Information Gathering
PhoneInfoga is an open-source OSINT framework for scanning international phone numbers. It first gathers basic information such as country, area, carrier and line type, then runs footprint scanners against public sources to try to find the VoIP provider or identify the owner.
curl -sSL https://raw.githubusercontent.com/sundowndev/phoneinfoga/master/support/scripts/install | bash
phoneinfoga scan -n <phone-number>
PhoneInfoga is an open-source OSINT framework that scans international phone numbers. It first gathers basic information such as country, area, carrier and line type, then uses a set of scanners to search public sources for footprints — pages, documents or provider clues linked to that number.
Version 2 is written in Go and ships as a single binary with a command-line interface, a browser web UI and a REST API. Its five built-in scanners are local, numverify, googlesearch, googlecse and ovh; the API-backed scanners need keys in a .env file, while the local scanner works with no configuration.
PhoneInfoga is used for scam-number checks, authorized investigations, and OSINT training. Note its upstream status: the project describes itself as stable but unmaintained, so it still works and is widely referenced, but bugs will not be fixed and the repository could be archived — pin a release version when you install it.
phoneinfoga versionPrint the installed PhoneInfoga versionphoneinfoga scan -n +1-555-123-4567Scan a phone number with all enabled scannersphoneinfoga scan -n +44 20 7946 0018Scan a UK number in international formatphoneinfoga scan -n +1234567890 --disable numverify,googlesearchScan while skipping the numverify and googlesearch scannersphoneinfoga scan -n +1234567890 --env-file config.envScan using API keys loaded from a specific env filephoneinfoga scan --helpShow all scan options and flagsphoneinfoga serveStart the web UI and REST API on port 5000phoneinfoga serve -p 8080Start the web UI and REST API on port 8080phoneinfoga serve --no-clientServe the REST API only, without the web clientphoneinfoga --helpShow all PhoneInfoga commands and global optionscurl -sSL https://raw.githubusercontent.com/sundowndev/phoneinfoga/master/support/scripts/install | bashInstall the latest release binary with the official install scriptsudo mv ./phoneinfoga /usr/local/bin/phoneinfogaMove the downloaded binary onto your PATH after the install scriptbrew install phoneinfogaInstall PhoneInfoga with Homebrew on macOS or Linuxdocker pull sundowndev/phoneinfoga:latestDownload the official PhoneInfoga Docker imagedocker run --rm -it sundowndev/phoneinfoga scan -n +1-555-123-4567Scan a number inside a throwaway Docker containerdocker run --rm -it -p 5000:5000 sundowndev/phoneinfoga serveRun the PhoneInfoga web UI from Docker on port 5000git clone https://github.com/sundowndev/phoneinfoga.gitClone the source code to build PhoneInfoga yourselfgo build -v -o phoneinfoga ./cmd/phoneinfogaBuild the PhoneInfoga binary from source with GoCheck whether a number is valid and get its country, carrier and line type.
Look up suspicious caller numbers before calling back or reporting them.
Find web pages and documents where a number appears.
Enrich an authorized investigation that starts from a phone number.
PhoneInfoga is used for phone number OSINT: validating an international number and gathering public information about it, such as country, carrier, line type and web footprints.
Use the official install script, Homebrew, Docker, or build from source — PhoneInfoga has no APT package in Kali.
Yes, it is a legitimate open-source tool. It only queries public sources and APIs; it cannot track a phone or reveal a precise location.
The tool is legal, but only use it on numbers you are authorized to investigate. Unauthorized investigation of private individuals can violate privacy laws.
Information Gathering
SpiderFoot is an open-source intelligence (OSINT) automation tool that integrates with over 200 public data sources to gather comprehensive intelligence on IP addresses, domain names, email addresses, and names. Created by Steve Micallef in 2012 and released under the MIT license, SpiderFoot automates the entire OSINT collection process with a powerful correlation engine that links findings across multiple data sources. It provides both a web-based UI (SpiderFoot HX) with interactive visualizations and a CLI for automation, making it one of the most popular OSINT frameworks for penetration testers, threat intelligence analysts, and security researchers. SpiderFoot is intended exclusively for authorized security testing, educational purposes, and defensive research.
Information Gathering
theHarvester is a comprehensive OSINT tool for gathering email addresses, subdomains, employee names, open ports, and banners from public sources including search engines, PGP key servers, Shodan, and DNS databases for passive reconnaissance and attack surface mapping.
Social Engineering
Sherlock is an OSINT tool used to track down social media accounts by username across hundreds of social networks to map an individual's online presence.
Information Gathering
Recon-ng is a full-featured Web Reconnaissance Framework focused on open source intelligence. It provides a powerful environment to conduct web-based reconnaissance quickly and thoroughly via community modules.
Information Gathering
Subfinder is a fast, passive subdomain discovery tool built by ProjectDiscovery. It finds valid subdomains of any target domain by collecting data from dozens of public online sources — Certificate Transparency logs, passive DNS databases, search engines, and threat-intelligence APIs — without ever sending a single packet to the target. Written in Go with a clean modular design, it is a favourite first step for bug bounty hunters, penetration testers, and security researchers who need reliable subdomain enumeration in seconds.
Information Gathering
OWASP Amass is the industry-standard in-depth network mapping and attack surface discovery tool. It uses active and passive techniques, scraping 20+ public data feeds, DNS enumeration, and certificate transparency logs to discover subdomains, IP addresses, and ASN data — making it essential for penetration testing, bug bounty hunting, and enterprise security assessments.
Master DNS enumeration techniques from basic queries to advanced zone transfers, subdomain brute forcing, and DNS security assessment using Kali Linux tools.
OSINT · IntermediateLearn a complete reconnaissance workflow combining OSINT, DNS enumeration, subdomain discovery, and active scanning for comprehensive target profiling.
OSINT · IntermediateLearn to use Amass for comprehensive attack surface mapping including DNS enumeration, subdomain discovery, integration with APIs, and visualizations.
OSINT · IntermediateLearn DNS enumeration techniques to discover domain infrastructure including record types, zone transfers, brute forcing, and DNS security extensions.
Each scan prints one block per scanner. The local scanner reports whether the number is valid plus its country, country code, location, carrier and line type. The numverify scanner adds the same fields from the Numverify API (Valid, Number, Local format, International format, Country prefix, Country code, Country name, Location, Carrier, Line type). The googlesearch and googlecse scanners list web pages where the number appears, and the ovh scanner reports OVH telecom data. Scanners without a configured API key report an error for that block instead of results, so a thin scan usually means missing keys, not a clean number.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.