OSINTLeak vs SpiderFoot
OSINTLeak
OSINTLeak is a cloud-hosted breach intelligence platform whose page title describes it as a breach intelligence platform and stealer log search. It offers search across emails, usernames, phone numbers and other indicators with 17 or more search selectors, domain and IP intelligence, WHOIS, reverse image search and real-time monitoring, and it targets OSINT researchers, enterprises, governments and law enforcement. Pricing is published in US dollars from a free Community tier of 20 searches per day to a Developer tier at USD 250 per month with API access, and an Enterprise option from USD 6,500 per year. A Python client and command-line tool, pyosintleak, is published on GitHub and PyPI. The terms state the service is operated by BREACHGUARDS LLC, is available only to professional users, and that data is obtained from public and less public sources rather than purchased from threat actors; no address or jurisdiction is published. An opt-out page allows individuals to remove their email address from public search after verification.
Pros
- Published tiered pricing with a free tier
- Public Python client and CLI on GitHub and PyPI for API automation
- Terms state data is not purchased from threat actors and the service is restricted to professional users
Things to check
- Operator named only as BREACHGUARDS LLC with no address or jurisdiction published, and no registry record found
- Access to stealer logs and leaked credentials raises legal and ethical questions a buyer must clear with counsel
Pricing: Community free (20 searches per day); Starter USD 35 per month or USD 350 per year (150 per day); Platinum USD 100 per month or USD 960 per year (500 per day); Developer USD 250 per month or USD 2,400 per year (1,500 per day, API); Enterprise from USD 6,500 per year.
SpiderFoot
SpiderFoot is an open-source (MIT) tool that automates OSINT collection for threat intelligence and for mapping an organisation's attack surface. Given a target such as a domain, IP address, email address or name, it runs over 200 modules against data sources and correlates the results, using a YAML-configurable correlation engine with 37 pre-defined rules. It runs as a self-hosted web application or from the command line, supports Docker deployment, can search the dark web through Tor, and can call other tools such as Nmap and DNSTwist. The project has been on GitHub since 2012.
Pros
- Free and open source under the MIT licence
- Broad automated collection from one scan
- Self-hosted, so scan data stays on your own infrastructure
Things to check
- Self-hosted: you install, run and maintain it
Pricing: Free and open source (MIT).