1,090Live OSINT modules, one search bar

One identifier in.The whole footprint out.

Email, username, phone, IP or Discord ID — GhostEye fans it out across breach databases, messengers, social and gaming platforms and returns one structured report, every result tied to its source.

Start investigating Read the docs

Free plan · no credit card · 5 searches/day

0Live modules

0Breach sources

0+Username platforms

JSONAPI & export

Scroll

Workflows

Built for real investigation workflows.

Every module is designed to move you from a single signal to a sourced conclusion — faster.

breach database · resultsLIVE

Sources0/21 hit

GhostDB32

BreachBase18

OathNet11

LeakCheck9

IntelX7

HIBP6

Hudson Rock3

OsintCat0

test@gmail.comEMAIL

0 records

Gaming forum2021 · 4.1M rowsGHOSTDB

emailtest@gmail.com

usernameghost_404

password•••••••••

ip185.220.••.•

Combolist2024 · 19M rowsBREACHBASE

emailtest@gmail.com

password•••••••

hashbcrypt $2y$10…

domainexample.com

Stealer log2023 · infected deviceOATHNET

urlaccounts.example.com

password••••••••••

countryIT

E-commerce2019 · 2.6M rowsLEAKCHECK

emailtest@gmail.com

nameJ. Example

phone+39 347 ••• ••••

cityMilan

Paste dump2022 · textINTELX

emailtest@gmail.com

usernameghost_404

discord2837••••••

ip93.41.••.•

Breach Database

Enter an email, username, phone, IP or Discord ID and GhostEye queries every connected breach source in parallel — results deduplicated, grouped per source and merged into one report.

GhostEye Infected Device file manager showing a stealer-log victim's files and desktop screenshot

INFECTED DEVICE · 42 files

Passwords.txt11.3 KB

URLaccounts.example.com

USERj•••@example.com

PASS••••••••••

URLstore.example.net/login

USERghost_404

PASS••••••••

Infected Device

Open a stealer-log victim like a file manager — passwords, cookies, autofills, installed software and the desktop screenshot captured at infection time.

username footprint · ghost_404LIVE

0 found0 checked9 unknown

GitHubgithub.com/ghost_404FOUND

Redditreddit.com/u/ghost_404FOUND

Steamsteamcommunity.com/id/…FOUND

X (Twitter)x.com/ghost_404FOUND

Twitchtwitch.tv/ghost_404FOUND

Spotifyopen.spotify.com/user/…FOUND

TikToktiktok.com/@ghost_404NOT FOUND

Instagraminstagram.com/ghost_404NOT FOUND

Username footprint across 700+ platforms

Our own detection engine plus the WhatsMyName dataset — filter by status or category, pivot straight into a new search.

email osint · j•••@example.comLIVE

Email OSINT reportj•••@example.com · deliverable

0LOW RISK

DeliverableYes

DisposableNo

Domain age19 years

First seen2016-03

Data breaches0

Free providerYes

Registered on 0 platforms

GitHub

Spotify

Discord

Steam

Pinterest +7 more

Email OSINT

Fraud-risk scoring plus an account footprint — which platforms an address is registered on, without ever touching the mailbox.

phone osint · +1 555 0•••LIVE

+1 555 0••• ••••E.164 · United States

VALID

Line typeMobile

CarrierExample Wireless

RegionNANP · 555

Caller IDJ. Example

PortedNo

Linked accounts

WhatsAppregistered account

FOUND

Telegram@ghost_404 · last seen recently

FOUND

Snapchatno account linked

NONE

Risk

Low · 0 spam reports18 / 100

Phone OSINT

Carrier, line type, caller-ID and risk signals for any number in E.164 format — the picture behind a phone before you ever dial it.

github osint · example-devLIVE

Example Developer@example-dev · joined 2016 · Example City

0repos

0followers

0gists

0 contributions in the last yearmost active · Tue 21:00 UTC

Emails from commits

dev•••@example.com•••@users.noreply.github.com

Linked

example.devx.com/example · org: example-labs

GitHub OSINT

Profile, activity and public commit metadata — a fast read on a developer identity and the accounts and domains linked to it.

Investigation board

Turn scattered hits into a link-analysis graph — pivot from an email to a handle, from a handle to a breach, from a breach to an IP.

terminal · api/v1

# one header, plain HTTP curl "https://ghosteye.org/api/v1/breach?query=test@gmail.com" \ -H "X-API-Key: ge_live_…" { "ok": true, "data": { "type": "email", "count": 86, "sources": ["ghostdb", "breachbase", "oathnet"] } }

API & JSON export

The same modules over plain HTTP with a single key. Export any report as JSON and drop it into your own tooling.

How it works

OSINT turns public data into useful context. A result is only a starting point — good intelligence connects the clues, keeps the sources, and gives every finding the case context it needs.

Follow the signal

Start from an email, username, phone, IP, Discord ID or domain — GhostEye detects the type for you.

Fan out in parallel

Every relevant module is queried at the same time — the full picture in seconds, not source by source.

Keep the thread

Breaches, profiles and network traces in one sourced report — export as JSON or branch it into a board.

The work around every search.

GhostEye brings the tools that make research repeatable into one console — from the first lookup to the final report.

0Live modulesIdentity, messengers, social, gaming, network and financial tooling.

0Breach sourcesConnected breach and stealer-log databases behind a single query.

3DLink analysisA live investigation board to map every pivot between identifiers.

APIDeveloper accessThe same modules over HTTP from the Starter plan upward.

Capabilities

1,090 live modules. One console.

Breach databases, messengers, social platforms, gaming identities, network and financial tooling — no add-ons, no separate logins.

Email OSINTIdentity

Phone OSINTIdentity

Username FootprintIdentity

Gmail / GHuntIdentity

Breach DatabaseBreach

HIBPBreach

IntelXBreach

Private DoxBreach

DiscordMessenger

TelegramMessenger

IP LookupNetwork

WHOISNetwork

VirusTotalNetwork

PAN / BINFinancial

Crypto WalletsFinancial

VIN DecodeVehicle

SteamGaming

MinecraftGaming

RobloxGaming

Epic GamesGaming

MedalGaming

GitHubSocial

InstagramSocial

TikTokSocial

X (Twitter)Social

YouTubeSocial

RedditSocial

TwitchSocial

GeolocationImagery

Explore every feature

Pricing

Start free. Scale when you need to.

Every plan uses the same engine — pick the daily throughput that fits your work.

Starter

€15 / month

Full panel access for regular recon.

70 searches per day
30 Breach Database searches per day
Full panel access

See details

Common questions.

Everything you need to know before your first search. Still stuck? Reach us on Telegram.

Use OSINT responsibly GhostEye is for authorized research, security and educational use. Doxxing, stalking, harassment, fraud or unauthorized access are forbidden — you are responsible for how you use what you find.

An OSINT and breach-intelligence search engine. You enter one identifier and GhostEye queries every relevant module in parallel — breach databases, messengers, social and gaming platforms, network tools — then returns one structured, sourced report.

Emails, usernames, phone numbers, IP addresses, domains, Discord IDs and Minecraft players, plus specialised tools like PAN/BIN, crypto wallets, VIN and hash identification. The search bar detects the type automatically.

Yes. The free plan gives you 5 searches per day with no credit card. Upgrade any time for more daily lookups and additional sources — see pricing.

Yes — the same modules over plain HTTP with a single X-API-Key header, included from the Starter plan upward. Read the API documentation.

Public sources, platform lookups and connected breach and stealer-log databases. Every result is tied to the source that returned it, so you always know where a finding came from.

Yes. Reports can be exported as JSON, and any result can be branched into the investigation board to map the links between identifiers.

Start with one identifier.
See what links back.

Free plan · No credit card · 5 searches/day

Start investigating

One identifier in.The whole footprint out.

Built for real investigation workflows.

Breach Database

Infected Device

Username footprint across 700+ platforms

Email OSINT

Phone OSINT

GitHub OSINT

Investigation board

API & JSON export

Follow the signal

Fan out in parallel

Keep the thread

The work around every search.

1,090 live modules. One console.

Start free. Scale when you need to.

Common questions.

Start with one identifier.See what links back.

Start with one identifier.
See what links back.