| Guide | GDE-017 |
| Topic | SpiderFoot |
| Domain | Digital infrastructure |
| Last updated | August 2026 |
Short answer: Install SpiderFoot, add the API keys you need, scope the scan to passive modules, then review the correlation graph and verify high-value findings manually.
What is SpiderFoot?
SpiderFoot is an open-source reconnaissance automation framework that runs a target, such as a domain, IP address, email or username, through more than 200 data source modules and correlates the results into a single relationship graph. It answers the breadth question no single manual tool can: what does the full footprint of a target look like across every data source at once.
Manual OSINT work checks sources one at a time. SpiderFoot automates that process by dispatching a single target through dozens or hundreds of modules in parallel, covering DNS records, breach databases, social media presence, port scans, threat intelligence feeds and more, then correlating overlapping findings into a graph showing how entities connect.
Investigators use SpiderFoot to establish a comprehensive baseline footprint of a domain or individual before manual deep-dive work, to identify data sources worth investigating further by hand, and to monitor a target for new exposure over time through scheduled scans.
| • | Establishing a comprehensive baseline footprint of a domain, IP or individual before manual investigation |
| • | Correlating findings across many data sources automatically rather than checking each manually |
| • | Discovering data sources and exposures a manual workflow might miss entirely |
| • | Monitoring a target for newly exposed information over repeated scans |
| • | Mapping infrastructure relationships between domains, IPs and organisations at scale |
How do you run a SpiderFoot OSINT scan?
Install the framework, scope the scan to relevant modules, then interpret the correlation graph it produces.
Free before paid. SpiderFoot itself is free and open source; some of the modules it calls query third-party APIs that require their own free-tier keys for full coverage.
SpiderFoot (self-hosted): Free and open source, MIT licensed. Runs locally or on a server you control, with a web interface for configuring and reviewing scans. The version this guide covers.
SpiderFoot HX: Free trial, then paid. The hosted commercial version, offering additional modules and managed infrastructure; most individual investigators run the free self-hosted edition instead.
VirusTotal: Free API tier. One of many third-party data sources SpiderFoot can query given a free API key, adding domain and file reputation data to a scan.
Shodan: Free tier with limited queries. Another commonly integrated data source; adding a Shodan API key to SpiderFoot enriches infrastructure scans with exposed-service data.