The OSINT Tools
Landscape (2026).
The OSINT tool market covers every layer between raw public data and finished intelligence: public archives, collection APIs, specialist sources, and analysis platforms. This page maps 44 vendors across 10 categories, from Reddit archives to dark web monitoring and threat intelligence. It is maintained by THINKPOL, operator of a private Reddit archive of 30+ billion posts and comments.
Last updated July 2026 · 44 vendors · 10 categories
OSINT tooling stacks in four layers. At the base sit public archives (Wayback Machine, Common Crawl) that preserve the open web for free. Above them, web data and scraping APIs (Bright Data, Oxylabs, Zyte) deliver live web content at scale. The third layer is specialist collection: sources too hard to gather generically, including the grey web (pseudonymous public platforms such as Reddit; this is THINKPOL's layer), the dark web (DarkOwl, Aleph Networks), and breach data (SpyCloud, Intelligence X). At the top, analysis platforms (investigation suites, threat intelligence, SOCMINT, narrative intelligence) federate data from the layers below and turn it into decisions. Most professional teams run one analysis platform on top of several specialist sources.
Looking for the Reddit layer specifically? Start with our Reddit OSINT platform overview, the best Reddit OSINT tools ranked, or the free Reddit OSINT tools you can use today.
Reddit archive & deleted-content search
Tools that preserve and search Reddit content beyond what reddit.com shows — including posts and comments that were deleted, removed, or edited after publication.
Reddit intelligence API over a private archive of 30+ billion posts and comments since 2005, including deleted and edited content, with sub-300ms full-archive search and a 15-second real-time firehose.
This is us. THINKPOL is the grey-web data layer: the archive Reddit's 2023 API lockdown made impossible to rebuild, delivered as an API that other platforms embed.
Free web tool that shows which of a user's Reddit comments were removed by moderators, by comparing the user-visible view with the public view.
Covers moderator-removed content only — it cannot show user-deleted content, and it depends on data sources that degraded after Reddit's 2023 API restrictions.
Community-run API that reimplements the Pushshift interface for searching archived Reddit posts and comments.
The volunteer successor to Pushshift: useful for hobbyist lookups, but coverage gaps, rate limits, and uptime make it hard to build professional workflows on.
The Internet Archive's free archive of hundreds of billions of web page snapshots since 1996, retrievable by URL and date.
Snapshots pages, not platforms: a Reddit thread is only preserved if someone captured that exact URL before deletion — no user-level or full-text coverage.
Investigation & link-analysis platforms
End-to-end platforms where analysts run investigations: entity graphs, link analysis, case management, and connectors that pull data in from many sources.
OSINT investigation platform with 500+ data sources and extraction methods spanning social media, messengers, blockchains, and the dark web.
An aggregation layer by design — platforms like this embed specialist sources rather than rebuild them, which is exactly where a deep Reddit archive slots in.
Investigation tooling (SocialNet, Horizon) that maps identities and connections across 200+ online networks for law-enforcement and corporate investigators.
Strong cross-network link mapping; depends on what each source still exposes publicly — archived and deleted grey-web content sits outside its collection model.
Digital-intelligence suite combining lawful-intercept analytics with Cobwebs' web intelligence platform for law-enforcement investigations.
Communications-records DNA (call detail, lawful intercept) extended to open sources; grey-web depth comes from partners, not from a native archive.
AI-based investigation platform that analyzes open, deep, and dark web sources to surface behavioral patterns and connections.
AI-first analysis over live collection; like most live-collection platforms, what a subject deleted before the investigation started is out of reach.
Analyst's Notebook and i2 suite — the long-standing standard for link-analysis charting in law enforcement and intelligence agencies.
The canvas, not the collection: i2 charts whatever data analysts import, which makes machine-readable intelligence APIs its natural upstream.
Investigative intelligence platform built on Elasticsearch that federates search and link analysis across an organization's internal and external data.
Federated search over data you already have; external grey-web archives enter through connectors — the integration surface specialist APIs plug into.
Automated open-source reports on people and businesses: social profiles, vehicles, court records, assembled into a single dossier.
Report automation over live public profiles; strong for insurance/legal workflows, not designed for deleted-content forensics or API-first integration.
People search & identity resolution
Services that pivot from one identifier (email, username, phone) to accounts, profiles, and records associated with the same person across platforms.
Reddit intelligence API over a private archive of 30+ billion posts and comments since 2005, including deleted and edited content, with sub-300ms full-archive search and a 15-second real-time firehose.
This is us. THINKPOL is the grey-web data layer: the archive Reddit's 2023 API lockdown made impossible to rebuild, delivered as an API that other platforms embed.
OSINT investigation platform with 500+ data sources and extraction methods spanning social media, messengers, blockchains, and the dark web.
An aggregation layer by design — platforms like this embed specialist sources rather than rebuild them, which is exactly where a deep Reddit archive slots in.
Email, phone, and username enrichment that checks registration footprints across hundreds of online services in real time.
Answers 'where does this identifier have accounts' — live registration checks; deep per-platform history and deleted activity need a longitudinal archive on top.
Identity resolution engine that links emails, phones, addresses, and social handles into person profiles, used heavily in fraud and trust & safety.
Identity graph built on records and profile data; pseudonymous community activity (the grey web's core) is largely invisible to record-based graphs.
Automated open-source reports on people and businesses: social profiles, vehicles, court records, assembled into a single dossier.
Report automation over live public profiles; strong for insurance/legal workflows, not designed for deleted-content forensics or API-first integration.
Identity exposure intelligence over a curated data lake of breached and leaked identity records, used for executive protection and fraud.
Identity-record depth on the breach side; community-behavior depth (what a persona says and does over years) is the complementary axis.
Breach & leak intelligence
Databases of compromised credentials and leaked datasets, used to check exposure and pivot between identities that share leaked identifiers.
Search engine and archive for leaked datasets, paste sites, domains, and darknet sources, queryable by selector (email, domain, IP, BTC address).
Leak-selector search with an archival mindset close to ours — applied to breach data rather than platform conversations; the two pivot well together.
Recaptured breach and malware-infostealer data (500+ billion assets) powering account-takeover prevention and identity exposure analytics.
Credential exposure at enterprise scale; pairs naturally with conversation-layer intelligence — the leak tells you what, the forum chatter tells you who and why.
Identity exposure intelligence over a curated data lake of breached and leaked identity records, used for executive protection and fraud.
Identity-record depth on the breach side; community-behavior depth (what a persona says and does over years) is the complementary axis.
Dark web monitoring
Crawlers and search engines for Tor hidden services, darknet markets, and criminal forums — the layer below the public (grey) web.
Search engine and archive for leaked datasets, paste sites, domains, and darknet sources, queryable by selector (email, domain, IP, BTC address).
Leak-selector search with an archival mindset close to ours — applied to breach data rather than platform conversations; the two pivot well together.
One of the largest commercially available databases of darknet content, offered through search UI and APIs (Vision).
Tor-layer depth. The grey web sits one layer up: pseudonymous but public communities where actors surface before and after darknet activity.
Dark web intelligence and investigation platform (DarkIQ, Cerberus) that monitors marketplaces, forums, and Tor traffic for enterprise and law enforcement.
Dark-web-native collection with investigation workflows; grey-web history is the adjacent layer such platforms typically source via partners.
Threat data and intelligence spanning illicit forums, markets, chat services, and social platforms (acquired Echosec for geosocial monitoring).
Broad illicit-community coverage curated for CTI; a specialist longitudinal Reddit archive adds the mainstream-pseudonymous layer their analysts pivot through.
Automated deep and dark web collection with threat intelligence feeds and APIs, part of Bitsight since 2024.
API-first delivery philosophy close to ours, pointed at the dark web; the grey web is the complementary collection surface.
Dutch web intelligence provider that builds curated dark web and open web datasets and APIs for law enforcement and NGOs.
EU-based, data-as-a-service for LEA — structurally similar model to ours on a different layer; natural co-existence in the same platforms.
French dark web search engine that indexes Tor hidden services (~60,000 sites/year) for government and enterprise clients.
The French dark-web index; with THINKPOL covering the grey web, the two layers together map an actor's public-pseudonymous and hidden presence.
Cybercrime intelligence built on human source networks inside underground communities plus automated malware and forum monitoring.
HUMINT-grade underground access; the public-pseudonymous layer (where actors recruit, brag, and leak) is the adjacent surface an archive covers systematically.
Threat intelligence platforms
Platforms that turn collected data into finished threat intelligence: actor tracking, IOC feeds, alerting, and analyst reporting for security teams.
Dark web intelligence and investigation platform (DarkIQ, Cerberus) that monitors marketplaces, forums, and Tor traffic for enterprise and law enforcement.
Dark-web-native collection with investigation workflows; grey-web history is the adjacent layer such platforms typically source via partners.
Threat data and intelligence spanning illicit forums, markets, chat services, and social platforms (acquired Echosec for geosocial monitoring).
Broad illicit-community coverage curated for CTI; a specialist longitudinal Reddit archive adds the mainstream-pseudonymous layer their analysts pivot through.
Automated deep and dark web collection with threat intelligence feeds and APIs, part of Bitsight since 2024.
API-first delivery philosophy close to ours, pointed at the dark web; the grey web is the complementary collection surface.
The largest commercial threat intelligence provider: the Intelligence Graph correlates open web, dark web, and technical sources into finished intelligence.
Category-defining breadth. Specialist archives exist because breadth platforms sample the grey web rather than preserve it — depth is the complement they buy in.
Cybercrime intelligence built on human source networks inside underground communities plus automated malware and forum monitoring.
HUMINT-grade underground access; the public-pseudonymous layer (where actors recruit, brag, and leak) is the adjacent surface an archive covers systematically.
External cybersecurity platform for brand protection, impersonation takedowns, and dark web monitoring across social and digital channels.
Protection and takedown workflows over live platforms; historical and deleted-content forensics is the layer beneath its alerting.
Social media monitoring (SOCMINT)
Platforms that monitor mainstream social networks at scale for security-relevant signals: real-time alerting, geofencing, and multi-platform collection.
Investigation tooling (SocialNet, Horizon) that maps identities and connections across 200+ online networks for law-enforcement and corporate investigators.
Strong cross-network link mapping; depends on what each source still exposes publicly — archived and deleted grey-web content sits outside its collection model.
Digital-intelligence suite combining lawful-intercept analytics with Cobwebs' web intelligence platform for law-enforcement investigations.
Communications-records DNA (call detail, lawful intercept) extended to open sources; grey-web depth comes from partners, not from a native archive.
AI-based investigation platform that analyzes open, deep, and dark web sources to surface behavioral patterns and connections.
AI-first analysis over live collection; like most live-collection platforms, what a subject deleted before the investigation started is out of reach.
Threat data and intelligence spanning illicit forums, markets, chat services, and social platforms (acquired Echosec for geosocial monitoring).
Broad illicit-community coverage curated for CTI; a specialist longitudinal Reddit archive adds the mainstream-pseudonymous layer their analysts pivot through.
External cybersecurity platform for brand protection, impersonation takedowns, and dark web monitoring across social and digital channels.
Protection and takedown workflows over live platforms; historical and deleted-content forensics is the layer beneath its alerting.
Open-source intelligence collection and AI risk analytics (ONYX) for defence, national security, and law enforcement missions.
Mission-grade multi-platform collection with AI triage; Reddit depth beyond the live API is exactly the kind of source it federates.
Multilingual open-source data analytics (Babel X) with 200+ language coverage and identity intelligence for government missions.
Language breadth at government scale; platform-native archival depth is the complementary axis specialist providers supply.
Narrative & media intelligence
Tools that track how narratives spread: disinformation detection, bot/coordination analysis, and news media monitoring across languages.
Intelligence platform that aggregates and analyzes open web, news, and social data for threat, risk, and geopolitical teams.
Cross-source situational awareness; per-platform depth (full history, deleted content) comes from specialist upstream sources.
Decentralized protocol that scrapes public posts across many platforms and sells aggregated sentiment and narrative-trend data streams.
The closest French neighbor: breadth-first streams of current chatter across platforms, versus THINKPOL's depth-first longitudinal archive of one platform — including what was deleted. Different questions, different tools.
Narrative intelligence platform (Constellation) that detects and scores narrative attacks, bot networks, and coordinated manipulation.
Narrative risk scoring downstream; upstream seeding evidence (original posts, deleted layers, account history) is the input layer archives provide.
Network-map-based analysis of online communities, known for landmark public reports on influence operations.
Gold-standard IO cartography; longitudinal deleted-content evidence strengthens exactly the attribution chains their maps reveal.
Social threat intelligence that measures fake-account prevalence and coordinated inauthentic behavior around brands and elections.
Authenticity scoring on live profiles; account history that predates the campaign — and what it deleted — lives in archives.
Real-time news media monitoring covering 240,000+ sources globally, delivered as structured data feeds for media-intelligence products.
The news-media layer of the same thesis: structured feeds others build on. News tells you what was published; the grey web tells you what communities did with it.
Web data & scraping APIs
Developer-facing APIs and infrastructure that deliver raw or structured web data at scale — the plumbing many intelligence products are built on.
Reddit intelligence API over a private archive of 30+ billion posts and comments since 2005, including deleted and edited content, with sub-300ms full-archive search and a 15-second real-time firehose.
This is us. THINKPOL is the grey-web data layer: the archive Reddit's 2023 API lockdown made impossible to rebuild, delivered as an API that other platforms embed.
Open repository of web crawl data — petabytes of raw page captures released monthly, widely used to train and ground AI systems.
Breadth over depth: broad web coverage on a monthly cadence, with no platform-native structure (no authors, threads, or vote data) and no deleted-content capture.
Dutch web intelligence provider that builds curated dark web and open web datasets and APIs for law enforcement and NGOs.
EU-based, data-as-a-service for LEA — structurally similar model to ours on a different layer; natural co-existence in the same platforms.
Decentralized protocol that scrapes public posts across many platforms and sells aggregated sentiment and narrative-trend data streams.
The closest French neighbor: breadth-first streams of current chatter across platforms, versus THINKPOL's depth-first longitudinal archive of one platform — including what was deleted. Different questions, different tools.
Real-time news media monitoring covering 240,000+ sources globally, delivered as structured data feeds for media-intelligence products.
The news-media layer of the same thesis: structured feeds others build on. News tells you what was published; the grey web tells you what communities did with it.
The largest web-data platform: proxy infrastructure, scraping APIs, and ready-made datasets covering most major websites.
General-purpose collection infrastructure; live scraping can't recover what was already deleted — that requires having archived it first.
Proxy network and web-scraping APIs for large-scale public data gathering, with an EU corporate base.
Live-collection plumbing; platform-specific archives are the layer above raw access.
Web scraping API and services company (maintainers of the Scrapy framework) delivering structured data extraction at scale.
Extraction expertise for the open web; conversation platforms with anti-scraping walls and deletion dynamics need dedicated archival pipelines.
Marketplace of 4,000+ ready-made scrapers (Actors) plus a platform to build and run custom web automation.
Long-tail scraper marketplace: its Reddit actors read what reddit.com shows today — the live view, not the historical or deleted record.
AI-powered web data collection platform with specialized APIs (SERP, e-commerce, social) built for feeding data pipelines and AI agents.
Agent-era live collection; archival depth per platform is the complementary dataset AI pipelines increasingly pull alongside.
Public web archives
Free, public preservation projects that snapshot web pages over time — the baseline any investigator uses to see what a page looked like in the past.
The Internet Archive's free archive of hundreds of billions of web page snapshots since 1996, retrievable by URL and date.
Snapshots pages, not platforms: a Reddit thread is only preserved if someone captured that exact URL before deletion — no user-level or full-text coverage.
On-demand page archiver that stores an exact, unalterable snapshot of any URL at the moment a user submits it.
Great for preserving evidence you already found; useless for discovering content that was deleted before anyone thought to capture it.
Open repository of web crawl data — petabytes of raw page captures released monthly, widely used to train and ground AI systems.
Breadth over depth: broad web coverage on a monthly cadence, with no platform-native structure (no authors, threads, or vote data) and no deleted-content capture.
How THINKPOL fits.
THINKPOL is the specialist grey-web data layer of this map: the Reddit archive that investigation platforms, threat intelligence teams, and analysis suites plug in when they need depth the live platform no longer shows.
- 30+ billion Reddit posts and comments archived since 2005, including content deleted or edited after publication.
- Sub-300ms full-text search across the entire archive, plus a 15-second real-time firehose for live monitoring.
- EU-hosted (France), GDPR-native, and outside US CLOUD Act reach: a structural requirement for European government and defence buyers.
See how the grey-web layer is used in law enforcement and cyber threat intelligence, explore the platform capabilities, or try the free tools.
Common questions about OSINT tools.
OSINT tools fall into ten main categories: Reddit archive and deleted-content search, investigation and link-analysis platforms, people search and identity resolution, breach and leak intelligence, dark web monitoring, threat intelligence platforms, social media monitoring (SOCMINT), narrative and media intelligence, web data and scraping APIs, and public web archives. Most professional workflows combine one analysis platform with several specialist data sources underneath it.
OSINT platforms are where analysts work: investigation suites such as i2 or Siren, threat intelligence platforms such as Recorded Future, and SOCMINT tools such as Fivecast provide search, link analysis, alerting, and case management. Data providers supply the collection underneath: web scraping APIs, breach databases, dark web indexes, and platform archives such as THINKPOL's Reddit archive. Platforms typically integrate specialist providers rather than rebuild deep collection themselves, so most buyers end up needing both layers.
Very few. THINKPOL archives Reddit continuously and retains 30+ billion posts and comments since 2005, including content deleted or edited after publication. Reveddit shows moderator-removed Reddit comments but not user-deleted content, and PullPush is a community-run archived Reddit search with coverage gaps. The Wayback Machine and archive.today preserve a page only if someone captured that exact URL before it was deleted.
EU-headquartered vendors in this landscape include THINKPOL, Aleph Networks, and Exorde Labs (France), Social Links and Web-IQ (Netherlands), Siren and Zyte (Ireland), Intelligence X and Apify (Czech Republic), Oxylabs (Lithuania), and Opoint (Norway). For European government and defence buyers this matters structurally: data hosted and incorporated under EU law is not compellable under the US CLOUD Act.
Law enforcement teams typically run an investigation platform (i2, Siren, PenLink, ShadowDragon) fed by specialist sources: dark web indexes such as Aleph Networks and Web-IQ, breach intelligence such as Intelligence X, and grey-web archives such as THINKPOL for full Reddit history including deleted content. Mission-focused SOCMINT platforms such as Fivecast and Babel Street cover multi-platform collection for national security cases.
Stop reading about
it in the news.
Request access to THINKPOL. We respond within one working day. A 30-minute scoping call follows, and a sandbox tenant is provisioned within five working days of contract signature.
Grey web intelligence for national security, law enforcement, CTI and corporate security teams. Built in France, hosted in the EU.
Free tools
Guides
Contact
- 59 rue de Ponthieu, Bureau 326
75008 Paris, France - contact@think-pol.com
