OSINT tool for finding leaked credentials, secrets and company exposure

I’ve been working on an OSINT project focused on a problem I kept running into during investigations.

You can find a breach record, credential dump, exposed API key or a mention of a company somewhere online, but connecting those findings and figuring out what actually matters can become a huge amount of manual work.

So I built EmptyFrog.

It continuously monitors sources such as breach datasets, dark web sources, public repositories, paste sites and forums, then correlates the findings around domains, keywords, VIPs and repositories.

The goal is pretty simple.

Turn raw exposure into something an analyst can actually investigate.

You can monitor things like:

• Leaked credentials
• API keys and secrets
• Exposed documents
• Breach records
• Infostealer-related exposure
• Company and brand mentions
• Threat actor discussions
• Public repository leaks

The interesting part for me is the correlation layer. Instead of having to manually search through thousands of records, the platform groups related findings and generates contextualized incidents.

It also has Slack, webhook and REST API integrations, with SIEM/SOAR integrations available for larger deployments.

There’s a free trial if anyone wants to play with it.

https://emptyfrog.io

I’d genuinely like feedback from people who do OSINT, CTI, DFIR or security research.

What sources do you currently use for this kind of investigation, and what information do you usually wish you had but can’t easily get?