daemon-sec-cheatsheet

people-search.md (44796B)

---

 ---
 title: "People Search & Public Records"
 description: "Registries, court records, aggregators and breach data for identifying a person and the records that mention them."
 category: osint
 subcategory: "People & Identity"
 tags: [osint, people, public-records, breach-data]
 tools: [hibp, intelx, aleph, alephclient, courtlistener, opensanctions, yente, edgar, ratsit, hitta]
 difficulty: intermediate
 updated: 2026-10-04
 references:
   - name: "Bellingcat's Online Investigation Toolkit"
     url: "https://bellingcat.gitbook.io/toolkit"
     author: "Bellingcat"
     license: none
     relation: derived
     note: "Tool catalogue: names, descriptions, cost flags and links for this area."
   - name: "OSINT Newsletter Tools Library"
     url: "https://tools.osintnewsletter.com"
     author: "The OSINT Newsletter"
     license: none
     relation: derived
     note: "Second tool catalogue, cross-checked against the above."
   - name: "Have I Been Pwned API v3"
     url: "https://haveibeenpwned.com/API/v3"
     author: "Troy Hunt"
     relation: link-only
     note: "Endpoint paths, required headers and rate-limit behaviour."
   - name: "Intelligence X SDK (Python)"
     url: "https://github.com/IntelligenceX/SDK/tree/master/Python"
     author: "Kleissner Investments"
     relation: link-only
     note: "CLI flags, API endpoint paths and the sort/media enumerations."
   - name: "alephclient documentation"
     url: "https://docs.aleph.occrp.org/developers/alephclient/"
     author: "OCCRP"
     relation: link-only
     note: "alephclient subcommands and the ALEPHCLIENT_* environment variables."
   - name: "CourtListener REST API v4"
     url: "https://wiki.free.law/c/courtlistener/help/api/rest/v4/overview"
     author: "Free Law Project"
     relation: link-only
     note: "Endpoint paths, search type values, throttles and the OPTIONS convention."
   - name: "OpenSanctions API reference"
     url: "https://api.opensanctions.org/openapi.json"
     author: "OpenSanctions"
     relation: link-only
     note: "Scope paths and query parameters for search, match and statements."
   - name: "yente"
     url: "https://github.com/opensanctions/yente"
     author: "OpenSanctions"
     relation: link-only
     note: "Self-hosted matching engine: image, port and YENTE_* environment variables."
 ---
 
 ## What this covers
 
 Finding the records that name a person: civil registries, corporate filings, court dockets,
 electoral rolls, phone books, and the commercial aggregators that resell all of it. Coverage is
 wildly uneven by country, and the aggregators are frequently wrong, so this is an area where
 knowing which source is authoritative matters more than knowing many sources.
 
 ## Method
 
 1. **Start with the authoritative registry**, not an aggregator. If a country publishes its company
    register or land registry, use it — the aggregator is a stale copy with errors added.
 2. **Establish the jurisdiction first.** People-search coverage is national. A US-focused
    aggregator has close to nothing on a Swedish resident, and Nordic registries are far more open
    than most.
 3. **Cross-reference two independent sources** before accepting an address, date of birth or
    relationship. Aggregators copy each other, so two of them agreeing means nothing.
 4. **Pivot through documents.** A court filing names an address, an employer and often relatives.
    One good document beats twenty aggregator hits.
 5. **Treat breach data as intelligence, not evidence.** It tells you an email existed on a service
    at some point. It does not tell you who typed it in.
 
 ## Regional registries worth knowing
 
 Nordic countries publish personal data that is closed almost everywhere else, which makes them
 unusually productive:
 
 - **Sweden** — [Ratsit](https://www.ratsit.se/), [Hitta.se](https://www.hitta.se/), and the
   Swedish Name Register give addresses, income brackets and dates of birth.
 - **Norway / Finland / Denmark** — equivalents exist; tax records are partly public in Norway.
 - **Nigeria** — NigeriaPhonebook for telephone-to-name lookups.
 - **United States** — county-level court and property records are the real source; national
   aggregators are convenience layers over them.
   [Search Systems](https://www.searchsystems.net/) is a directory of the underlying databases,
   organised by state and record type.
 
 None of these publish an API. They do take their search term in the query string, which is worth
 knowing because it means a registry lookup can be scripted into a browser or a note template
 rather than retyped:
 
 ```text
 https://www.hitta.se/sök?vad=Anna+Andersson        name or address; returns people and companies
 https://www.hitta.se/sök?vad=08-555+012+34         reverse telephone, same parameter
 ```
 
 The `vad` parameter is the only one you need; the rest of the query string the site adds is UI
 state. Note that the path segment is the Swedish word `sök`, so it percent-encodes to
 `s%C3%B6k` when you paste it into `curl` — a shell that mangles the UTF-8 is the usual reason a
 hand-built Hitta URL 404s. Ratsit and the US brokers sit behind bot protection that returns 403
 to anything without a browser fingerprint, so for those, drive the search box rather than the
 URL.
 
 ## Key tools
 
 ### Have I Been Pwned
 
 The reference for which breach corpora hold an address, and the only tool in this area with a
 stable documented API. Account lookups sit behind a paid key now — the cheapest tier is a few
 dollars a month — while the breach catalogue and the password range endpoint stay free and need
 no key at all.
 
 The keyless half, which is where to start because it costs nothing and tells you what the corpus
 even is:
 
 ```bash
 # the breach catalogue: free, no key, useful for dating a corpus
 curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/breaches' \
   | jq -r '.[].Name' | head
 
 # one breach in detail — when it happened, how big, what fields leaked
 curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/breach/Adobe' \
   | jq '{BreachDate,AddedDate,PwnCount,IsVerified,DataClasses}'
 
 # which breaches carried the field you actually care about, sorted oldest first
 curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/breaches' \
   | jq -r '[.[] | select(.DataClasses | index("Physical addresses"))]
            | sort_by(.BreachDate)[] | "\(.BreachDate)  \(.PwnCount)  \(.Name)"'
 
 # every breach attributed to one domain — the pivot when you know the employer, not the person
 curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/breaches?Domain=adobe.com'
 
 # the field vocabulary, so a report says "Physical addresses" and not "address data"
 curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/dataClasses' | jq -r '.[]'
 
 # what was added most recently, for deciding whether a re-run is worth the quota
 curl -s -H 'user-agent: osint-research' 'https://haveibeenpwned.com/api/v3/latestBreach' \
   | jq '{Name,AddedDate}'
 ```
 
 Then the keyed half. `user-agent` is mandatory on every call and `hibp-api-key` on everything
 that names an account:
 
 ```bash
 # confirm which tier the key actually buys before you plan a run around it
 curl -s 'https://haveibeenpwned.com/api/v3/subscription/status' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' \
   | jq '{SubscriptionName,Rpm,DomainSearchMaxBreachedAccounts}'
 
 # which breaches hold this address; truncateResponse=false is what gets you the dates
 curl -s 'https://haveibeenpwned.com/api/v3/breachedAccount/target@example.com?truncateResponse=false' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' \
   | jq -r '.[] | "\(.BreachDate)  \(.Name)"'
 
 # include unverified corpora — more hits, weaker provenance, so record the flag you used
 curl -s 'https://haveibeenpwned.com/api/v3/breachedAccount/target@example.com?truncateResponse=false&IncludeUnverified=true' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' | jq 'length'
 
 # k-anonymity account search: the address never leaves your machine, only six hex characters do
 H=$(printf 'target@example.com' | shasum -a 1 | cut -c1-40 | tr 'a-f' 'A-F')
 curl -s "https://haveibeenpwned.com/api/v3/breachedaccount/range/${H:0:6}" \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' \
   | jq -r --arg suffix "${H:6}" '.[] | select(.hashSuffix == $suffix) | .websites[]'
 
 # paste sites that carried the address, which often predate the breach being named
 curl -s 'https://haveibeenpwned.com/api/v3/pasteAccount/target@example.com' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'
 
 # every breached address under a domain you have proven you control
 curl -s 'https://haveibeenpwned.com/api/v3/breachedDomain/example.com' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'
 
 # which domains you have actually verified, when a run comes back suspiciously empty
 curl -s 'https://haveibeenpwned.com/api/v3/subscribedDomains' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' | jq -r '.[].DomainName'
 
 # stealer-log hits — infostealer output, so far more recent than breach corpora
 curl -s 'https://haveibeenpwned.com/api/v3/stealerLogsByEmail/target@example.com' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'
 
 # the same, across a verified domain: which of your subject's colleagues ran malware
 curl -s 'https://haveibeenpwned.com/api/v3/stealerLogsByEmailDomain/example.com' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'
 
 # which sites a stealer-infected machine had credentials for — a browsing-history proxy
 curl -s 'https://haveibeenpwned.com/api/v3/stealerLogsByWebsiteDomain/example.com' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research'
 ```
 
 The password range endpoint needs no key, is not rate limited, and never sees the password:
 
 ```bash
 # only the first five SHA-1 characters leave your machine
 printf 'hunter2' | shasum -a 1 | tr 'a-f' 'A-F' | cut -c1-5 \
   | xargs -I{} curl -s "https://api.pwnedpasswords.com/range/{}" | head -3
 
 # pad the response with dummy rows so its size tells an observer nothing about the
 # prefix; padded rows always carry a count of 0, so discard them before reading
 curl -s -H 'Add-Padding: true' 'https://api.pwnedpasswords.com/range/5BAA6' \
   | awk -F: '$2 != 0' | head -3
 
 # NTLM suffixes instead of SHA-1, for checking a dumped AD hash against the corpus.
 # NTLM suffixes are 27 characters where SHA-1 suffixes are 35 — a length mismatch
 # when you diff against a local list means you queried the wrong mode
 curl -s 'https://api.pwnedpasswords.com/range/8846F?mode=ntlm' | head -3
 ```
 
 The k-anonymity account endpoint is the one worth building a habit around: it sends six hex
 characters of a SHA-1 and matches the remaining suffix locally, so the address you are
 investigating is never transmitted. The response carries `hashSuffix` and `websites` — not
 `breaches`, which is the field name people assume and then silently get `null` from.
 
 Omitting `user-agent` returns 403 rather than a useful error. `breachedAccount` truncates by
 default, returning only breach names — if your output has no dates in it, you forgot
 `truncateResponse=false`, and a report built on that output cannot say when anything happened. A
 429 carries a `retry-after` header in seconds; honour it, because the limit is per key and
 hammering it gets the key suspended. And the output tells you a corpus containing that address
 was published — not that your subject created the account, not that they still use the address,
 and not what the password was.
 
 ### Intelligence X
 
 Web-first, and the broadest selector search available without a corporate contract: it indexes
 leaks, darknet pages, document dumps and its own historical web crawl, and it searches by
 selector type rather than free text. Reach for it when an identifier returns nothing elsewhere.
 
 Paste the selector at [intelx.io](https://intelx.io/) and read the result pane by bucket — the
 left-hand facets split hits into leaks, darknet, web and documents, and the bucket matters more
 than the hit count. Selectors it understands:
 
 ```text
 target@example.com          email address
 example.com                 domain, including subdomain hits
 198.51.100.0/24             CIDR range
 +14155550123                phone number, E.164
 1BoatSLRHtKNngkdXEeobR76b53LETtpyT   cryptocurrency address
 d41d8cd98f00b204e9800998ecf8427e     hash or document selector
 ```
 
 For the record, capture the item's **date added** and its bucket, not just the snippet —
 Intelligence X keeps items long after the source is gone, so the snippet alone cannot be re-verified. The API
 takes the key from the developer tab of your account in an `x-key` header; phonebook (bulk
 selector extraction) and most export volume are paid tiers, and the free tier is metered tightly
 enough that you will feel it inside an hour.
 
 ### OCCRP Aleph and Library of Leaks
 
 Aleph is a document-and-entity index built for cross-border corruption work: leaked archives,
 scraped registries, sanctions lists and court filings normalised into one searchable entity
 graph. It beats a people-search aggregator whenever the subject appears in documents rather than
 directories. [Library of Leaks](https://search.libraryofleaks.org/) is the same software over a
 different, leak-heavy corpus.
 
 ```bash
 pipx install alephclient
 
 # register free, then take the key from your Aleph user profile — anonymous API calls get a 401
 export ALEPHCLIENT_HOST=https://aleph.occrp.org
 export ALEPHCLIENT_API_KEY=REPLACE_ME
 
 # people matching a name, across every dataset you can read
 curl -s -G 'https://aleph.occrp.org/api/2/entities' \
   -H "Authorization: ApiKey $ALEPHCLIENT_API_KEY" \
   --data-urlencode 'q=Sergei Ivanov' --data-urlencode 'filter:schema=Person' \
   | jq -r '.results[] | "\(.properties.name[0])  \(.collection.label)"'
 
 # companies instead of people — the usual pivot off a director's name
 curl -s -G 'https://aleph.occrp.org/api/2/entities' \
   -H "Authorization: ApiKey $ALEPHCLIENT_API_KEY" \
   --data-urlencode 'q=Sergei Ivanov' --data-urlencode 'filter:schema=Company' | jq '.total'
 
 # which datasets exist, so you can say what you did and did not search
 curl -s 'https://aleph.occrp.org/api/2/collections?limit=50' \
   -H "Authorization: ApiKey $ALEPHCLIENT_API_KEY" \
   | jq -r '.results[] | "\(.foreign_id)  \(.label)"'
 
 # one entity in full, including the documents it was extracted from
 curl -s 'https://aleph.occrp.org/api/2/entities/ENTITY_ID' \
   -H "Authorization: ApiKey $ALEPHCLIENT_API_KEY" | jq '.properties'
 
 # push your own case documents in so they are indexed alongside the public corpora
 alephclient crawldir --foreign-id my-case-2026 ./case-documents
 ```
 
 Names in Aleph are transliterated inconsistently because the sources are, so run the variants
 from [username and account work](/sheets/osint/usernames-and-accounts) before concluding a name
 is absent. An entity is an extraction from a document, which means both the spelling and the
 role can be wrong; open the source document before you cite it. Uploading case documents sends
 them to someone else's server — check that is acceptable for your material first.
 
 ### CourtListener and RECAP
 
 Free, keyless-to-browse access to US federal dockets, opinions and PACER filings that other
 researchers have paid for and donated. For a US subject this is the best single documentary
 source on this page, because a filing names addresses, employers, counsel and relatives in one
 place.
 
 ```bash
 # token from your free account profile; note the literal word "Token"
 export CL_TOKEN=REPLACE_ME
 
 # federal dockets mentioning a name (type=r gives dockets with nested documents)
 curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
   -H "Authorization: Token $CL_TOKEN" \
   --data-urlencode 'q="Dana Whitfield"' --data-urlencode 'type=r' \
   | jq -r '.results[] | "\(.dateFiled)  \(.court)  \(.caseName)"'
 
 # case law opinions instead of dockets
 curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
   -H "Authorization: Token $CL_TOKEN" \
   --data-urlencode 'q="Dana Whitfield"' --data-urlencode 'type=o' | jq '.count'
 
 # narrow to one court and a date window
 curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
   -H "Authorization: Token $CL_TOKEN" \
   --data-urlencode 'q=Whitfield' --data-urlencode 'type=d' \
   --data-urlencode 'court=txwd' --data-urlencode 'filed_after=2020-01-01'
 
 # judges, for checking who heard a case
 curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
   -H "Authorization: Token $CL_TOKEN" \
   --data-urlencode 'q=Whitfield' --data-urlencode 'type=p'
 
 # the docket itself, including the parties
 curl -s 'https://www.courtlistener.com/api/rest/v4/dockets/?id=12345' \
   -H "Authorization: Token $CL_TOKEN" | jq '.results[0] | {case_name,date_filed,assigned_to_str}'
 
 # page with the cursor the previous response handed back, not an offset
 curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' \
   -H "Authorization: Token $CL_TOKEN" \
   --data-urlencode 'q=Whitfield' --data-urlencode 'type=r' --data-urlencode 'cursor=CURSOR'
 ```
 
 RECAP holds what somebody has already fetched from PACER, so absence means nobody bought that
 document, not that the case does not exist — check PACER's own index before saying there is no
 case. Search results are cached for ten minutes, so polling for new filings wastes your quota;
 use the Alert API for monitoring. State courts are mostly absent, which is where most US
 litigation actually happens.
 
 ### OpenSanctions
 
 Sanctions lists, politically-exposed-person data and criminal watchlists, merged and deduplicated
 into one entity model with a matching API. Use it to answer "is this person on a list" properly,
 rather than eyeballing a dozen national PDFs — and to record a clean negative.
 
 ```bash
 export OS_KEY=REPLACE_ME
 
 # full-text search, for when you only have a name
 curl -s -G 'https://api.opensanctions.org/search/default' \
   -H "Authorization: ApiKey $OS_KEY" --data-urlencode 'q=Sergei Ivanov' \
   | jq -r '.results[] | "\(.caption)  \(.schema)  \(.datasets|join(","))"'
 
 # proper screening: describe the entity and let the matcher score candidates
 curl -s -X POST 'https://api.opensanctions.org/match/default' \
   -H "Authorization: ApiKey $OS_KEY" -H 'Content-Type: application/json' \
   -d '{"queries":{"q1":{"schema":"Person","properties":{"name":["Sergei Ivanov"],"birthDate":["1965"],"country":["ru"]}}}}' \
   | jq -r '.responses.q1.results[] | "\(.score)  \(.caption)  \(.datasets|join(","))"'
 
 # one entity in full, with every list that carries it and why
 curl -s 'https://api.opensanctions.org/entities/NK-A7z1Z' \
   -H "Authorization: ApiKey $OS_KEY" | jq '{caption,datasets,properties}'
 
 # which lists are in the index, so your negative result has a defined scope
 curl -s 'https://api.opensanctions.org/catalog' | jq -r '.datasets[].name' | head -30
 ```
 
 A date of birth or a country code moves the score far more than extra name tokens; a bare name
 query on a common name returns confident nonsense. The score is a similarity, not a finding —
 anything you publish needs the underlying list entry read by a human. Trial keys come free with
 a business email and public-interest keys are granted for journalism and research; if the metering
 gets in the way, the matching engine (`yente`) is open source and self-hostable against the same
 free bulk data.
 
 ### EDGAR full-text search
 
 Free, keyless, and routinely forgotten in people work: every SEC filing since 2001 is full-text
 searchable, and filings name directors, officers and beneficial owners with addresses. A
 Form D or a proxy statement is a dated, signed document naming a person — which is exactly the
 kind of source an aggregator hit is not.
 
 ```bash
 # the SEC requires a descriptive User-Agent with contact details; without one you get blocked
 UA='osint-research research@example.com'
 
 # every filing mentioning a name
 curl -s -A "$UA" 'https://efts.sec.gov/LATEST/search-index?q=%22Dana+Whitfield%22' \
   | jq -r '.hits.hits[] | "\(._source.file_date)  \(._source.display_names[0])"'
 
 # restrict to a form type — Form D names the directors of a private placement
 curl -s -A "$UA" 'https://efts.sec.gov/LATEST/search-index?q=%22Dana+Whitfield%22&forms=D'
 
 # date-bounded, which is how you tie a person to a company in a given year
 curl -s -A "$UA" \
   'https://efts.sec.gov/LATEST/search-index?q=%22Dana+Whitfield%22&dateRange=custom&startdt=2019-01-01&enddt=2021-12-31'
 
 # every filing by one company, from its CIK
 curl -s -A "$UA" 'https://data.sec.gov/submissions/CIK0000320193.json' \
   | jq '{name,addresses,formerNames}'
 ```
 
 The browsable version is at [sec.gov/edgar/search](https://www.sec.gov/edgar/search/), and it is
 the right place to read a hit. Full-text coverage starts in 2001; older filings are indexed by
 company but not searchable by content. A name in a filing is the name as filed, so middle
 initials and suffixes are inconsistent across years.
 
 ### Ratsit
 
 Web only, Sweden only, and far more revealing than anything equivalent elsewhere: registered
 address, year and month of birth, income bracket, property and vehicle flags, and who else is
 registered at the address. Swedish population-register data is public, so this is a legitimate
 primary source rather than a broker's guess.
 
 Search the name at [ratsit.se](https://www.ratsit.se/), narrow by county when the name is common,
 and read the profile page. For the record, capture these fields and nothing inferred from them:
 
 ```text
 Folkbokförd adress    registered address, i.e. where the state believes they live
 Född                  birth year and month (day is withheld on the free view)
 Inkomst / Taxeringsår income bracket AND the assessment year it belongs to
 Fordon / Fastighet    vehicle and property flags, each a pointer to another register
 Personer på adressen  others registered at the same address — household, not family
 ```
 
 The income figure is always a year or two behind and is meaningless without the assessment year
 printed beside it.
 
 **Search logged out.** Ratsit sells subjects a paid feature listing the logged-in users who
 looked them up; anonymous searches leave no entry in that log. Mrkoll, the nearest competitor,
 shows subjects a profile-view count but not identities. Either way, an account turns a passive
 lookup into something the subject can notice.
 
 ### US people-search aggregators
 
 [FastPeopleSearch](https://www.fastpeoplesearch.com/), [That's Them](https://thatsthem.com/) and
 [Radaris](https://radaris.com/) are free, web only, and the fastest route to a candidate address
 and phone for a US subject. They are also data brokers reselling scraped and purchased records of
 unknown age.
 
 Enter the name plus a city or state — a bare name on a common surname is unusable. Read the
 result page as three separate claims with separate reliability: current address, phone numbers,
 and "possible relatives". The first two are checkable against a county property or voter record;
 the third is inference from shared addresses and surnames and is wrong often enough that
 repeating it is reckless.
 
 ```text
 Dana Whitfield Austin TX        name + city: the only query form that works
 Dana Whitfield 78701            name + ZIP, when the city name is ambiguous
 (512) 555-0123                  reverse phone, usually the highest-precision entry point
 1200 Example St, Austin TX      reverse address, to enumerate the household
 ```
 
 Capture the page with an archiving tool, because broker pages change without notice — see
 [archiving and evidence](/sheets/osint/archiving-and-evidence).
 
 These sites are also the mechanism by which your subject's data is public in the first place; most
 carry an opt-out form, and a subject who has used it will be absent from the broker while still
 present in the underlying county record. Absence here means nothing.
 
 ### Pipl
 
 **Sales-gated since its pivot to enterprise identity resolution.** There is no self-serve tier,
 no web search for individuals, and contracts start in the thousands of dollars a year. Treat the
 Pipl entry in the table below as historical. For the same job without a contract, the live
 options are the registry-first route above, Intelligence X for selector search, and OSINT
 Industries or Osintly if you need a commercial aggregator with per-query pricing.
 
 ## Breach and leak data
 
 Useful for confirming that an identifier was in use, and for pivoting between an email, a username
 and a phone number. Handle carefully: this is other people's stolen data.
 
 | Tool | What it does | Cost |
 | --- | --- | --- |
 | [Have I Been Pwned](https://haveibeenpwned.com/) | Authoritative check for whether an address appears in a known breach. Does not expose passwords. | free |
 | [DeHashed](https://dehashed.com/) | Searchable breach aggregator across emails, usernames, names, phones and IPs. | partly free |
 | [Intelligence X](https://intelx.io/) | Searches leaks, darknet, document archives and historical web by selector. | partly free |
 | [Leak-Lookup](https://leak-lookup.com/) | Breach index with API access. | partly free |
 | [DiscordLeaks](https://discordleaks.unicornriot.ninja/) | Searchable archive of leaked far-right Discord servers, maintained by Unicorn Riot. | free |
 
 Do not put a live target's credentials into a third-party lookup you do not control, and do not
 treat a password from a breach as authorisation to use it.
 
 DeHashed is the one worth a note on access: it is credit-metered now, and the old
 basic-auth `api.dehashed.com/search?query=` endpoint that circulates in every scripted wrapper is
 retired. The current API is v2, documented behind a login at
 [dehashed.com/docs](https://dehashed.com/docs), so check the endpoint there rather than copying a
 wrapper. The web search works without any of
 that. Leak-Lookup's free tier is a hash-only check; its searchable API is paid.
 
 ## Tool reference
 
 | Tool | What it does | Cost |
 | --- | --- | --- |
 | [192](http://www.192.com/) | Searching for someone's address in the UK, phone number and who they live with according to electoral rolls. | free |
 | [Eniro](https://www.eniro.se/) | Yellow Pages (Swedish Edition) | free |
 | [Epieos](https://tools.epieos.com/holehe.php) | Checks where an email has been used. Based on Holehe. | paid |
 | [FastPeopleSearch](http://fastpeoplesearch.com/) | Mostly good for US. | free |
 | [GetContact](https://www.getcontact.com/en/) | Phonenumber ID app - draws from crowdsourced contactbooks | free |
 | [Ghunt](https://github.com/mxrch/GHunt) | A command line tool for obtaining information about Google accounts. | free |
 | [Hitta.se](https://www.hitta.se/) | Mapping service for Sweden | free |
 | [Intelx](http://intelx.io/) | Find user details in data breaches | partly free |
 | [NigeriaPhonebook](https://nigeriaphonebook.com/) | Look up by name, state, and phone number. Last names are partially censored for free accounts. | free |
 | [Person Lookup](https://personlookup.co.za/) | find individuals, phonenumbers, and adresses | free |
 | [Pipl](http://pipl.com/) | Identity information for professionals | paid |
 | [Ratsit](https://www.ratsit.se/) | Look up phone numbers/names (Sweden) | free |
 | [Search Systems](https://www.searchsystems.net/) | Finding public record information online in over 70,000 databases organized by type and location to help you find property, criminal, court, birth, death… | free |
 | [Skopenow](https://www.skopenow.com/) | Social Media Investigations - name, phone, email, username searches. | paid |
 | [Spokeo](http://spokeo.com/) | People search through email, phone, name | paid |
 | [Swedish Name Register](https://scb.se/hitta-statistik/sverige-i-siffror/namnsok/) | Find out how common a name is in Sweden based on census data | free |
 | [The Law Pages](https://www.thelawpages.com/court-cases/court-case-search.php?mode=1) | Search criminal court case details in the UK, such as sentence, hearing, defendant, etc. | free |
 | [ThisNumber](https://sur.ly/o/numberway.com/AA000014) | An international directory of white pages and yellow pages phone books, and online directory enquiries. It's a free, independent and up-to-date guide to… | free |
 | [TrueCaller](https://www.truecaller.com/) | Truecaller is a caller ID app that identifies incoming calls, blocks unwanted numbers, and gathers phone numbers and names from contact lists. It also… | partly free |
 | [TruffleHog](https://trufflesecurity.com/trufflehog) | Find leaked credentials. | free |
 | [Worldwide Osint Tools map](https://cipher387.github.io/osintmap/) | Global overview of yellow/white pages, court cases, business registries etc. | free |
 | USA court case databases | State-by-state guide for researching criminal and civil court cases | partly free |
 
 ## Pitfalls
 
 - **Aggregators invent relatives.** "Possible relatives" lists are inference from shared addresses
   and surnames. They are frequently wrong and occasionally defamatory.
 - **Stale addresses.** Someone moved five years ago; the aggregator still shows the old address as
   current. Date every claim.
 - **Name collisions.** Common names across a large population produce confident, wrong matches.
   Require a second identifier — date of birth, middle initial, employer.
 - **Jurisdiction and legality.** Accessing some records requires a declared lawful purpose. Bulk
   collection of personal data about EU residents engages the GDPR regardless of the data being
   public.
 
 ## Worked example
 
 One datum: the name **Dana Whitfield**, typed under a signature on a PDF that also carries a
 Travis County, Texas address block. Nothing else.
 
 1. **Establish the jurisdiction's real sources.** [Search Systems](https://www.searchsystems.net/)
    lists the Travis County clerk, district clerk and appraisal district portals. That tells you
    where the authoritative property and civil records live before you touch an aggregator.
 2. **Federal dockets.** `type=r` search on CourtListener for `"Dana Whitfield"` returns one 2021
    docket in the Western District of Texas. The docket's party block gives a street address and
    the name of a law firm — two new pivots, from a dated court document.
 3. **Filings.** EDGAR full-text search for the same name, `forms=D`, returns a 2022 Form D naming
    her as a director of a private company, with a business address in Austin and a company CIK.
 4. **Company side.** The CIK into `data.sec.gov/submissions/CIK….json` gives the company's former
    names and address history, which is how you find out the entity was renamed in 2023 — the
    reason a plain name search missed it.
 5. **Screening, including the negative.** The OpenSanctions `/match/default` call with
    `name`, `country=us` and the birth year inferred from the docket returns no result above 0.6.
    Record that as a checked negative with the datasets listed, not as "nothing found".
 6. **Identifier confirmation.** The business email in the Form D goes into HIBP
    `breachedAccount`. Two corpora dated 2019 and 2021 hold it, which confirms the address was in
    use across that window — and nothing more.
 7. **Aggregator, last.** That's Them on "Dana Whitfield, Austin TX" returns three candidate
    addresses, one matching the docket. The other two, and the whole "possible relatives" block,
    stay in the notes as unverified inference.
 
 The whole run, as commands:
 
 ```bash
 UA='osint-research research@example.com'
 export CL_TOKEN=REPLACE_ME OS_KEY=REPLACE_ME HIBP_KEY=REPLACE_ME
 
 curl -s -G 'https://www.courtlistener.com/api/rest/v4/search/' -H "Authorization: Token $CL_TOKEN" \
   --data-urlencode 'q="Dana Whitfield"' --data-urlencode 'type=r' | jq -r '.results[].caseName'
 
 curl -s -A "$UA" 'https://efts.sec.gov/LATEST/search-index?q=%22Dana+Whitfield%22&forms=D' \
   | jq -r '.hits.hits[] | "\(._source.file_date)  \(._source.display_names[0])"'
 
 curl -s -A "$UA" 'https://data.sec.gov/submissions/CIK0001234567.json' | jq '{name,formerNames}'
 
 curl -s -X POST 'https://api.opensanctions.org/match/default' -H "Authorization: ApiKey $OS_KEY" \
   -H 'Content-Type: application/json' \
   -d '{"queries":{"q1":{"schema":"Person","properties":{"name":["Dana Whitfield"],"country":["us"]}}}}' \
   | jq -r '.responses.q1.results[] | "\(.score)  \(.caption)"'
 
 curl -s 'https://haveibeenpwned.com/api/v3/breachedAccount/dana@example.com' \
   -H "hibp-api-key: $HIBP_KEY" -H 'user-agent: osint-research' | jq -r '.[].Name'
 ```
 
 What you can assert: a named person, tied by two independent dated documents to one company and
 one city, with one address corroborated by a court filing. What you cannot: anything the
 aggregator alone said, and any relationship nobody filed.
 
 What would falsify it: the docket and Form D resolving to different people once a middle name,
 date of birth or signature is compared; the apparent address match being a forwarding or business
 address shared by unrelated parties; or the filing being amended or withdrawn. The company-and-
 city link survives only while the two primary documents point to the same natural person.
 
 ## Broader catalogues
 
 - [People OSINT](https://tools.osintnewsletter.com/tool-categories/people-osint)
 - [Public Records OSINT](https://tools.osintnewsletter.com/tool-categories/public-records-osint)
 - [Breached Data Provider OSINT](https://tools.osintnewsletter.com/tool-categories/breached-data-provider)
 
 
 ## More tools
 
 Further tools for this area from the OSINT Newsletter Tools Library ([People OSINT](https://tools.osintnewsletter.com/tool-categories/people-osint), [Public Records OSINT](https://tools.osintnewsletter.com/tool-categories/public-records-osint), [Breached Data Provider OSINT](https://tools.osintnewsletter.com/tool-categories/breached-data-provider)), excluding those already listed above.
 
 | Tool | What it does |
 | --- | --- |
 | [192.com](https://www.192.com/) | UK-based online directory that helps you find information about people, addresses, businesses, and property records in the UK. |
 | [4shared](https://www.4shared.com/) | File-sharing and cloud-storage platform with a public search function. |
 | [Aeroleads](https://aeroleads.com/) | A prospecting and contact discovery platform that helps users find professional email addresses, phone numbers, company… |
 | [AllPeople](https://allpeople.com/) | A people-search and contact directory tool (US) that aggregates publicly available contact information to help identify… |
 | [Analyst Research Tools](https://analystresearchtools.com/) | A browser-based investigative research platform pulling together a collection of free lookup tools to help you gather, organise… |
 | [AnyWho](https://www.anywho.com/) | US- focused people-search and directory tool to find publicly available contact information, including names, phone numbers, and… |
 | [Australia Public Record](https://www.australiapublicrecord.com/) | Searches Australian public records to uncover people, businesses, properties, court records, and other publicly available… |
 | [BeenVerified](https://www.beenverified.com/) | People-search and background research platform that aggregates publicly available records into a single interface. |
 | [BIS Data Portal](https://data.bis.org/) | Public platform for exploring, analysing, and downloading international financial and economic statistics. |
 | [Business registers in EU countries](https://e-justice.europa.eu/topics/registers-business-insolvency-land/business-registers-eu-countries_en) | An official European Union portal providing access to national business registers across EU Member States. |
 | [Buzzglobe](https://buzzglobe.com/) | Social-media search aggregator for discovering publicly indexed profiles, pages, posts and images across multiple platforms. |
 | [Congressional Trader](https://congressional-trader.com/) | Search and review public U.S. congressional stock trade disclosures for lawmakers, tickers, states, and recent transactions. |
 | [Corp Watch](https://www.corpwatch.org/) | A non-profit investigative research platform that tracks corporate activity, accountability, environmental issues, human rights… |
 | [Corporation Wiki](https://www.corporationwiki.com/) | An online corporate intelligence database that aggregates public records on companies, directors, officers, and business… |
 | [dilisense](https://dilisense.com/en) | An AML/KYC screening and risk-intelligence platform that consolidates sanctions, PEPs, criminal watchlists, and adverse-media… |
 | [District 4 Labs Darkside](https://portal.district4labs.net/search) | An OSINT search platform that aggregates breached data, darknet intelligence, and leaked datasets into one searchable interface. |
 | [EDGAR Full Text Search](https://www.sec.gov/edgar/search/#) | Enables search across millions of filings submitted to the U.S. Securities and Exchange Commission (SEC). |
 | [EU Sanctions Map](https://www.sanctionsmap.eu/#/main) | An official public resource that provides a user-friendly overview of sanctions regimes adopted by the European Union. |
 | [Eyedex](https://www.eyedex.org/) | An open directory search engine that indexes publicly accessible web directories & allows users to search across petabytes of… |
 | [Federal Procurement Data System (FPDS)](https://sam.gov/contracting) | Official U.S. government database for federal contract spending. |
 | [Footprint IQ](https://footprintiq.app/) | Scans usernames, emails, and phone numbers across 500+ public sources to map a subject's digital footprint and calculate an… |
 | [Forebears](https://forebears.io/) | A global surname and genealogy database. |
 | [Free Full PDF](https://www.freefullpdf.com/) | Academic search engine focused on locating freely available full-text scientific PDFs, including journal articles, theses… |
 | [FreewareWeb FTP Search](https://www.freewareweb.com/copyright.shtml) | A specialised search engine that searches indexed FTP sites for files and directories using filenames, keywords, file types… |
 | [Gravatar](https://gravatar.com/site/check) | An avatar service that allows you to determine whether an email address is associated with a publicly available Gravatar profile. |
 | [GrayhatWarfare](https://grayhatwarfare.com/) | Search engine for publicly exposed files stored in cloud storage services such as AWS S3, Azure Blob Storage, Google Cloud… |
 | [Have I Been Pwned?](https://haveibeenpwned.com/) | Check whether an email address, password, or domain has appeared in known data breaches. |
 | [Hippie OSINT Toolkit](https://osint.hippie.cat/) | An OSINT web toolkit that allows you to reverse search a domain, a TikTok post, an image, or username (and more). |
 | [Hudson Rock](https://www.hudsonrock.com/) | A cybercrime intelligence platform that lets you search for compromised credentials, infected machines, and exposed corporate… |
 | [IDCrawl](https://www.idcrawl.com/) | A free people, username, reverse phone and reverse email search tool. |
 | [Import Yeti](https://www.importyeti.com/) | A supply chain intelligence tool that helps users discover who imports products into the United States and which overseas… |
 | [Indicia](https://indicia.app) | A Software-as-a-Service (SaaS)) platform for professional investigations, leveraging AI-powered tools to perform digital… |
 | [LeakData.io](https://leakdata.io/en) | A breach intelligence platform that checks authorised emails, usernames, phone numbers, and domains against indexed breach data. |
 | [Leaker](https://github.com/vflame6/leaker) | A passive reconnaissance CLI tool that aggregates credential leak data from multiple breach databases, supporting searches by… |
 | [LeakIX](https://leakix.net/) | Search engine and monitoring platform that indexes exposed services, misconfigurations, and leaked/publicly accessible data from… |
 | [Library of Leaks](https://search.libraryofleaks.org/) | A searchable archive of leaked datasets, documents, and exposed information sources. |
 | [LittleSis](https://littlesis.org/) | A public-interest database that maps relationships between powerful people and organisations (mostly U.S.) |
 | [Lullar](https://com.lullar.com/en/tools) | A free people-search engine that checks a username, email, or name across 170+ social media and online platforms in one query. |
 | [Names Directory](https://namesdir.com/) | A web-based name-association search tool to search for first names associated with surnames and surnames associated with first… |
 | [NAMINT](https://seintpl.github.io/NAMINT/) | A web app that generates multiple username, email, and naming combinations from a person’s first, middle, and last name. |
 | [North Data](https://www.northdata.com/) | A business intelligence platform providing access to company records, corporate structures, financial information and ownership… |
 | [Nuwber](https://nuwber.com/) | People-search and data-broker platform used to identify and cross-reference individuals using names, telephone numbers, addresses… |
 | [OFAC Sanctions List Search](https://sanctionssearch.ofac.treas.gov/) | The U.S. Office of Foreign Assets Control (OFAC) sanctions database that identifies individuals, companies, vessels and… |
 | [OpenCorporates](https://opencorporates.com/) | One of the largest open databases of company information in the world, aggregating official corporate registry data from… |
 | [OpenSecrets](https://www.opensecrets.org/) | A non-partisan transparency platform that tracks money in U.S. politics. |
 | [OSINT Industries](https://app.osint.industries/) | An all-encompassing OSINT platform that gathers and correlates publicly available digital data such as emails, domains, phone… |
 | [OSINT Tools Map](https://cybdetective.com/osintmap/) | An interactive directory of country-specific OSINT resources, including phonebooks, cadastral maps, business registers, court… |
 | [Osintly](https://osint.ly/) | A unified OSINT platform that searches for information across pseudonyms, email addresses, phone numbers, IP addresses, domains… |
 | [Predicta Search](https://www.predictasearch.com/) | Reverse email, phone number, username or name lookup. |
 | [Radaris](https://radaris.com/) | A people-search and information-aggregation service that allows you to search for information associated with individuals… |
 | [Sanctions Atlas](https://sanctionsatlas.com/) | A sanctions intelligence platform that brings together global sanctions lists, watchlists and ownership data. |
 | [SearchShared](https://www.searchshared.info/) | File-sharing search engine for locating publicly indexed/shared files across multiple hosting services. |
 | [Sherlock Eye](https://www.sherlockeye.io/) | AI-powered OSINT assistant that automates investigations, links data, and surfaces insights fast. |
 | [SynapsInt](https://synapsint.com/) | A web-based search platform that aggregates publicly available data about people, organisations, domains, IP addresses, email… |
 | [That's Them](https://thatsthem.com/) | A free people-search engine (US) to help find individuals through names, phone numbers, emails, and addresses. |
 | [The World Bank Open Data Catalog](https://datacatalog.worldbank.org/) | A searchable repository of development-related datasets, providing access to data, metadata, downloadable resources and, for some… |
 | [TheBigBrother](https://github.com/chadi0x/TheBigBrother) | All-in-one OSINT toolkit that helps track usernames across the web, investigate emails and domains, extract metadata, and follow… |
 | [UN Comtrade Database](https://comtradeplus.un.org/) | United Nations' database of detailed international trade statistics providing official trade data reported by countries and areas. |
 | [United States Patent and Trademark Office (USPTO)](https://www.uspto.gov/) | A public database for digging into patents, trademarks, and intellectual property filings. |
 | [Wikispooks](https://wikispooks.com/wiki/Main_Page) | An independent, collaboratively edited research wiki focused on people, organisations, events, documents and alleged networks of… |
 | [XposedOrNot](https://xposedornot.com/) | Free data breach search engine. |
 
 ## Sources
 
 Both catalogues below are maintained by other people and are considerably larger than
 this page. Use them as the canonical index; this sheet is a working route through them.
 
 - [Bellingcat's Online Investigation Toolkit](https://bellingcat.gitbook.io/toolkit) — ~340 tools, each with its own
   review page covering cost, difficulty, requirements and limitations.
 - [OSINT Newsletter Tools Library](https://tools.osintnewsletter.com) — ~280 tools, organised by investigative goal.
 
 Neither publishes a licence, so nothing here is copied from them: tool names, one-line
 descriptions, cost flags and links are catalogue facts, and the method and commentary are
 this site's own. See [credits](/credits).