> Start from an email, a username, a phone, a domain, an IP or a photo. Pandora Search runs 107 transforms over 135 open sources and draws a graph of relationships, with the source of every finding and an audit trail. OSINT link analysis · in the browser # From one data point to a graph of relationships. Enter an email, a username, a phone number, a domain, an IP or a photo. Pandora Search queries open sources, links what it finds into a graph and keeps the source of every finding, with an audit trail for each case. [Get started](https://pandorasearch.com/login/) [See pricing](https://pandorasearch.com/pricing/) 3 trial searches on sign-up · no card required · sign in with an email link, no password TRANSFORMS **107** SOURCES **135** ENTITY TYPES **19** ## The key facts 107 **transforms**, from username sweeps to certificate logs, run automatically or one at a time. 135 **sources**: public APIs, open data, official registries and open-source tools. 19 **entity types**: emails, usernames, accounts, people, phones, domains, URLs, IPs, ASNs, companies, places, photos, documents, breaches, posts, software, devices, Discord IDs and public keys. 5 **views** of the same case: Graph, Map, Timeline, Dossier and Table. 3 **trial searches** to see how much Pandora finds, masked until you pick a plan. No card required. How a case runs ## Three steps from the first query to the graph 1. ### Enter one data point An email, a username, a phone, a domain, an IP, a URL, a name, a Discord ID or a pair of coordinates. Pandora detects the type; if it is ambiguous, Tab switches between candidates. Photos and documents go in through the paperclip. 2. ### Declare the purpose, choose the depth Write why you are investigating: it goes into the audit log. Quick runs the automatic sources on the data point; Deep runs another round on the usernames, emails, domains and IPs that appear. 3. ### Read the graph as it grows Each transform streams its findings into the graph. Double-click an entity to run its automatic transforms, right-click to choose any of them, and switch to the map, timeline, dossier or table at any time. What it does ## Seven ways in, one graph Every finding becomes an entity on the graph, linked to what produced it. The inspector shows its properties, its connections, the provenance of each data point and the transforms you can run next. [01] Identity and accounts ### Where a username or an email has an account Account sweeps across thousands of sites, registration checks and public profiles, with each match tied to the source that found it. The same username on two sites can belong to two people, so the Dossier counts how many independent sources agree. - Username sweeps with WhatsMyName, Sherlock and Maigret; email registrations with Holehe, with the password-recovery checks switched off - Public profiles through each platform's API: GitHub, Gravatar, Stack Exchange, Bluesky and its name history, Discourse forums, Roblox, Minecraft and Telegram's public preview - SSH and PGP public keys on code forges: the same key on two accounts links them almost certainly - Packages published on 12 registries, from npm and PyPI to Docker Hub and WordPress.org [Read about it on the blog: Username OSINT](https://pandorasearch.com/blog/topic/username-osint/) [02] Emails and breaches ### Breach exposure, never the secrets For an email or a username, Pandora lists the breaches it appears in, with the name, the date and the types of data exposed. It does not request or display passwords, hashes or any other leaked value, from any source. - Breach exposure from XposedOrNot, LeakCheck's public API and Have I Been Pwned - The email's profile: whether its domain receives mail, whether the provider is disposable, its Gravatar and its PGP keys - Commercial connectors follow the same rule: from a breach record Pandora reads only its source, date and data types, and it never asks them for infostealer logs - Infostealer log search engines are never queried [Read about it on the blog: Email OSINT](https://pandorasearch.com/blog/topic/email-osint/) [03] Domains and infrastructure ### Domains, IPs and what connects them From a domain or an IP: DNS, registration data, certificates, the history of what pointed where, and reputation flags from open threat feeds, on the same graph as the accounts and the people. - DNS over HTTPS, RDAP and WHOIS, and subdomains from Certificate Transparency (crt.sh, Certspotter) - Passive DNS, reverse DNS and other sites that share an IP or an analytics ID - Open ports and known vulnerabilities from Shodan InternetDB; network and owner from RIPEstat - Tor, VPN and hosting flags and abuse lists, plus VirusTotal, AlienVault OTX, AbuseIPDB and abuse.ch - Registered look-alike domains (dnstwist) and URLs archived in Common Crawl and the Wayback Machine [Read about it on the blog: Domain and IP recon](https://pandorasearch.com/blog/topic/domain-ip-recon/) [04] Images and metadata ### What a photo or a document carries Upload a photo or a document and Pandora reads its metadata. GPS coordinates go to the map; the camera, the software and the dates go to the timeline. - EXIF: camera, lens, capture date and GPS position - The same photo on different accounts, by perceptual hash (pHash) and not by face recognition; generic avatars do not link accounts - Document metadata (author, software, dates) and the public documents of a domain, following the Metagoofil method - Reverse image search in one click (Google Lens, Yandex, Bing, TinEye) and Google Cloud Vision web detection [Read about it on the blog: Image OSINT](https://pandorasearch.com/blog/topic/image-osint/) [05] Places and maps ### Places on a map, each with its origin Geolocated IPs, photo GPS and geocoded places appear on a dark OpenStreetMap basemap. Coordinates pasted from a map or an EXIF viewer go in as a location. - IP geolocation and network owner, from online services and local databases (DB-IP, iptoasn) - What surrounds a point, from OpenStreetMap's Overpass API - Street-level photos around a point, from Mapillary - OpenStreetMap accounts for a username [06] Companies and registries ### Who runs a company, and since when Searches for a company or a person in official registries return roles with their dates and whether they are still current. A partial name match is presented as a possible namesake, not as the person. - A local index of Spain's BORME (Section I): directors and corporate acts, without tax IDs - UK Companies House: officers and persons with significant control - OpenCorporates (140 jurisdictions), GLEIF LEI records and Wikidata - Press mentions worldwide, from GDELT [Read about it on the blog: Company records](https://pandorasearch.com/blog/topic/company-records/) [07] Dossier and export ### A dossier you can check, and files you can take elsewhere The Dossier merges the case into one profile: names, usernames, emails, phones, places, photos, accounts and breaches, each with the number of independent sources that back it. Cases save themselves and export in standard formats. - Corroboration per data point: green for several sources, yellow for one, and an exposure index - Strong corroboration when the same public key or the same photo appears on different accounts - The time-zone footprint of each platform: when they all point to the same offset, the Dossier says so - Export to JSON, CSV, GraphML (Maltego, Gephi, yEd), a PNG of the graph and a printable report Five views ## One case, five ways to read it ### Graph The case grows live as each transform streams its findings. Select, pin and expand; F frames the graph, Ctrl+K adds or finds an entity. ### Map Geolocated IPs, photo GPS and geocoded places on a dark OpenStreetMap basemap. ### Timeline Account sign-ups, breaches, posts (and deleted ones), domain registrations, photos and documents, in lanes by type. ### Dossier The unified profile: each data point with the number of sources that back it, and an exposure index. ### Table Every entity in the case, filterable and sortable. Who it is for ## For people who must show where each finding came from 01 ### Investigators Private and corporate investigators who need every finding tied to a source they can cite, and a record of how the case was built. 02 ### Journalists Check who is behind an account, a domain or a company before publishing, and keep the trail that led there. 03 ### Security and CTI teams Map the infrastructure behind a phishing domain or an IP, and the public exposure of your own people and domains. 04 ### Due diligence and KYC Review directors, companies and their public footprint, with registry dates and press mentions. 05 ### Researchers Study open-source methods with a tool that records its purpose, its queries and the source of each result. Legality ## Built for lawful investigations Open sources are not a free-for-all. Pandora records why each case exists, what was asked and where each answer came from, and leaves out what a lawful investigation does not need. ### What every case has - **A declared purpose:** written when the case starts and kept in the audit log. - **An audit log:** every query, with the transform and the source that answered it. - **Provenance:** each data point keeps the transform and the source that produced it. - **Passive collection:** no query notifies the person investigated; password-recovery checks are off. ### What Pandora leaves out - **Secrets:** no passwords, hashes or leaked values: the exposure only. - **GDPR special categories:** adult, dating, health, religion and politics sites are not queried. - **Face recognition:** photos are compared by perceptual hash, never with biometric data. - **Getting around protections:** no anti-bot evasion, no access controls bypassed, no infostealer log searches. [Read the acceptable use policy](https://pandorasearch.com/legal/acceptable-use/) [Read about it on the blog: Ethics and law](https://pandorasearch.com/blog/topic/ethics-legal/) Pricing ## Plans by credits per month Every plan includes the same transforms, views and exports. Each transform costs credits: 1 for an open source, 5 for a heavy sweep. A quick investigation uses about 50. ANALYST **2,000** credits / month ≈ 40 quick investigations **$11.66** /month billed annually ($139.99) Save 80% INVESTIGATOR **15,000** credits / month ≈ 300 quick investigations **$49.91** /month billed annually ($599) Save 66% AGENCY **150,000** credits / month ≈ 3,000 quick investigations **$1,249.16** /month billed annually ($14,990) Save 16% [See all cycles, credit packs and what a credit buys](https://pandorasearch.com/pricing/) Blog ## Latest from the blog - [Geolocating a photo or a point on the map](https://pandorasearch.com/blog/geolocate-a-photo-or-a-point-on-the-map/): How to place a photo using clues in the scene, OpenStreetMap and Overpass, street-level imagery and shadows, and where the ethical limits lie. - [Checking breach exposure without touching passwords](https://pandorasearch.com/blog/check-breach-exposure-without-touching-passwords/): Using Have I Been Pwned, XposedOrNot and LeakCheck to measure an email's breach exposure, and why handling leaked passwords crosses a line. - [OSINT and the GDPR: investigating within the law](https://pandorasearch.com/blog/osint-and-gdpr-investigating-within-the-law/): Lawful basis, purpose limitation, minimisation, special categories and audit trails: how to apply the GDPR to an OSINT investigation. [All articles](https://pandorasearch.com/blog/) Questions ## Frequently asked questions **What is Pandora Search?** A link-analysis tool for open-source investigation that runs in the browser. You start from one data point (an email, a username, a phone number, a domain, an IP, a URL, a name, a Discord ID, a photo or a document) and Pandora chains open sources, drawing what it finds as a graph, with a map, a timeline, a unified dossier and a table. **Is it legal to use?** Pandora only queries publicly available sources, passively. Whether a specific investigation is lawful depends on its purpose: you need a legitimate reason and a legal basis, especially under the GDPR when the subject is a person. Each case records its declared purpose in the audit log, and the acceptable use policy lists what is not allowed. **Does Pandora show leaked passwords?** No. For a breach it shows the name, the date and the types of data exposed. It does not request or display passwords, hashes or other leaked values, and it never queries infostealer log search engines. **Does it use face recognition?** No. To find the same photo on different accounts it compares a perceptual hash of the image (pHash), which is not biometric data. Generic avatars do not link accounts. **Will the person I investigate be notified?** Collection is passive: no query is meant to reach the person, and the registration checks that would trigger a password-recovery email are switched off. **How do credits work?** Each transform costs credits: 1 for an open source, 5 for a heavy one (sweeps across thousands of sites, dorks, Overpass) and premium sources at their own price. Links you open by hand cost nothing. A quick investigation uses about 50 credits. Plans renew their credits every period. A free account has 3 trial searches that spend no credits and show what they find masked. **Do I need my own API keys?** Not for most sources. A few providers do not allow resale (VirusTotal (public API), Last.fm, osu!, EmailRep (free tier), OpenCorporates (free tier), Shodan (academic membership), Hunter.io); those run with your own key, and then cost 1 credit. **Can I export to Maltego?** Yes. Cases export to GraphML, which Maltego imports with Import › Graph from GraphML and which Gephi and yEd open directly. JSON, CSV, a PNG of the graph and a printable report are also available. ## Start with one data point. Create your account with a link sent to your email: no password, no card. You get 3 trial searches to see how much it finds. [Create your account](https://pandorasearch.com/login/) or [compare the plans](https://pandorasearch.com/pricing/) --- Page: https://pandorasearch.com/