicly; archived and deleted grey-web content sits outside its collection model. |
| PenLink (Cobwebs) | US / IL | Digital-intelligence suite combining lawful-intercept analytics with Cobwebs' web intelligence platform for law-enforcement investigations. | Communications-records DNA (call detail, lawful intercept) extended to open sources; grey-web depth comes from partners, not from a native archive. |
| Voyager Labs | US / IL | AI-based investigation platform that analyzes open, deep, and dark web sources to surface behavioral patterns and connections. | AI-first analysis over live collection; like most live-collection platforms, what a subject deleted before the investigation started is out of reach. |
| Flashpoint | US | Threat data and intelligence spanning illicit forums, markets, chat services, and social platforms (acquired Echosec for geosocial monitoring). | Broad illicit-community coverage curated for CTI; a specialist longitudinal Reddit archive adds the mainstream-pseudonymous layer their analysts pivot through. |
| ZeroFox | US | External cybersecurity platform for brand protection, impersonation takedowns, and dark web monitoring across social and digital channels. | Protection and takedown workflows over live platforms; historical and deleted-content forensics is the layer beneath its alerting. |
| Fivecast | AU | Open-source intelligence collection and AI risk analytics (ONYX) for defence, national security, and law enforcement missions. | Mission-grade multi-platform collection with AI triage; Reddit depth beyond the live API is exactly the kind of source it federates. |
| Babel Street | US | Multilingual open-source data analytics (Babel X) with 200+ language coverage and identity intelligence for government missions. | Language breadth at government scale; platform-native archival depth is the complementary axis specialist providers supply. |
| Dataminr | US | Real-time event and risk detection AI that turns public data from 500,000+ sources into alerts for newsrooms, corporations, and governments. | First-alert speed on breaking events; retrospective investigation (who seeded it, what was deleted) starts where alerting ends. |
Narrative & media intelligence
Tools that track how narratives spread: disinformation detection, bot/coordination analysis, and news media monitoring across languages.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| Silobreaker | UK / SE | Intelligence platform that aggregates and analyzes open web, news, and social data for threat, risk, and geopolitical teams. | Cross-source situational awareness; per-platform depth (full history, deleted content) comes from specialist upstream sources. |
| Exorde Labs | EU (France) | Decentralized protocol that scrapes public posts across many platforms and sells aggregated sentiment and narrative-trend data streams. | The closest French neighbor: breadth-first streams of current chatter across platforms, versus THINKPOL's depth-first longitudinal archive of one platform (including what was deleted). Different questions, different tools. |
| Blackbird.AI | US | Narrative intelligence platform (Constellation) that detects and scores narrative attacks, bot networks, and coordinated manipulation. | Narrative risk scoring downstream; upstream seeding evidence (original posts, deleted layers, account history) is the input layer archives provide. |
| Graphika | US | Network-map-based analysis of online communities, known for landmark public reports on influence operations. | Gold-standard IO cartography; longitudinal deleted-content evidence strengthens exactly the attribution chains their maps reveal. |
| Cyabra | IL / US | Social threat intelligence that measures fake-account prevalence and coordinated inauthentic behavior around brands and elections. | Authenticity scoring on live profiles; account history that predates the campaign (and what it deleted) lives in archives. |
| Opoint | EU (NO) | Real-time news media monitoring covering 240,000+ sources globally, delivered as structured data feeds for media-intelligence products. | The news-media layer of the same thesis: structured feeds others build on. News tells you what was published; the grey web tells you what communities did with it. |
| Logically | UK | AI-plus-analyst misinformation detection and fact-checking services for governments and platforms. | Claim-level verification; provenance (where a claim was seeded and by whom) is the archive-side question that complements it. |
Web data & scraping APIs
Developer-facing APIs and infrastructure that deliver raw or structured web data at scale; the plumbing many intelligence products are built on.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| THINKPOL (that's us) | EU (France) | Reddit intelligence API over a private archive of 30+ billion posts and comments since 2005, including deleted and edited content, with sub-300ms full-archive search and a 15-second real-time firehose. | This is us. THINKPOL is the grey-web data layer: the archive Reddit's 2023 API lockdown made impossible to rebuild, delivered as an API that other platforms embed. |
| Common Crawl | US (non-profit) | Open repository of web crawl data: petabytes of raw page captures released monthly, widely used to train and ground AI systems. | Breadth over depth: broad web coverage on a monthly cadence, with no platform-native structure (no authors, threads, or vote data) and no deleted-content capture. |
| Web-IQ | EU (NL) | Dutch web intelligence provider that builds curated dark web and open web datasets and APIs for law enforcement and NGOs. | EU-based, data-as-a-service for LEA; structurally similar model to ours on a different layer; natural co-existence in the same platforms. |
| Exorde Labs | EU (France) | Decentralized protocol that scrapes public posts across many platforms and sells aggregated sentiment and narrative-trend data streams. | The closest French neighbor: breadth-first streams of current chatter across platforms, versus THINKPOL's depth-first longitudinal archive of one platform (including what was deleted). Different questions, different tools. |
| Opoint | EU (NO) | Real-time news media monitoring covering 240,000+ sources globally, delivered as structured data feeds for media-intelligence products. | The news-media layer of the same thesis: structured feeds others build on. News tells you what was published; the grey web tells you what communities did with it. |
| Bright Data | IL / US | The largest web-data platform: proxy infrastructure, scraping APIs, and ready-made datasets covering most major websites. | General-purpose collection infrastructure; live scraping can't recover what was already deleted; that requires having archived it first. |
| Oxylabs | EU (LT) | Proxy network and web-scraping APIs for large-scale public data gathering, with an EU corporate base. | Live-collection plumbing; platform-specific archives are the layer above raw access. |
| Zyte | EU (IE) | Web scraping API and services company (maintainers of the Scrapy framework) delivering structured data extraction at scale. | Extraction expertise for the open web; conversation platforms with anti-scraping walls and deletion dynamics need dedicated archival pipelines. |
| Apify | EU (CZ) | Marketplace of 4,000+ ready-made scrapers (Actors) plus a platform to build and run custom web automation. | Long-tail scraper marketplace: its Reddit actors read what reddit.com shows today: the live view, not the historical or deleted record. |
| Nimble | IL / US | AI-powered web data collection platform with specialized APIs (SERP, e-commerce, social) built for feeding data pipelines and AI agents. | Agent-era live collection; archival depth per platform is the complementary dataset AI pipelines increasingly pull alongside. |
| Datashake | UK | Aggregated web data APIs: reviews, profiles, and web content from hundreds of sources unified into one schema. | Aggregation-by-API for review and profile data; the same buy-not-build logic applies to grey-web conversation data. |
Public web archives
Free, public preservation projects that snapshot web pages over time: the baseline any investigator uses to see what a page looked like in the past.
| Name | HQ | What it does | Angle |
|---|---|---|---|
| Wayback Machine (Internet Archive) | US (non-profit) | The Internet Archive's free archive of hundreds of billions of web page snapshots since 1996, retrievable by URL and date. | Snapshots pages, not platforms: a Reddit thread is only preserved if someone captured that exact URL before deletion; no user-level or full-text coverage. |
| archive.today | Undisclosed | On-demand page archiver that stores an exact, unalterable snapshot of any URL at the moment a user submits it. | Great for preserving evidence you already found; useless for discovering content that was deleted before anyone thought to capture it. |
| Common Crawl | US (non-profit) | Open repository of web crawl data: petabytes of raw page captures released monthly, widely used to train and ground AI systems. | Breadth over depth: broad web coverage on a monthly cadence, with no platform-native structure (no authors, threads, or vote data) and no deleted-content capture. |
All 44 vendors.
Each vendor appears once; multi-category vendors carry every tag they belong to. Filter by category or sort alphabetically.
- THINKPOL (that's us) · EU (France) (Reddit archive & deleted-content search, People search & identity resolution, Web data & scraping APIs)
- Reveddit · US (Reddit archive & deleted-content search)
- PullPush · Community project (Reddit archive & deleted-content search)
- Wayback Machine (Internet Archive) · US (non-profit) (Public web archives, Reddit archive & deleted-content search)
- archive.today · Undisclosed (Public web archives)
- Common Crawl · US (non-profit) (Public web archives, Web data & scraping APIs)
- Social Links · EU (NL) (Investigation & link-analysis platforms, People search & identity resolution)
- ShadowDragon · US (Investigation & link-analysis platforms, Social media monitoring (SOCMINT))
- PenLink (Cobwebs) · US / IL (Investigation & link-analysis platforms, Social media monitoring (SOCMINT))
- Voyager Labs · US / IL (Investigation & link-analysis platforms, Social media monitoring (SOCMINT))
- i2 (Harris) · US / UK (Investigation & link-analysis platforms)
- Siren · EU (IE) (Investigation & link-analysis platforms)
- OSINT Industries · UK (People search & identity resolution)
- Pipl · US / IL (People search & identity resolution)
- Skopenow · US (People search & identity resolution, Investigation & link-analysis platforms)
- Intelligence X · EU (CZ) (Breach & leak intelligence, Dark web monitoring)
- SpyCloud · US (Breach & leak intelligence)
- Constella Intelligence · US / EU (ES) (Breach & leak intelligence, People search & identity resolution)
- DeHashed · US (Breach & leak intelligence)
- DarkOwl · US (Dark web monitoring)
- Searchlight Cyber · UK (Dark web monitoring, Threat intelligence platforms)
- Flashpoint · US (Dark web monitoring, Threat intelligence platforms, Social media monitoring (SOCMINT))
- Cybersixgill (Bitsight) · IL / US (Dark web monitoring, Threat intelligence platforms)
- Web-IQ · EU (NL) (Dark web monitoring, Web data & scraping APIs)
- Aleph Networks · EU (France) (Dark web monitoring)
- Recorded Future · US (Mastercard) (Threat intelligence platforms)
- Intel 471 · US (Threat intelligence platforms, Dark web monitoring)
- ZeroFox · US (Threat intelligence platforms, Social media monitoring (SOCMINT))
- Silobreaker · UK / SE (Threat intelligence platforms, Narrative & media intelligence)
- Fivecast · AU (Social media monitoring (SOCMINT), Investigation & link-analysis platforms)
- Babel Street · US (Social media monitoring (SOCMINT), People search & identity resolution)
- Dataminr · US (Social media monitoring (SOCMINT))
- Exorde Labs · EU (France) (Narrative & media intelligence, Web data & scraping APIs)
- Blackbird.AI · US (Narrative & media intelligence)
- Graphika · US (Narrative & media intelligence)
- Cyabra · IL / US (Narrative & media intelligence)
- Opoint · EU (NO) (Narrative & media intelligence, Web data & scraping APIs)
- Logically · UK (Narrative & media intelligence)
- Bright Data · IL / US (Web data & scraping APIs)
- Oxylabs · EU (LT) (Web data & scraping APIs)
- Zyte · EU (IE) (Web data & scraping APIs)
- Apify · EU (CZ) (Web data & scraping APIs)
- Nimble · IL / US (Web data & scraping APIs)
- Datashake · UK (Web data & scraping APIs)
How THINKPOL fits.
THINKPOL is the specialist grey-web data layer of this map: the Reddit archive that investigation platforms, threat intelligence teams, and analysis suites plug in when they need depth the live platform no longer shows.
- 30+ billion Reddit posts and comments archived since 2005, including content deleted or edited after publication.
- Sub-300ms full-text search across the entire archive, plus a 15-second real-time firehose for live monitoring.
- EU-hosted (France), GDPR-native, and outside US CLOUD Act reach: a structural requirement for European government and defence buyers.
See how the grey-web layer is used in law enforcement and cyber threat intelligence, explore the platform capabilities, or try the free tools.
Common questions about OSINT tools.
What are the main categories of OSINT tools?
OSINT tools fall into ten main categories: Reddit archive and deleted-content search, investigation and link-analysis platforms, people search and identity resolution, breach and leak intelligence, dark web monitoring, threat intelligence platforms, social media monitoring (SOCMINT), narrative and media intelligence, web data and scraping APIs, and public web archives. Most professional workflows combine one analysis platform with several specialist data sources underneath it.
What is the difference between OSINT platforms and data providers?
OSINT platforms are where analysts work: investigation suites such as i2 or Siren, threat intelligence platforms such as Recorded Future, and SOCMINT tools such as Fivecast provide search, link analysis, alerting, and case management. Data providers supply the collection underneath: web scraping APIs, breach databases, dark web indexes, and platform archives such as THINKPOL's Reddit archive. Platforms typically integrate specialist providers rather than rebuild deep collection themselves, so most buyers end up needing both layers.
Which OSINT tools cover deleted content?
Very few. THINKPOL archives Reddit continuously and retains 30+ billion posts and comments since 2005, including content deleted or edited after publication. Reveddit shows moderator-removed Reddit comments but not user-deleted content, and PullPush is a community-run archived Reddit search with coverage gaps. The Wayback Machine and archive.today preserve a page only if someone captured that exact URL before it was deleted.
Which OSINT tools are EU-based?
EU-headquartered vendors in this landscape include THINKPOL, Aleph Networks, and Exorde Labs (France), Social Links and Web-IQ (Netherlands), Siren and Zyte (Ireland), Intelligence X and Apify (Czech Republic), Oxylabs (Lithuania), and Opoint (Norway). For European government and defence buyers this matters structurally: data hosted and incorporated under EU law is not compellable under the US CLOUD Act.
Which OSINT tools do law enforcement agencies use?
Law enforcement teams typically run an investigation platform (i2, Siren, PenLink, ShadowDragon) fed by specialist sources: dark web indexes such as Aleph Networks and Web-IQ, breach intelligence such as Intelligence X, and grey-web archives such as THINKPOL for full Reddit history including deleted content. Mission-focused SOCMINT platforms such as Fivecast and Babel Street cover multi-platform collection for national security cases.
Share
THINKPOL
Grey web intelligence
Investigations and analysis from the THINKPOL team, built on a 30-billion-post Reddit archive with deleted content preserved.
Newsletter
Grey web intelligence, in your inbox.
One email a month: new investigations, tool updates and what changed on the platforms we monitor.
Only one email per month. No spam.
