What is SpiderFoot?
SpiderFoot automates open-source intelligence collection for reconnaissance, threat intelligence and assessment of internet exposure. Scans can start from domains, IP addresses, network ranges, email addresses, usernames and other identifiers. Its modules exchange findings to discover related infrastructure, accounts and information across data sources.
The MIT-licensed Python application runs through an embedded web server or entirely from the command line, with Docker deployment also supported. It provides configurable correlation rules, visualisations, structured exports and a SQLite back end for custom queries. Some modules depend on external services and API keys; the sources describe managed hosting and additional collaboration features separately under SpiderFoot HX.
Key capabilities
- Asset discovery Enumerates hosts, subdomains, DNS records and cloud storage resources associated with a target.
- Threat intelligence Queries reputation services, blocklists and breach data sources for indicators linked to scanned entities.
- Identity research Extracts contact information and searches for accounts associated with usernames and other identifiers.
- Correlation Connects collected findings through a YAML-configurable rule engine and visualisations.
- Data access Exports results in CSV, JSON and GEXF formats and supports custom queries against its SQLite back end.
- Deployment Runs as a self-hosted Python application with a web interface or command line, with Docker deployment files provided.
Where SpiderFoot fits
SpiderFoot fits into reconnaissance for authorised penetration tests and red-team exercises, as well as defensive reviews of information an organisation exposes on the internet. Investigators can use its collection and correlation functions to explore relationships between infrastructure, identities and threat indicators.
Before deployment, teams should review the selected modules, scan scope and authorisation, particularly when enabling port scanning, DNS zone transfer attempts or other active checks. They should also verify external service requirements, API credentials and associated costs. The documentation recommends packaged releases rather than the development branch, which may contain features and modules that are not fully tested.
Reviews of SpiderFoot
Be the first to share your experience with SpiderFoot.
Write a review
Loading review form…
Alternatives to SpiderFoot
God's Eye ViewGod's Eye View combines public aircraft, satellite, earthquake and camera feeds in a Cesium globe. Run it locally, inspect each data source, add optional voice control and connect agents through MCP.SSherlockSherlock searches social networks for accounts matching supplied usernames. It runs from the command line, supports local installation or Docker, and exports findings for further review.