Who registered a domain name, and when.
In real life: whois, ICANN Lookup

Old versions of a website's pages.
In real life: Wayback Machine

Public logs of HTTPS certificates: they reveal subdomains.
In real life: crt.sh

On which Lab platforms does a username exist?
In real life: WhatsMyName, Sherlock

Camera, date and GPS position hidden in a photo (EXIF).
In real life: exiftool, Jeffrey's Image Metadata Viewer

Officers, filed documents and links between companies.
In real life: Annuaire des entreprises, Pappers, OpenCorporates

A domain's records: mail, verifications, subdomains.
In real life: dig, DNSDumpster, SecurityTrails

Base64, hexadecimal, binary, ROT13, Caesar, Vigenère.
In real life: CyberChef, dCode

A message hidden in an image's pixels (LSB).
In real life: zsteg, StegOnline, Aperi'Solve

What a sound hides in its frequencies.
In real life: Audacity, Sonic Visualiser

All the readable text hidden in a file.
In real life: strings, binwalk

Has an address or a username leaked?
In real life: Have I Been Pwned, DeHashed

Watermarks hidden in a text (zero-width spaces).
In real life: dCode, hex editor

City and provider of an IP address.
In real life: ipinfo.io, IP whois

A plane's flight history from its registration.
In real life: Flightradar24, FlightAware

Follow the money on a blockchain.
In real life: mempool.space, Blockchair

The websites that share the same analytics identifier.
In real life: DNSlytics, SpyOnWeb, BuiltWith

MD5, SHA-1 and SHA-256 of a list of texts.
In real life: CyberChef, md5sum

Where does an image appear, even cropped?
In real life: Google Lens, TinEye, Yandex Images

Location of a Wi-Fi access point from its name or MAC address.
In real life: WiGLE

Sun position and cast shadows: date a photo.
In real life: SunCalc, PeakVisor