Skip to main content
Threat Intel
back

Dark Web OSINT Tools

36 curated tools across 8 categories for investigating the dark web. Each entry has a clear primary use case, source link, and honest description of what it does.

Curated from the dark-web-osint-tools repository with additional sources and cross-references. See also Robin — an AI-powered dark-web investigation tool built on top of these engines.

categories:

Showing 36 of 36

  • Ahmia Search Engines
    essential

    Leading dark-web search engine that indexes .onion sites. Public API available for programmatic queries. Also publishes a list of verified onion links.

    source
  • OnionSearch Search Engines

    Scrapes onion links from 9+ search engines (Ahmia, DarkSearch, Tor66, etc) in one CLI. Supports Tor proxy.

    source
  • Katana Search Engines

    Dark-web crawler and search engine with a web UI. Indexes .onion pages and makes them searchable.

    source
  • Darkdump Search Engines

    CLI tool that searches the deep web with a single command. Queries Ahmia and other engines via Tor.

    source
  • Darkus Search Engines

    Dark-web monitoring tool with search + screenshot capabilities. Tracks onion site changes over time.

    source
  • IACA Dark Web Tools Search Engines

    Curated directory of dark-web investigation resources maintained by the International Anti-Crime Academy.

  • Onion Search Engine Search Engines

    Clearnet-accessible search engine for .onion sites. No Tor required on the client side.

  • Tor66 Onion Link Discovery

    Fresh onion link directory updated daily. One of the longest-running onion link lists.

  • TorNode Onion Link Discovery

    Onion service directory with category browsing and uptime statistics.

  • Darkweblink Onion Link Discovery
    essential

    Clearnet directory of working .onion links organized by category. Accessible without Tor.

  • OnionScan Scanners & Analysis
    essential

    The reference scanner for .onion site security. Checks for misconfigurations, data leaks, and identifiable information.

    source
  • Onioff Scanners & Analysis

    Checks whether an onion site is online. Simple CLI that reports reachability and response time.

    source
  • Docker Onion Nmap Scanners & Analysis

    Runs Nmap scans against onion services through the Tor network in a Docker container.

    source
  • TorBot Crawlers & Indexing

    Dark-web crawler with data extraction, page parsing, and custom module support. Python-based.

    source
  • TorCrawl.py Crawlers & Indexing

    Lightweight Python crawler that spider .onion domains via Tor proxy. Saves HTML/JSON output.

    source
  • VigilantOnion Crawlers & Indexing

    Continuous dark-web monitoring framework. Crawled content is indexed and alertable.

    source
  • OnionIngestor Crawlers & Indexing

    Modular onion site ingestor — crawl, parse, and export structured data from dark-web pages.

    source
  • Prying Deep Crawlers & Indexing

    Dark-web OSINT framework written in Go. Crawls .onion pages, extracts metadata, and generates reports.

    source
  • Darc Crawlers & Indexing

    Dark-web crawler with asynchronous architecture. Supports concurrent page scraping and content parsing.

    source
  • Midnight Sea Crawlers & Indexing

    Privacy-first dark-web scraper with proxy rotation and stealth techniques.

    source
  • DeepDarkCTI Intel Platforms
    essential

    Curated collection of dark-web threat intelligence sources, tools, and reports. Excellent starting point.

    source
  • Robin Intel Platforms
    essential

    AI-powered dark-web OSINT investigation tool. LLM-driven query refinement, multi-engine search, scrape, summarise.

    source
  • Recon Intel Platforms

    Dark-web reconnaissance framework with modular plugins for data collection and analysis.

    source
  • SOCRadar Dark Web Intel Platforms

    Commercial dark-web monitoring — leaked credentials, brand impersonation, forum mentions, ransomware leak sites.

  • Flare Systems Intel Platforms

    Dark-web + clear-web threat monitoring. Covers Telegram, Discord, ransomware leak sites, paste sites.

  • BreachForums Monitor Forums & Markets

    Tracking thread listings and user activity across breach-forum marketplaces.

  • Ransomwatch Forums & Markets
    essential

    Monitors and archives ransomware leak-site postings. Indexes victim disclosures from 50+ groups.

  • DarkFeed Forums & Markets

    IOC feed sourced from dark-web forums, ransomware leak sites, and Telegram channels.

  • IntelligenceX (Dark Web) Leak Databases
    essential

    Search across dark-web pages, paste sites, and leaked databases. Free tier with preview-only results.

  • DeHashed Leak Databases

    Credential search engine aggregating data from breach dumps and dark-web sources.

  • LeakCheck Leak Databases

    Search leaked credentials and personal data from dark-web breach compilations.

  • Snusbase Leak Databases

    Database search engine covering thousands of breach compilations sourced from dark-web channels.

  • Tor Gateway Miscellaneous
    essential

    The Tor network itself is the foundational layer. Tools in this directory require Tor for routing to .onion services.

  • torsocks Miscellaneous

    Wraps any CLI tool so its traffic routes through Tor. Use with curl, nmap, git — any TCP-based tool.

    source
  • Nyx Miscellaneous

    Terminal-based Tor status monitor. Shows bandwidth, circuit paths, relay info in real time.

    source
  • Tor Browser Miscellaneous
    essential

    Modified Firefox hardened for .onion browsing. The standard gateway for manual dark-web investigation.