--- title: "Best OSINT APIs (and IP Intelligence Tools)" category: "comparisons" url: https://keirolabs.cloud/blog/best-osint-apis --- There is no single best OSINT API. There is a best one per layer: IPinfo and MaxMind for IP intelligence, Shodan and Censys for exposed devices and certificates, SecurityTrails and WhoisXML for domain and DNS history, Hunter.io for people and inboxes, and a web search and extraction API for everything that only exists as a fresh page. This post prices every layer per 1,000 queries from each vendor's own pricing pages, checked on September 23, 2026. It is written for the legitimate side of this work: fraud checks, threat intel, journalism, and security research. ## The 60-second version OSINT APIs come in layers, and the pricing models barely overlap. Here is the field, priced as of September 23, 2026: - **IPinfo**: Lite is free forever with unlimited requests at country level only. Core runs $26/mo, Max $163/mo, Enterprise custom. Overages bill at $0.34 per +1k on Core and $1.30 per +1k on Max. The privacy-detection layer (VPN, proxy, Tor, relay) is paid only. ([IPinfo pricing](https://ipinfo.io/pricing)) - **MaxMind**: GeoLite2 is the free database. GeoIP2 Precision web services bill per query: Country $0.0001 ($0.10/1k), City Plus $0.0003 ($0.30/1k), Insights $0.002 ($2.00/1k) with proxy detection and confidence factors. ([MaxMind GeoIP2](https://www.maxmind.com/en/geoip2-precision-services)) - **ip-api**: free endpoint at 45 requests per minute, HTTP only, non-commercial use only. Pro is EUR 13.30 per month billed annually: unlimited queries, HTTPS, commercial use, a 99.9% SLA. ([ip-api](https://ip-api.com/), [pro](https://members.ip-api.com/)) - **ipapi.co**: free 1,000 lookups/day (about 30,000/month), which their own FAQ says is for trial and evaluation, not production. Paid plans run $15/mo for 60,000 lookups up to $399/mo for 15M. ([ipapi.co pricing](https://www.ipapi.co/pricing/)) - **Shodan**: Membership is $49 one-time (a lifetime upgrade). Freelancer $69/mo, Small Business $359/mo, Corporate $1,099/mo. Free accounts get 100 query credits and 100 scan credits per month, and every API plan is rate limited to 1 request per second. ([Shodan billing](https://account.shodan.io/billing)) - **Censys**: free account with basic visibility into standard ports and services. API access is included across tiers, and credit packages start at $100. ([Censys pricing](https://censys.com/pricing/)) - **SecurityTrails**: free account with 50 API queries/month; the commercial domain and DNS history API is quoted by volume, with no public price list. ([SecurityTrails pricing](https://securitytrails.com/corp/pricing)) - **Hunter.io**: free 50 credits/month. Starter $49/mo for 2,000 credits, Growth $149/mo for 10,000, Scale $299/mo for 25,000, and yearly billing takes 30% off. One credit per email found; nothing charged when no email is found. ([Hunter pricing](https://hunter.io/pricing)) - **WhoisXML API**: 500 free queries to start, then one-time, monthly, or yearly packages across separate WHOIS, DNS, IP, and subdomain APIs. ([WhoisXML pricing](https://whois.whoisxmlapi.com/pricing)) - **Keirolabs**: not IP data, the open-web layer. /search/lite bills 0.1 credit per request on monthly plans: $0.24/1k on Essential ($30/mo), $0.13/1k on Pro, $0.08/1k on Startup. /search/fast is 1 credit, /search/content and /extract are 3, /answer is 5, deep research is 20. Free tier is 1,250 credits/month (12,500 lite searches), no card. ([Keiro pricing](https://keirolabs.cloud/pricing)) No vendor wins all six layers, and the vendor that claims to is selling you a wrapper with a margin. Build the stack from the table, then argue about price. ## OSINT API An OSINT API is an HTTP endpoint that returns structured public data: an IP's registered network and location, a device's banner, a domain's DNS history, a certificate's subject, an email address tied to a person. You send a query, you get JSON. That is the whole contract, and it is why the category is fragmented: the public records that matter live in different databases, maintained by different organizations, licensed under different rules. Type "OSINT API" into a search box and you mostly get IP geolocation vendors, because that is the layer with marketing budgets. But IP geolocation is only one of six layers an investigation actually touches: 1. **IP intelligence.** Geo, ASN, network owner, hosting versus residential, and privacy flags (VPN, proxy, Tor exit, relay). IPinfo, MaxMind, ip-api, ipapi.co. 2. **Internet device search.** Banners, open ports, exposed services, certificate transparency. Shodan, Censys. 3. **Domain and DNS history.** Current and historical WHOIS, passive DNS, subdomain enumeration. SecurityTrails, WhoisXML API. 4. **People and email.** Domain-to-email discovery, verification. Hunter.io. 5. **The open web.** Fresh pages, site content, reporting on the infrastructure you are investigating. A search and extraction API. This is where Keirolabs sits. 6. **Leaks and breaches.** Credential exposure databases. A real category, but the vendors change terms often enough that I price the five layers above instead. What separates a good OSINT API from a bad one is not the field count. It is four things: where the data comes from (first-party collection versus a licensed feed), how fresh it is (a certificate index updated hourly versus a WHOIS snapshot from 2023), what the rate limit is (a rate limit is a price in disguise), and whether the license lets you use the results in the way your work requires (attribution requirements on free data, commercial-use restrictions, redistribution bans). The GSC cluster behind this post is a good tell. The queries are "OSINT API" and "IP intelligence" shaped, not "password dump" shaped. That matches how the work actually goes: an analyst triaging signups wants one enrich call; a fraud team wants a screening endpoint; a journalist wants to pivot from a domain to an operator. The vendors below are ordered the same way. One framing note, since this topic attracts the wrong crowd: everything here is about lawful OSINT. Fraud teams checking a signup IP, security researchers mapping exposed infrastructure, reporters verifying a scam operation. The tools are public-records plumbing. Using them to stalk a person is not OSINT, it is just abuse with a better name, and it violates the terms of most of these APIs anyway. ## APIs for OSINT Three workflows cover most real usage. Each one has a cost floor, and the floor is lower than most teams think because caching does more work than vendor selection. ### Workflow 1: enrich an IP A signup hits your form with IP 203.0.113.45. You want to know: where, whose network, and is it a VPN. The field sequence that matters: country and city first (fraud rules are regional), then ASN and network type (a signup from a hosting provider is a different signal than one from a mobile carrier), then privacy flags. Skip the sequence and you will over-block: VPN detection without ASN context flags every corporate egress proxy as hostile. Costs at three volumes, using the cheapest production-honest option per vendor: - At 10,000 lookups/month: MaxMind City Plus is $0.30/1k, or $3. IPinfo Core is $26 flat and covers you to 150k, so it wins from 87,000 lookups onward. - At 100,000/month: IPinfo Core $26, MaxMind City Plus $30, MaxMind Insights $200, ipapi.co $25 (the 150k tier), ip-api Pro about $15 flat. - At 1,000,000/month: ipapi.co drops to $49/mo (the 500k plan) or $99 (2M), which is $0.0495/1k at the 2M tier. IPinfo Core still covers the 150k-5M band at $26 plus $0.34/1k overages past your band. MaxMind Insights is $2,000. Cache. An IP-to-city lookup does not change within a day for most networks, so a day-length cache keyed on IP is safe for geo and ASN, and it routinely cuts billed lookups by half or more on consumer traffic, where the same egress IPs recur. MaxMind's web services bill every query, cached or not, which is exactly why they also sell downloadable databases as flat-fee subscriptions. The privacy flags are the expensive part. IPinfo puts VPN, proxy, Tor, and relay detection in paid plans (Max at $163/mo carries the fullest set). MaxMind's proxy detection is in Insights at $2.00/1k, ten times the City Plus rate. If you flag only the suspicious slice of traffic instead of every lookup, you pay Insights rates on 1 to 5 percent of volume and City rates on the rest. That one routing decision is the difference between a $30 and a $200 monthly line item. ### Workflow 2: pivot a domain You have a domain from a phishing report: `example-scam-domain.com`. The pivot chain: 1. **Current WHOIS.** WhoisXML API gives you registration data, registrar, and dates; the first 500 queries are free. Redacted privacy services are normal now, which is why the next steps exist. 2. **Historical WHOIS.** WhoisXML's history API keeps pre-privacy records, which is how investigators recover operators who registered openly years ago. Their own customer quotes describe exactly this workflow for scam investigations. 3. **Subdomains and passive DNS.** SecurityTrails' free account covers 50 queries a month, enough for one investigation, not for a pipeline. Passive DNS shows what else ever resolved to the same IP. 4. **Certificates.** Censys's certificate index is the strongest free-ish pivot: a certificate for one host links to every other host on the same infrastructure. Free account for basic visibility, credit packages from $100 when you need depth. 5. **Infrastructure neighbors.** Shodan on the IP shows what else runs there; org and netblock queries show what else the operator owns. 6. **The fresh web.** None of the above tells you what the site says today, what a newspaper wrote about the operator last week, or what the scam page currently promises. That is a live search and extraction problem: Keiro's /search/content (3 credits) returns the page content behind search results, and /answer (5 credits) returns a cited brief. The chain costs almost nothing until the last step. A full pivot inside the free tiers of WhoisXML, SecurityTrails, and Censys costs $0 and maybe an hour. The Keiro steps bill 3 to 5 credits: on the free tier's 1,250 monthly credits, that is roughly 250 content pulls or 250 answers a month, no card required. ### Workflow 3: a fraud-screen endpoint The thing teams actually build is an endpoint that takes a signup and returns allow, review, or block. The design that survives contact with production: ```python def screen(signup_ip, email_domain): # day-cached, so repeat signups from one office cost one lookup ip = enrich(signup_ip) # IPinfo Core or MaxMind City Plus if ip.is_datacenter and ip.geo.country not in ALLOWED: return "review" flags = privacy(ip) # IPinfo Max or MaxMind Insights if flags.vpn or flags.tor or flags.proxy: return "review" # deep check only for the flagged slice, not every signup rep = keiro_search_content( f'"{email_domain}" scam OR fraud OR complaints') return "block" if rep.hits_risk >= 3 else "allow" ``` The latency budget forces the architecture. IPinfo quotes 50 to 200 ms average; ip-api's Pro stays under 100 ms in the US, Europe, and most of Asia; Keiro's search is a web-index round trip, so it belongs behind a queue, not in the request path. Screen synchronously on IP signals, escalate flagged traffic to web checks asynchronously. Cost per 1,000 signups, uncached, with the web check only on the 5 percent that the IP layer flags: | Component | Rate | Per 1,000 signups | |---|---|---| | IP geo and ASN (IPinfo Core, cached) | $26/mo flat | about $0.26 | | Privacy flags on the flagged slice (MaxMind Insights) | $2.00/1k | $0.10 (5% of volume) | | Web reputation check on flags (Keiro /search/content, Essential) | 3 credits, $7.20/1k | $0.36 (5% of volume) | | Total | | about $0.72/1k | Cache the IP layer and the total drops under half a cent per signup. The expensive part was never the data; it was calling the expensive API on everyone instead of on the flagged slice. ## OSINT APIs The full field, one row per layer, entry self-serve prices: | Provider | Layer | What it exposes | Entry paid price | Free tier | |---|---|---|---|---| | IPinfo | IP intel | Geo, ASN, company, carrier, VPN/proxy/Tor flags | $26/mo (Core) | Lite: unlimited, country level | | MaxMind | IP intel | Geo, ISP, proxy detection, confidence factors | $0.30/1k (City Plus) | GeoLite2 database | | ip-api | IP intel | Geo, ASN, ISP, currency | EUR 13.30/mo (Pro, annual) | 45 req/min, HTTP, non-commercial | | ipapi.co | IP intel | Geo, timezone, currency, network | $15/mo for 60k | 1,000/day (evaluation) | | Shodan | Device search | Banners, ports, services, vulns, certs | $69/mo (Freelancer) | 100 query credits/mo | | Censys | Devices + certs | Hosts, services, certificate graph | Credits from $100 | Free basic account | | SecurityTrails | Domain/DNS | Passive DNS, subdomains, WHOIS history | Quoted by volume | 50 queries/mo | | Hunter.io | Email | Domain email discovery, verification | $49/mo (2,000 credits) | 50 credits/mo | | WhoisXML API | Domains | WHOIS, historical WHOIS, DNS, IP, subdomains | Package pricing | 500 free queries | | Keirolabs | Web search/extract | Live search, page markdown, cited answers | $30/mo (Essential) | 1,250 credits/mo | And the fine print, which is where these pages usually get you: | Provider | Published rate | The catch | Source | |---|---|---|---| | IPinfo | Core $26/mo, Max $163/mo | Lite is country-only; city, company, and privacy flags are paid. Downloadable databases are not in self-serve plans and start at $1,000/mo. Overages: $0.34/1k on Core, $1.30/1k on Max | [ipinfo.io/pricing](https://ipinfo.io/pricing) | | MaxMind | Country $0.0001, City Plus $0.0003, Insights $0.002 per query | Every query bills, cached or not. Proxy detection only in Insights ($2/1k). GeoLite2 requires attribution and is less accurate than Precision | [maxmind.com](https://www.maxmind.com/en/geoip2-precision-services) | | ip-api | Free: 45 req/min | No HTTPS on free, so tokens ride in cleartext. No commercial use. Pro (EUR 13.30/mo annual) unlocks SSL, unlimited, commercial | [ip-api.com](https://ip-api.com/) | | ipapi.co | $15/mo for 60,000 lookups | Free plan is explicitly not for production. Repeat queries of the same IP count as separate lookups | [ipapi.co/pricing](https://www.ipapi.co/pricing/) | | Shodan | $49 one-time membership; $69-$1,099/mo plans | 1 request/second on every plan, including Corporate. The vuln filter needs Small Business or higher; the tag filter needs Corporate | [account.shodan.io](https://account.shodan.io/billing) | | Censys | Credit packages from $100 | No self-serve monthly tier with published limits; queries, exports, and collections all consume credits | [censys.com/pricing](https://censys.com/pricing/) | | SecurityTrails | Quoted by volume | Free account: 50 queries/month. No public price list for the commercial API | [securitytrails.com](https://securitytrails.com/corp/pricing) | | Hunter.io | $49/mo for 2,000 credits | 1 credit per email found, 0.5 per verification. Annual billing is the same plans at 30% off ($34/$104/$209) | [hunter.io/pricing](https://hunter.io/pricing) | | WhoisXML API | Packages: one-time, monthly, yearly | 500 free queries to start; each product is a separate API with its own balance | [whois.whoisxmlapi.com](https://whois.whoisxmlapi.com/pricing) | | Keirolabs | /search/lite 0.1 credit on plans; /search/fast 1 credit | One-time packs bill lite at 0.5 credit ($2.50-$3.33/1k), so monthly plans are the cheap path. It is a search API, not an IP database | [keirolabs.cloud/pricing](https://keirolabs.cloud/pricing) | Three patterns worth noticing. First, the billing unit is never the thing you asked for: IP vendors bill per query, device searchers bill per credit, email tools bill per result found, and Keiro bills per credit where a credit is one search but a third of a content pull. Read the unit before the price. Second, free tiers are evaluation-grade everywhere: ip-api's 45/min and no-HTTPS, Shodan's 100 credits, SecurityTrails' 50 queries, Censys's basic ports. They are built so you can prove the pipeline works, then pay. Third, the vendors with public per-unit pricing (MaxMind, ipapi.co, Hunter, Keiro) and the vendors with "contact sales" (SecurityTrails, Censys at scale, IPinfo databases) are selling to different buyers, and the quote-only ones are usually more negotiable than their entry price suggests. > An OSINT stack is three APIs and a cache: one for networks, one for registrations, one for the open web. Price each against its own volume, because no vendor sells the other two. ## Best IP Intelligence Tools for High-Volume Production Applications The truncated GSC query in this post's cluster asks exactly this, so here is the direct answer for the layer where volume is highest. Production IP intelligence means four properties at once: an SLA, HTTPS, no attribution requirement, and a price curve that does not double when you grow 10x. **IPinfo** ([pricing](https://ipinfo.io/pricing)). The widest field set: geo, ASN, company, carrier, hosted domains, and a privacy-detection family (VPN, proxy, Tor, relay). The API quotes 50 to 200 ms responses, 99.99% uptime, and up to 100,000 queries per second; the company says it processed over 1.95 trillion API requests in the past year. Lite is $0 with unlimited requests, but it returns country and continent only, plus ASN name and domain. Core is $26/mo (150k to 5M monthly requests by plan band, $0.34 per +1k overage), Max is $163/mo (250k to 5M, $1.30 per +1k), Enterprise is custom. Downloadable databases are not in self-serve plans and start at $1,000/month. Pros: the privacy flags are the product, and no other vendor in this list matches the field depth; throughput numbers are production-grade; the free Lite tier is genuinely unlimited. Cons: the jump from free to useful is the steepest here ($0 to $26 buys country-plus-ASN, not city-with-confidence); database licensing starts at $1,000/month, which pushes high-volume buyers toward Enterprise quotes. **MaxMind** ([pricing](https://www.maxmind.com/en/geoip2-precision-services)). The oldest name in the space and still the reference dataset. GeoLite2 is the free, attribution-required database. The Precision web services bill per query: Country $0.0001, City Plus $0.0003, Insights $0.002, pay as you go with no plan to negotiate. Insights adds proxy detection, confidence factors, user count and type, static IP score, and demographic data. Pros: per-query pricing means no monthly commitment and no overage cliffs; the confidence scores are the honest touch, because every geo vendor is wrong sometimes and MaxMind is the only one here that sells you its error bars; GeoLite2 makes prototyping free. Cons: per-query billing punishes uncached loops; the fields that matter for fraud (proxy, confidence) only exist in Insights at $2.00/1k, six times the City rate; no privacy flags below Insights. **ip-api** ([site](https://ip-api.com/), [pro](https://members.ip-api.com/)). The free endpoint is the internet's default dev geolocation API: no key, 45 requests per minute from one IP, HTTP only, non-commercial only. Pro is EUR 13.30 per month billed annually and unlocks HTTPS, unlimited queries, commercial use, API keys, and a 99.9% SLA that auto-extends your subscription 10 days if they miss it. Anycast and GeoDNS behind it; sub-100 ms response times in the US, Europe, and most of Asia. Pros: unlimited queries for the price of two coffees is the best flat rate in IP data; no auto-renew billing, you stop paying by not renewing; the free tier needs no key, which makes it the fastest onboarding in this post. Cons: the field set is thinner than IPinfo's (geo, ASN, ISP, and hosting flags on some endpoints), and there is no published dollar price, only euros. **ipapi.co** ([pricing](https://www.ipapi.co/pricing/)). Straight lookup-count subscriptions: free 1,000/day (about 30,000/month), then $15/mo for 60,000, $25 for 150k, $49 for 500k, $99 for 2M, $199 for 6M, $399 for 15M, with annual billing around 20% lower ($12/mo for the 60k tier). Their own FAQ is refreshingly blunt that the free plan is for trial and evaluation, not production, and that heuristics may restrict free calls. Pros: clean per-volume ladder with no contact-sales wall up to 15M lookups; timezone and currency fields come standard; SSL from the first paid tier. Cons: at the 60k tier it is $0.25/1k, which is fine, but the same unlimited-query flat rate on ip-api Pro costs about a euro more; the free tier's heuristic restrictions mean your dev environment can behave differently from production. Cost per 1,000 lookups at 100,000 lookups/month, self-serve rates, US dollars: IP LOOKUPS, $/1K AT 100K PER MONTH, SEPT 2026 ip-api Pro ~$0.15 ipapi.co $0.25 IPinfo Core $0.26 MaxMind City+ $0.30 IPinfo Max $1.63 MaxMind Insights $2.00 (ip-api Pro, IPinfo Core, IPinfo Max and ipapi.co are flat monthly plan rates spread over 100,000 lookups; MaxMind rows are per-query rates. All figures are the vendors' published self-serve rates.) The high-volume production answer, ranked: ip-api Pro if its field set covers you and you want a flat bill; IPinfo Core if you need company, carrier, or ASN context; MaxMind City Plus if you want per-query pricing with no subscription to babysit; and keep Insights on a separate code path for the flagged slice only. One more production note: the per-unit entry rates of all four vendors land within about $0.15 of each other, the $26 IPinfo plan already includes its volume, and the real differentiator at scale is the SLA and the shape of the free tier, not the sticker. ## New Geolocation OSINT APIs Released in 2026 The query assumes 2026 shipped a wave of new tools. What actually shipped is a wave of new pricing pages, and knowing the difference will save you money. The IP layer repriced. IPinfo's current lineup (Lite free, Core $26, Max $163) is built around an unlimited free tier that pushes everyone to evaluate on real traffic before paying, with the paid walls around data depth rather than request counts. MaxMind's Precision services settled into clean per-query pricing ($0.0001/$0.0003/$0.002) that rewards teams who cache and punishes teams who do not. ipapi.co's ladder now runs to 15M lookups at $399/mo, about $0.027/1k, which would have been an enterprise quote three years ago. The device layer restructured. Shodan's current lineup pairs a $49 one-time membership (a lifetime upgrade) with monthly tiers at $69, $359, and $1,099, and keeps 1 request per second on every plan including the top one. Censys moved to a credits model with packages from $100, where queries, exports, and collections all draw on the same balance. The genuinely new infrastructure in this market is the search and extraction layer. Keirolabs runs its own index (an index, not a scraper) and sells the OSINT pivot layer per credit, which is why it shows up in this cluster at all: /search/lite at 0.1 credit on plans is $0.24/1k on Essential and $0.08/1k on Startup, with 1,250 free credits a month. Most "new OSINT APIs" marketed in 2026 are not new data; they are LLM-flavored wrappers over IPinfo, MaxMind, or Shodan feeds. Check the attribution strings and the data-source page before paying a wrapper premium for someone else's database. Freshness beats feature count in this category. A 2026 launch with yesterday's WHOIS snapshot is worse than a 2012 API with an hourly cert feed, and the vendors that publish collection dates (Shodan banners, Censys certs, MaxMind database build dates) are the ones worth trusting with an investigation. ## OSINT Search API "OSINT search" means two different products, and both matter. The first is device and infrastructure search: Shodan's query language over internet-wide banners, Censys's over hosts and certificates. These are search APIs in the literal sense, with query syntax (`product:nginx`, `services.tls.certificates.leaf_data.subject_dn:*`) and result limits that price by page and credit. Shodan gives free accounts 100 query credits a month and 20 search pages; Censys gives a free account with basic visibility and sells credits from $100. They answer "what is running where" with precision nothing else matches. The second is the open-web layer, and it is the one the device engines cannot do. When you need what a scam page currently says, what reporting exists on an operator, or whether a "company" has a web presence older than the domain, you need live web search with page content. That is Keiro's layer, and here are its real numbers from [our pricing](https://keirolabs.cloud/pricing): /search/lite bills 0.1 credit per request on monthly plans, which is $0.24 per 1,000 on Essential ($30/mo), $0.13 per 1,000 on Pro ($50/mo), and $0.08 per 1,000 on Startup ($100/mo); the published headline rate is $0.25/1k. /search/fast is 1 credit. /search/content and /extract are 3 credits ($7.20/1k on Essential, $2.40/1k on Startup): search plus the markdown behind the results, which is what you want when the snippet is not enough. /answer is 5 credits for a synthesized answer with citations, useful for the "summarize what is known about this operator" step. Deep research (/agentic) is 20 credits for multi-step reports. Free tier: 1,250 credits a month, no card, 30 req/min; Pro raises the rate limit to 300, Startup to 1,000. A worked pivot that shows the difference. You have an IP from a phishing email header. Shodan tells you what runs on it. Censys tells you what certificates it has served. Neither will tell you that the same operator registered a fresh domain last week and that a regional news outlet profiled their operation in July. The web layer finds the reporting, pulls the current scam-page copy for your takedown request, and cites everything. On Keiro that pivot is one /search/content call (3 credits) and one /answer call (5 credits), which on the free tier is 156 investigations' worth of both steps, every month, forever. The honest limitation: a web search API has no WHOIS history, no passive DNS, and no banner database. It complements the infrastructure layer; it does not replace it. Teams that try to replace Shodan with a web search API end up paying for searches that a $49 one-time membership would have answered better. ## OSINT API Free Free tiers, ranked by what you can actually do with them: | Tool | Free tier | The catch | |---|---|---| | ip-api | 45 req/min, no key | HTTP only, non-commercial only | | IPinfo Lite | Unlimited requests, country + ASN name | No city, no company, no privacy flags | | MaxMind GeoLite2 | Free database download | Attribution required, lower accuracy than Precision | | Keirolabs | 1,250 credits/mo = 12,500 lite searches, no card | 30 req/min; it is a search API, not IP data | | Shodan | 100 query credits + 100 scan credits/mo, 16 monitored IPs | 1 req/sec; no vuln filter | | WhoisXML API | 500 free queries to start | Per-product balances; packages after | | Hunter.io | 50 credits/mo | 1 credit per email found | | Censys | Free basic account | Standard ports only; depth costs credits | | SecurityTrails | 50 queries/mo | Subset of data | | ipapi.co | 1,000 lookups/day (about 30k/mo) | Evaluation only, per their own FAQ | The best zero-dollar stack for a side project is ip-api (geo over HTTP), MaxMind GeoLite2 (offline lookups), Shodan free (infrastructure), WhoisXML's 500 queries (WHOIS), and Keiro's 1,250 credits (the web pivot layer). That covers all six layers for $0, with rate limits as the only tax. Attribution is the other tax on free data: GeoLite2 requires visible attribution, and IPinfo's Lite terms do too, which matters if you are embedding results in a product rather than an internal investigation. A free tier is an evaluation license with a rate limit attached. The moment your investigation becomes a pipeline, the pipeline's volume outruns the free tier, and the pricing table above decides your bill. ## On-Demand OSINT Access "On-demand" is a pricing model question: do you pay per query, per month, or per pack? Per query (MaxMind, pay-as-you-go credits) is the honest model for spiky workloads: an investigation sprint costs exactly what it uses, and idle months cost $0. The risk is that uncached code burns money silently; MaxMind bills every query, cached or not. Per month (IPinfo, ipapi.co, Shodan, Hunter, Keiro plans) is the model for steady pipelines. The trap is the plan band: IPinfo Core's $26 covers a 150k-5M band, so at 60k/month you are paying for headroom you do not use, while at 400k/month it is the cheapest option in the table. Per pack (Keiro one-time packs, WhoisXML packages) fits project work with a known end. Keiro's packs run $10 for 1,500 credits, $30 for 5,000, $100 for 20,000, and expire in 6 months; on packs, lite search bills at 0.5 credit instead of the plan rate of 0.1, so a pack is the right buy for a sprint and the wrong buy for an always-on pipeline. WhoisXML's one-time packages follow the same logic per product. Rate limits are the other half of on-demand. Shodan caps every plan, including $1,099/mo Corporate, at 1 request per second, which means a 10,000-IP sweep takes almost three hours no matter what you pay. IPinfo allows up to 100,000 queries per second. Keiro's plans scale from 30 req/min (free) to 1,000 req/min (Startup). Match the limit to your workload shape: investigations are bursty and human-paced, fraud pipelines are machine-paced, and the wrong match shows up as 429s at the worst moment. SLAs differ by an order of magnitude: ip-api commits to 99.9% monthly uptime on Pro (and extends your subscription 10 days if they miss it), IPinfo publishes 99.99%. If your fraud screen blocks signups on an API response, the SLA is not a detail. ## The picks **Fraud screening at signup:** IPinfo Core ($26/mo) behind a day-long cache for the always-on path, MaxMind Insights ($2/1k) only for flagged traffic, and a Keiro /search/content check (3 credits) queued behind the flag. About $0.72 per 1,000 signups uncached, under half that cached. **High-volume IP production:** ip-api Pro at EUR 13.30/mo if its fields cover you, IPinfo Core at $26 if you need company and ASN depth, ipapi.co at $99/2M if you want pure per-lookup pricing. All three hold under a dollar per 1,000 at 100k/month. **Device and exposure investigations:** Shodan, and the $49 one-time membership remains the best $49 in OSINT. Escalate to Small Business ($359/mo) when you need the vuln filter or the streaming feeds. **Certificate pivots and infrastructure mapping:** Censys. The certificate index is the strongest domain-to-infrastructure pivot in OSINT, and the credits model means a small investigation costs a few dollars, not a monthly minimum. **Domain and WHOIS history:** WhoisXML API for the historical WHOIS depth (the pre-privacy records), SecurityTrails for passive DNS and subdomain enumeration, starting from their 500 and 50 free queries respectively. **People and inbox pivots:** Hunter.io at $49/mo for 2,000 credits, 1 credit per email found and nothing charged when the search fails. The 30% annual discount makes it $34/mo effective if the workload is steady. **The open-web pivot layer:** Keiro, and I will make the case with our own numbers since we sell it. /search/lite at 0.1 credit on plans is $0.24/1k on Essential and $0.08/1k on Startup; /search/content (3 credits) and /answer (5 credits) cover the pull-the-page and summarize-with-citations steps of an investigation; the free tier is 1,250 credits a month with no card, which is 12,500 lite searches. One honest catch: one-time packs bill lite at 0.5 credit, so if you buy a pack instead of a plan, you are paying $2.50 to $3.33 per 1,000. Monthly plans are the cheap path. Keiro is not an IP database or a WHOIS archive, and this post does not pretend otherwise; it is the layer that turns infrastructure findings into readable, citable reporting. **Journalists and solo investigators:** the free stack in the section above, plus Keiro's free tier for the web steps. Total: $0/month, all six layers, rate-limited but real. ## The boring takeaway Pick by layer, then by volume. Signup fraud: IPinfo Core or MaxMind City Plus cached, Insights for the flagged slice. Infrastructure: Shodan's $49 membership until you outgrow 1 request per second. Domain history: WhoisXML and SecurityTrails. Email pivots: Hunter. Everything that lives on a fresh page: a search and extraction API, where Keiro's plan pricing runs $0.08 to $0.24 per 1,000 lite results and the free tier renews monthly with no card. Free tiers are for proving the pipeline; production wants an SLA, HTTPS, and a license that matches your use. Cache what the records let you cache, escalate the expensive lookups to the flagged slice only, and re-check every number above before you sign anything, including ours. Every price in this post was taken from the vendor's own pricing page and checked on September 23, 2026; this market reprices quarterly, and the free tier you rely on today is the line item someone's CFO finds next quarter.