Open-Source Intelligence (OSINT)
Nearly every subject leaves a public footprint — usernames, breached emails, domains, and social connections. OSINT is the discipline of finding it, verifying it, and citing it defensibly.
What is OSINT?
Open-Source Intelligence is the practice of collecting and analyzing publicly available information — social media, breach data, domain registrations, and archived web content — to answer a specific investigative question. Unlike device forensics, OSINT never requires seizing anything; it works entirely from what's already public.
Because OSINT sources can be edited or deleted at any moment, the discipline places unusual emphasis on contemporaneous documentation: archiving evidence the instant it's found, not after the investigation concludes.
Collect
Usernames, emails, domains, and social profiles from public sources.
Correlate
Link entities together with graph-based analysis to surface relationships.
Cite
Archive and timestamp every finding to keep it defensible later.
Step-by-Step Methodology
The sequence a careful examiner follows, in order.
- 1
Define direction
Write down the specific investigative question before collecting anything — OSINT without a defined scope becomes an unfocused, unbounded search.
- 2
Enumerate usernames and emails
Use Sherlock or WhatsMyName to check a known username across hundreds of platforms, and validate associated emails against breach databases like Have I Been Pwned.
- 3
Reconnaissance domains & infrastructure
Run WHOIS, DNS enumeration, and subdomain discovery against any associated domains, and query Shodan/Censys for exposed services on resolved IPs.
- 4
Investigate social media
Systematically review public posts, connections, and metadata across platforms, cross-referencing timestamps and locations against other collected data points.
- 5
Geolocate and verify media
Use reverse image search and visual analysis (shadows, signage, terrain) to independently verify claimed locations in photos, cross-referencing against satellite imagery.
- 6
Map relationships with link analysis
Feed collected entities into Maltego to visually surface connections between people, domains, emails, and infrastructure that aren't obvious from any single source.
- 7
Archive and document every finding
Capture the source URL, access timestamp, and a full archived snapshot (Wayback Machine or local capture with hash) for every piece of evidence at the moment it's found.
Tools Comparison
Sortable — click any column header.
Commands & Code
Copy-ready snippets used in real workflows.
# Search a username across 400+ platforms
python3 sherlock.py target_username --timeout 10 --print-found
# Export results to a case file
python3 sherlock.py target_username --output ./case_osint/username_results.txt# Find indexed PDFs on a specific domain
site:example.com filetype:pdf
# Find a name mentioned alongside a company on LinkedIn
site:linkedin.com intitle:"Jane Doe" "Acme Corp"
# Exclude a term while searching a phrase
"acme corp data breach" -press-release
# Search across two possible domain variants
site:example.com OR site:example.org "internal use only"# Gather emails and subdomains for a target domain from public sources
theHarvester -d example.com -b google,bing,crtsh -l 200 -f case_osint/example_recon.htmlLegal & Ethical Considerations
- OSINT must stay within publicly accessible information — bypassing a login wall or paywall crosses into unauthorized access, not OSINT.
- Sock puppet accounts require organizational policy sign-off; interacting with a subject (friending, messaging) can constitute entrapment or witness tampering in some contexts.
- Dark web research carries elevated legal and personal-safety risk — passive observation only, and never transact or actively participate.
- Document sourcing for every finding; unsourced or unverifiable OSINT claims carry little evidentiary weight and can undermine an otherwise strong case.
Common Mistakes
- Treating a username match across platforms as proof of a single identity without corroborating evidence — usernames can be coincidental or deliberately impersonated.
- Failing to archive content before it's taken down; social media and fraudulent sites can disappear within hours of being reported.
- Conducting research from a personally identifiable account or browser profile, exposing the investigator or tipping off the subject.
- Over-relying on a single reverse-image-search engine — cross-checking multiple engines (Google, TinEye, PimEyes) catches matches others miss.