SpiderFoot is an open-source Python 3 framework for automating OSINT reconnaissance via a web UI or CLI. It includes over 200 modules, a YAML-driven correlation engine, data exports, TOR support and integrates with tools like Nmap, SHODAN and HaveIBeenPwned. For teams and large-scale scans, SpiderFoot HX adds cloud hosting, multi-user collaboration, REST APIs and change alerts.

• SpiderFoot has 200+ modules pulling from SHODAN, HaveIBeenPwned, GreyNoise, AlienVault OTX and more, with a YAML-based correlation engine running 37 pre-built rules to link findings like leaked emails to vulnerable subdomains.
• It's free, MIT-licensed, and runs via a local web UI or CLI (Python 3.7+, SQLite backend), chaining into tools like Nmap, CMSeeK and DNSTwist for port scans and typo-domain checks.
• Targets span IPs, ASNs, emails, phone numbers and even Bitcoin wallets, with most modules working without paid API keys.
• The paid SpiderFoot HX adds cloud hosting, multi-user/2FA access, Splunk/ElasticSearch/Slack integration, attack-surface monitoring with change alerts, and a REST API.