PANDORASEARCH
ENES
Get started
ENES
Get started

OSINT link analysis · in the browser

From one data point to a graph of relationships.

Enter an email, a username, a phone number, a domain, an IP or a photo. Pandora Search queries open sources, links what it finds into a graph and keeps the source of every finding, with an audit trail for each case.

Get started See pricing

3 trial searches on sign-up · no card required · sign in with an email link, no password

TRANSFORMS 107 SOURCES 135 ENTITY TYPES 19

The key facts

107

transforms, from username sweeps to certificate logs, run automatically or one at a time.

135

sources: public APIs, open data, official registries and open-source tools.

19

entity types: emails, usernames, accounts, people, phones, domains, URLs, IPs, ASNs, companies, places, photos, documents, breaches, posts, software, devices, Discord IDs and public keys.

5

views of the same case: Graph, Map, Timeline, Dossier and Table.

3

trial searches to see how much Pandora finds, masked until you pick a plan. No card required.

How a case runs

Three steps from the first query to the graph

  1. Enter one data point

    An email, a username, a phone, a domain, an IP, a URL, a name, a Discord ID or a pair of coordinates. Pandora detects the type; if it is ambiguous, Tab switches between candidates. Photos and documents go in through the paperclip.

  2. Declare the purpose, choose the depth

    Write why you are investigating: it goes into the audit log. Quick runs the automatic sources on the data point; Deep runs another round on the usernames, emails, domains and IPs that appear.

  3. Read the graph as it grows

    Each transform streams its findings into the graph. Double-click an entity to run its automatic transforms, right-click to choose any of them, and switch to the map, timeline, dossier or table at any time.

What it does

Seven ways in, one graph

Every finding becomes an entity on the graph, linked to what produced it. The inspector shows its properties, its connections, the provenance of each data point and the transforms you can run next.

[01] Identity and accounts

Where a username or an email has an account

Account sweeps across thousands of sites, registration checks and public profiles, with each match tied to the source that found it. The same username on two sites can belong to two people, so the Dossier counts how many independent sources agree.

  • Username sweeps with WhatsMyName, Sherlock and Maigret; email registrations with Holehe, with the password-recovery checks switched off
  • Public profiles through each platform's API: GitHub, Gravatar, Stack Exchange, Bluesky and its name history, Discourse forums, Roblox, Minecraft and Telegram's public preview
  • SSH and PGP public keys on code forges: the same key on two accounts links them almost certainly
  • Packages published on 12 registries, from npm and PyPI to Docker Hub and WordPress.org
Read about it on the blog: Username OSINT

[02] Emails and breaches

Breach exposure, never the secrets

For an email or a username, Pandora lists the breaches it appears in, with the name, the date and the types of data exposed. It does not request or display passwords, hashes or any other leaked value, from any source.

  • Breach exposure from XposedOrNot, LeakCheck's public API and Have I Been Pwned
  • The email's profile: whether its domain receives mail, whether the provider is disposable, its Gravatar and its PGP keys
  • Commercial connectors follow the same rule: from a breach record Pandora reads only its source, date and data types, and it never asks them for infostealer logs
  • Infostealer log search engines are never queried
Read about it on the blog: Email OSINT

[03] Domains and infrastructure

Domains, IPs and what connects them

From a domain or an IP: DNS, registration data, certificates, the history of what pointed where, and reputation flags from open threat feeds, on the same graph as the accounts and the people.

  • DNS over HTTPS, RDAP and WHOIS, and subdomains from Certificate Transparency (crt.sh, Certspotter)
  • Passive DNS, reverse DNS and other sites that share an IP or an analytics ID
  • Open ports and known vulnerabilities from Shodan InternetDB; network and owner from RIPEstat
  • Tor, VPN and hosting flags and abuse lists, plus VirusTotal, AlienVault OTX, AbuseIPDB and abuse.ch
  • Registered look-alike domains (dnstwist) and URLs archived in Common Crawl and the Wayback Machine
Read about it on the blog: Domain and IP recon

[04] Images and metadata

What a photo or a document carries

Upload a photo or a document and Pandora reads its metadata. GPS coordinates go to the map; the camera, the software and the dates go to the timeline.

  • EXIF: camera, lens, capture date and GPS position
  • The same photo on different accounts, by perceptual hash (pHash) and not by face recognition; generic avatars do not link accounts
  • Document metadata (author, software, dates) and the public documents of a domain, following the Metagoofil method
  • Reverse image search in one click (Google Lens, Yandex, Bing, TinEye) and Google Cloud Vision web detection
Read about it on the blog: Image OSINT

[05] Places and maps

Places on a map, each with its origin

Geolocated IPs, photo GPS and geocoded places appear on a dark OpenStreetMap basemap. Coordinates pasted from a map or an EXIF viewer go in as a location.

  • IP geolocation and network owner, from online services and local databases (DB-IP, iptoasn)
  • What surrounds a point, from OpenStreetMap's Overpass API
  • Street-level photos around a point, from Mapillary
  • OpenStreetMap accounts for a username

[06] Companies and registries

Who runs a company, and since when

Searches for a company or a person in official registries return roles with their dates and whether they are still current. A partial name match is presented as a possible namesake, not as the person.

  • A local index of Spain's BORME (Section I): directors and corporate acts, without tax IDs
  • UK Companies House: officers and persons with significant control
  • OpenCorporates (140 jurisdictions), GLEIF LEI records and Wikidata
  • Press mentions worldwide, from GDELT
Read about it on the blog: Company records

[07] Dossier and export

A dossier you can check, and files you can take elsewhere

The Dossier merges the case into one profile: names, usernames, emails, phones, places, photos, accounts and breaches, each with the number of independent sources that back it. Cases save themselves and export in standard formats.

  • Corroboration per data point: green for several sources, yellow for one, and an exposure index
  • Strong corroboration when the same public key or the same photo appears on different accounts
  • The time-zone footprint of each platform: when they all point to the same offset, the Dossier says so
  • Export to JSON, CSV, GraphML (Maltego, Gephi, yEd), a PNG of the graph and a printable report

Five views

One case, five ways to read it

Graph

The case grows live as each transform streams its findings. Select, pin and expand; F frames the graph, Ctrl+K adds or finds an entity.

Map

Geolocated IPs, photo GPS and geocoded places on a dark OpenStreetMap basemap.

Timeline

Account sign-ups, breaches, posts (and deleted ones), domain registrations, photos and documents, in lanes by type.

Dossier

The unified profile: each data point with the number of sources that back it, and an exposure index.

Table

Every entity in the case, filterable and sortable.

Who it is for

For people who must show where each finding came from

01

Investigators

Private and corporate investigators who need every finding tied to a source they can cite, and a record of how the case was built.

02

Journalists

Check who is behind an account, a domain or a company before publishing, and keep the trail that led there.

03

Security and CTI teams

Map the infrastructure behind a phishing domain or an IP, and the public exposure of your own people and domains.

04

Due diligence and KYC

Review directors, companies and their public footprint, with registry dates and press mentions.

05

Researchers

Study open-source methods with a tool that records its purpose, its queries and the source of each result.

Legality

Built for lawful investigations

Open sources are not a free-for-all. Pandora records why each case exists, what was asked and where each answer came from, and leaves out what a lawful investigation does not need.

What every case has

  • A declared purpose: written when the case starts and kept in the audit log.
  • An audit log: every query, with the transform and the source that answered it.
  • Provenance: each data point keeps the transform and the source that produced it.
  • Passive collection: no query notifies the person investigated; password-recovery checks are off.

What Pandora leaves out

  • Secrets: no passwords, hashes or leaked values: the exposure only.
  • GDPR special categories: adult, dating, health, religion and politics sites are not queried.
  • Face recognition: photos are compared by perceptual hash, never with biometric data.
  • Getting around protections: no anti-bot evasion, no access controls bypassed, no infostealer log searches.

Read the acceptable use policy Read about it on the blog: Ethics and law

Pricing

Plans by credits per month

Every plan includes the same transforms, views and exports. Each transform costs credits: 1 for an open source, 5 for a heavy sweep. A quick investigation uses about 50.

ANALYST

2,000 credits / month

≈ 40 quick investigations

$11.66/month

billed annually ($139.99)

Save 80%

INVESTIGATOR

15,000 credits / month

≈ 300 quick investigations

$49.91/month

billed annually ($599)

Save 66%

AGENCY

150,000 credits / month

≈ 3,000 quick investigations

$1,249.16/month

billed annually ($14,990)

Save 16%

See all cycles, credit packs and what a credit buys

Blog

Latest from the blog

Image OSINT

Geolocating a photo or a point on the map

How to place a photo using clues in the scene, OpenStreetMap and Overpass, street-level imagery and shadows, and where the ethical limits lie.

Email OSINT

Checking breach exposure without touching passwords

Using Have I Been Pwned, XposedOrNot and LeakCheck to measure an email's breach exposure, and why handling leaked passwords crosses a line.

Ethics and law

OSINT and the GDPR: investigating within the law

Lawful basis, purpose limitation, minimisation, special categories and audit trails: how to apply the GDPR to an OSINT investigation.

All articles

Questions

Frequently asked questions

What is Pandora Search?

A link-analysis tool for open-source investigation that runs in the browser. You start from one data point (an email, a username, a phone number, a domain, an IP, a URL, a name, a Discord ID, a photo or a document) and Pandora chains open sources, drawing what it finds as a graph, with a map, a timeline, a unified dossier and a table.

Is it legal to use?

Pandora only queries publicly available sources, passively. Whether a specific investigation is lawful depends on its purpose: you need a legitimate reason and a legal basis, especially under the GDPR when the subject is a person. Each case records its declared purpose in the audit log, and the acceptable use policy lists what is not allowed.

Does Pandora show leaked passwords?

No. For a breach it shows the name, the date and the types of data exposed. It does not request or display passwords, hashes or other leaked values, and it never queries infostealer log search engines.

Does it use face recognition?

No. To find the same photo on different accounts it compares a perceptual hash of the image (pHash), which is not biometric data. Generic avatars do not link accounts.

Will the person I investigate be notified?

Collection is passive: no query is meant to reach the person, and the registration checks that would trigger a password-recovery email are switched off.

How do credits work?

Each transform costs credits: 1 for an open source, 5 for a heavy one (sweeps across thousands of sites, dorks, Overpass) and premium sources at their own price. Links you open by hand cost nothing. A quick investigation uses about 50 credits. Plans renew their credits every period. A free account has 3 trial searches that spend no credits and show what they find masked.

Do I need my own API keys?

Not for most sources. A few providers do not allow resale (VirusTotal (public API), Last.fm, osu!, EmailRep (free tier), OpenCorporates (free tier), Shodan (academic membership), Hunter.io); those run with your own key, and then cost 1 credit.

Can I export to Maltego?

Yes. Cases export to GraphML, which Maltego imports with Import › Graph from GraphML and which Gephi and yEd open directly. JSON, CSV, a PNG of the graph and a printable report are also available.

Start with one data point.

Create your account with a link sent to your email: no password, no card. You get 3 trial searches to see how much it finds.

Create your account

or compare the plans