OSINT Guide 2026: find anything online.

A hands-on guide to Open-Source Intelligence — from search engine mastery to dark web investigation. Every tool verified and working. Every technique step-by-step.

Foundations

What OSINT is, how to set up your lab safely, and how to think like an investigator

What is OSINT?

Open-Source Intelligence is the practice of collecting, analyzing, and acting on information gathered from publicly available sources. It's used by cybersecurity professionals, journalists, law enforcement, researchers, private investigators, and everyday people who want to understand their own digital footprint.

  • OSINT uses ONLY publicly accessible data — no hacking, no unauthorized access
  • Sources include: social media, public records, DNS/WHOIS, court filings, satellite imagery, breach databases, archived web pages, certificate transparency logs
  • The OSINT cycle: Requirements → Collection → Processing → Analysis → Reporting
  • Legal & ethical boundaries matter — just because data is public doesn't mean every use is ethical

Setting Up a Secure OSINT Lab

Before investigating anything, you need an isolated environment that protects your real identity. Never conduct OSINT investigations from your personal browser or accounts.

  1. Install a hypervisor: VirtualBox (free) or VMware Workstation
  2. Download Kali Linux (kali.org/get-kali) — comes pre-loaded with most OSINT tools
  3. Create sock puppet accounts on platforms you'll investigate — use a burner email (ProtonMail), never your real phone number, never your real name
  4. Install Tor Browser for anonymous browsing: torbrowser-launcher
  5. Set up a VPN as a baseline (Mullvad or ProtonVPN recommended for privacy)
  6. Configure browser isolation: use separate Firefox profiles for each investigation

Warning: NEVER mix personal and investigation accounts. The #1 OPSEC failure is cross-contamination — same password, same phone number, or logging into personal accounts from your investigation VM.

Essential Browser Extensions

  1. Wappalyzer — identifies website technology stacks
  2. InVID/WeVerify — video and image verification toolkit
  3. SingleFile — saves complete web pages as evidence
  4. User-Agent Switcher — change browser fingerprint
  5. uBlock Origin — blocks tracking scripts during research

Tip: Install these in your investigation browser profile only. Keep your personal browser clean.

Social Media Intelligence

Investigating X/Twitter, Instagram, LinkedIn, and Facebook without alerting the target

X / Twitter Investigation

X (formerly Twitter) remains one of the richest OSINT sources. Most scraping tools are dead in 2026 — here's what actually works.

  1. X Advanced Search (works 100%, no tools needed): Visit x.com/search-advanced with your sock puppet account
  2. Powerful search operators: from:target_handle since:2024-01-01 until:2024-12-31 from:target_handle filter:media from:target_handle filter:links to:target_handle — replies TO them @target_handle -from:target_handle — mentions by others
  3. Browser DevTools trick: open F12 → Network tab while scrolling through search results. The JSON responses contain structured data you can export and analyze
  4. twscrape (authenticated scraping for advanced users): pip3 install twscrape Requires valid X accounts with session cookies — breaks periodically but is the best programmatic option
  5. Analyze posting times to determine timezone and daily routine patterns

Warning: Twint, snscrape, and Nitter are non-functional in 2026. X blocked guest tokens and hardened its API. Don't waste time on these.

Instagram Investigation

  1. Instaloader (actively maintained): pip3 install instaloader instaloader --login your_sockpuppet target_profile Downloads: posts, captions, comments, tagged locations, profile pic, stories
  2. Epieos for quick account discovery: Visit epieos.com → enter target's email → checks 140+ services including Instagram
  3. Manual browser approach: View Page Source on any public profile → search for "biography", "follower_count" in the embedded JSON

LinkedIn & Facebook Investigation

  1. LinkedIn: use Google dorking instead of LinkedIn's search (which filters results): site:linkedin.com/in "Firstname Lastname" "Company"
  2. CrossLinked — enumerate employee names from LinkedIn via search engines: pip3 install crosslinked crosslinked -f "{first}.{last}@company.com" "Company Name"
  3. Facebook: use the Graph Search remnants via URL manipulation: https://www.facebook.com/search/posts/?q=keyword https://www.facebook.com/search/people/?q=name
  4. Facebook ID lookup: enter a profile URL at lookup-id.com to get the numeric ID, then use it for deeper searches

Image Metadata from Social Media

Every platform strips metadata differently. Knowing what survives upload is critical for investigations.

Tip: Telegram preserves original file metadata unless the sender explicitly compresses. Always check Telegram-forwarded images — they're a goldmine.

Platform GPS Data Camera Model Timestamp Software
X / Twitter Stripped Stripped Stripped Stripped
Instagram Stripped Partial Stripped Stripped
LinkedIn Stripped Stripped Stripped Stripped
Facebook Stripped Partial Partial Stripped
Telegram PRESERVED PRESERVED PRESERVED PRESERVED

Email & Username Intelligence

From one email address or username, map an entire digital identity

Email Account Enumeration

Given an email address, determine which platforms have accounts registered with it — without alerting the target.

  1. user-scanner (modern replacement for Holehe — combines email + username scanning): pip3 install user-scanner user-scanner -e "[email protected]" -v
  2. Bulk scanning: user-scanner -ef emails.txt -o results.json
  3. Epieos (web-based, free tier, 140+ services): Visit epieos.com → enter email → get linked accounts, Google ID, Skype
  4. GHunt — deep Google account OSINT (if target uses Gmail): pip3 install ghunt ghunt login # one-time browser auth ghunt email [email protected]
  5. GHunt extracts: Google Maps reviews (with GPS locations!), Photos albums, YouTube channels, Calendar events, profile pictures, last edit dates
  6. Gravatar check: echo -n "[email protected]" | md5sum Visit gravatar.com/avatar/<md5hash>

Tip: GHunt's Google Maps review data is incredibly powerful. A target's review history can reveal home location, workplace, travel patterns, and daily routines — all from a Gmail address.

Username Footprint Tracing

A single username can unlock accounts across hundreds of platforms. Most people reuse usernames.

  1. user-scanner (handles both email and username): user-scanner -u "target_username" -v
  2. Maigret — deep search across 3000+ sites with HTML report: pip3 install maigret maigret target_username --all-sites --reports-type html
  3. WhatsMyName (web-based verification): Visit whatsmyname.app → enter username → compare with tool results
  4. Google with quotes for results tools miss: "target_username" "target_username" site:github.com "target_username" site:reddit.com "target_username" site:medium.com
  5. For each confirmed platform: document creation date, profile photo, bio, linked accounts, connections

Identifying Disposable & Fake Emails

When investigating phishing campaigns or fraud, you need to quickly classify email addresses.

  1. Check against disposable domain list: git clone https://github.com/disposable-email-domains/disposable-email-domains.git grep -i "mailinator.com" disposable-email-domains/disposable_email_blocklist.conf
  2. Email reputation check: curl -s https://emailrep.io/[email protected] | python3 -m json.tool
  3. MX record analysis (disposable services have distinctive patterns): dig MX mailinator.com +short dig MX gmail.com +short
  4. Breach exposure: haveibeenpwned.com → search each email
  5. Domain email pattern discovery: Visit phonebook.cz → search domain → all indexed emails, subdomains, URLs
  6. Hunter.io (free tier, 50 searches/mo): verify corporate email naming conventions

Website & Domain Intelligence

WHOIS, DNS, subdomains, technology fingerprinting, and infrastructure mapping

WHOIS & DNS Reconnaissance

Every domain has a registration trail and DNS configuration that reveals infrastructure, ownership, and sometimes the identity of the operator.

  1. WHOIS lookup: whois example.com Document: registrar, registration/expiry dates, nameservers, registrant info
  2. Historical WHOIS: Visit whois.domaintools.com for current + historical records
  3. Reverse WHOIS — find other domains by the same owner: Visit viewdns.info/reversewhois/ → search by email or name
  4. DNS deep dive: dig example.com A +short dig example.com MX +short dig example.com TXT +short dig example.com NS +short
  5. Email security posture: dig _dmarc.example.com TXT +short dig default._domainkey.example.com TXT +short
  6. Visual DNS mapping: Visit dnsdumpster.com → enter domain → download network map
  7. Historical DNS records: Visit securitytrails.com (free account) → view IP changes over time
  8. Instant domain dump: Visit phonebook.cz → search domain → returns ALL indexed emails, subdomains, URLs

Tip: Phonebook.cz is massively underrated — faster than theHarvester for initial domain recon and often returns more results.

Subdomain Enumeration

Subdomains reveal an organization's hidden attack surface: dev servers, staging environments, internal tools, and forgotten services.

  1. Subfinder (passive, fast): sudo apt install subfinder -y subfinder -d example.com -o subs_subfinder.txt
  2. Amass (comprehensive): sudo apt install amass -y amass enum -passive -d example.com -o subs_amass.txt
  3. Certificate Transparency logs: curl -s "https://crt.sh/?q=%25.example.com&output=json" | python3 -m json.tool | grep name_value | sort -u
  4. theHarvester (built into Kali): theHarvester -d example.com -b all -l 200
  5. Merge & deduplicate: cat subs_subfinder.txt subs_amass.txt | sort -u > all_subs.txt
  6. Probe which are live: sudo apt install httpx-toolkit -y cat all_subs.txt | httpx -silent -status-code -title > live_subs.txt
  7. Categorize by function: dev, staging, api, mail, vpn, admin, etc.

Technology Fingerprinting

Knowing what software a website runs reveals potential vulnerabilities, and for OSINT, tells you about the organization's technical sophistication.

  1. WhatWeb (CLI, pre-installed on Kali): whatweb example.com -v
  2. Wappalyzer: install as Firefox extension for real-time detection
  3. Manual header analysis: curl -I https://example.com Look for: Server, X-Powered-By, X-Generator, Set-Cookie naming patterns
  4. Source code fingerprinting: curl -s https://example.com | grep -i "generator\|wp-content\|drupal\|react\|next\|angular"
  5. robots.txt and sitemap analysis: curl -s https://example.com/robots.txt curl -s https://example.com/sitemap.xml | head -50
  6. BuiltWith: visit builtwith.com for comprehensive tech profiling
  7. Censys — internet infrastructure search: Visit search.censys.io → search by domain or IP → TLS certs, ports, cloud provider, OS

Tip: Censys is the modern complement to Shodan — it focuses on TLS certificates and cloud assets, invaluable for finding shadow IT in multi-cloud environments.

Dark Web & Breach Intelligence

Tor, dark web search engines, breach databases, infostealer exposure, and crypto tracing

Navigating the Dark Web Safely

The dark web is a small portion of the internet accessible only through special software like Tor. It has legitimate uses (whistleblowing, censorship circumvention) and illegitimate ones. For OSINT, we stay on search engines and public forums.

  1. Install and launch Tor Browser: torbrowser-launcher Or download from torproject.org
  2. Set security to maximum: Shield icon → Safest
  3. Verify your connection: visit check.torproject.org
  4. Understand the circuit: padlock icon → view Guard → Middle → Exit relay path

Warning: NEVER maximize the Tor window (fingerprinting risk). Never install extensions. Never log into personal accounts. Never open downloaded files while connected.

Dark Web Search & Breach Hunting

You don't need to visit illegal marketplaces to get intelligence from the dark web. Several powerful tools index dark web content and make it searchable from the clearnet.

  1. Ahmia (clearnet access to dark web search): Visit ahmia.fi → search for organization names, domains, keywords
  2. IntelX (paste sites, dark web, leaks): Visit intelx.io → search for @yourdomain.com Free tier: limited daily searches but covers a huge range of sources
  3. DeHashed (breach credential search): Visit dehashed.com → search by email, domain, username, IP, phone
  4. Hudson Rock (free infostealer exposure check): Visit cavalier.hudsonrock.com Checks if employees were infected by infostealer malware (RedLine, Raccoon, Vidar)
  5. Clearnet search for dark web reposts: site:pastebin.com "@yourdomain.com" "yourdomain.com" AND ("leaked" OR "dump" OR "breach")

Tip: Hudson Rock's infostealer check is a 2026 game-changer. Infostealer malware dumps browser-saved credentials en masse — this tells you if your organization has been compromised.

Cryptocurrency & Blockchain OSINT

Ransomware payments, fraud proceeds, and darknet market transactions all leave trails on public blockchains.

  1. Bitcoin explorer: Visit blockchain.com/explorer → enter address → trace transaction graph
  2. Arkham Intelligence (modern crypto OSINT, free): Visit platform.arkhamintelligence.com → wallet search → known entity labels, flow analysis
  3. Etherscan for Ethereum: Visit etherscan.io → enter address → transaction history, token transfers
  4. Blockchair — multi-chain explorer: Visit blockchair.com → supports BTC, ETH, and many other chains

Geolocation & Media Verification

Reverse image search, video verification, EXIF analysis, audio geolocation, and satellite imagery

Reverse Image Search

Given a photo, find its source, earlier uploads, different contexts, and sometimes the exact location where it was taken.

  1. Google Images: images.google.com → camera icon → upload image
  2. Yandex Images (BEST for facial recognition & non-English sources): yandex.com/images → camera icon → upload
  3. TinEye (best for finding the EARLIEST upload date): tineye.com → upload → sort by oldest
  4. Always use all three — each indexes different content and has different strengths
  5. Bing Visual Search: bing.com/images → camera icon — occasionally finds things others miss

Tip: Yandex consistently outperforms Google for OSINT reverse image search. Its facial recognition is more aggressive and it indexes Russian/Eastern European sources that Google misses.

Image & Video Metadata Extraction

  1. ExifTool — the gold standard for metadata extraction: sudo apt install exiftool -y exiftool photo.jpg exiftool video.mp4
  2. MediaInfo for detailed video/audio metadata: sudo apt install mediainfo -y mediainfo video.mp4
  3. Key metadata to look for: GPS coordinates, camera make/model, creation timestamp, software used, serial numbers
  4. Extract keyframes from video with ffmpeg: sudo apt install ffmpeg -y ffmpeg -i video.mp4 -vf "fps=1/5" keyframe_%04d.jpg
  5. Extract frame at specific timestamp: ffmpeg -i video.mp4 -ss 00:00:30 -frames:v 1 frame.jpg
  6. Then reverse-search each keyframe on Google/Yandex/TinEye

Video Verification with InVID/WeVerify

The professional standard for verifying social media videos. Used by major news organizations worldwide.

  1. Install: Firefox Add-ons → search "InVID WeVerify" → Install
  2. Open any video on social media → click the extension icon
  3. Keyframes: auto-extracts key frames and reverse-searches them
  4. Magnifier: zoom into details — signs, reflections, shadows, uniforms
  5. Forensic tab: Error Level Analysis (ELA) detects image manipulation, clone detection finds copy-pasted regions

Geolocation Techniques

  1. Shadow analysis: sun position + shadow length = time of day + latitude. Use SunCalc (suncalc.org) to verify
  2. Google Earth Pro (free): match terrain, buildings, road layouts to geolocate photos/videos
  3. OpenStreetMap: cross-reference landmarks, road names, building shapes
  4. Sentinel Hub (sentinel-hub.com): free satellite imagery for verifying locations and timelines
  5. Audio geolocation: extract audio from video, use Audacity spectral analysis to identify background sounds — call to prayer timing, train announcements, bird species, language fragments

People & Identity Investigations

Building complete digital profiles from a single starting point

The Investigation Chain

Real OSINT investigations start with one data point and expand outward. Here's the modern workflow for building a complete digital identity map.

  1. Start with email → Epieos (epieos.com) for linked accounts across 140+ services
  2. If Gmail → GHunt for deep Google intelligence: ghunt email [email protected] Maps reviews, Photos albums, YouTube, Calendar, profile pic
  3. Email enumeration → user-scanner: user-scanner -e "[email protected]" -v
  4. Extract username from email → run username search: user-scanner -u "username" -v maigret username --all-sites --reports-type html
  5. Check code repositories — git commit history often reveals real email addresses: github.com/search?q=username&type=users
  6. Google with context: "Firstname Lastname" "City" site:linkedin.com
  7. Build visual identity map using draw.io or Maltego CE showing all connections and pivot points

Public Records & Corporate Intelligence

Governments and regulatory bodies publish enormous amounts of data that most people never think to search.

  1. OpenCorporates — global company officer search: Visit opencorporates.com → search by company or person name
  2. India: eCourts (ecourts.gov.in) for case search by party name
  3. India: MCA (mca.gov.in) for company/director registration data
  4. India: Indian Kanoon (indiankanoon.org) for case law search
  5. US: PACER (pacer.uscourts.gov) for federal court records
  6. UK: Companies House (find-and-update.company-information.service.gov.uk)
  7. SEC filings: sec.gov/cgi-bin/browse-edgar for US public company data

Network Mapping & Link Analysis

When you need to see how people, organizations, and infrastructure connect, visual link analysis tools make hidden patterns visible.

  1. Maltego CE (free community edition): sudo apt install maltego -y Drag entities → Run Transforms → build connection graph
  2. Maltego CE limits: 12 results per transform (enough for learning, not production)
  3. Gephi (free graph visualization): sudo apt install gephi -y Import CSV data (Node1, Node2 pairs) → apply ForceAtlas2 layout → color by modularity
  4. draw.io / diagrams.net — free diagramming for simpler investigations

Cyber Threat Intelligence

APT profiling, malware analysis, IOC collection, breach monitoring, and threat hunting

Threat Actor Profiling

When you encounter an intrusion, OSINT helps you identify who's behind it, what their objectives are, and what they'll do next.

  1. MITRE ATT&CK — the knowledge base of adversary TTPs: Visit attack.mitre.org/groups/ → explore APT profiles
  2. ATT&CK Navigator — visual TTP mapping: Visit mitre-attack.github.io/attack-navigator/ Create a layer → search a group → highlight their techniques → export
  3. Cross-reference vendor reports: • Mandiant: mandiant.com/resources/apt-groups • CrowdStrike threat intelligence reports • Microsoft Threat Intelligence blog
  4. IOC databases: • AlienVault OTX: otx.alienvault.com • ThreatFox: threatfox.abuse.ch • URLhaus: urlhaus.abuse.ch • MalwareBazaar: bazaar.abuse.ch

Malware Investigation with OSINT

You don't need a malware lab to get intelligence about a suspicious file. Hash-based lookups give you instant analysis from sandboxes worldwide.

  1. Calculate file hashes: md5sum suspicious_file sha256sum suspicious_file
  2. VirusTotal — paste the hash, get 70+ AV results + behavioral analysis: Visit virustotal.com → Search tab → paste SHA256
  3. Cross-reference: • Hybrid Analysis: hybrid-analysis.com → search hash • Any.Run: any.run → browse public sandbox results • MalwareBazaar: bazaar.abuse.ch → search hash
  4. Extract IOCs from results: C2 domains, contacted IPs, dropped files, mutex names, registry changes
  5. Format for SIEM ingestion: type,value,description domain,evil.example.com,C2 server ip,203.0.113.45,Secondary C2 hash-sha256,abc123...,Payload dropper

Breach Monitoring Setup

Proactive monitoring catches exposures before attackers exploit them.

  1. HaveIBeenPwned domain search: haveibeenpwned.com/DomainSearch → enter your domain
  2. Google Alerts: google.com/alerts → create alerts for your domain + breach-related keywords
  3. IntelX: intelx.io → search your domain across paste sites and dark web
  4. Hudson Rock: cavalier.hudsonrock.com → check for infostealer malware exposure

Tip: Set up ALL four monitoring sources. IntelX and Hudson Rock catch things HIBP misses — especially infostealer dumps, which are the #1 initial access vector in 2026.

OPSEC & Reporting

Protecting your identity, preserving evidence, writing actionable reports, and automating collection

Investigator OPSEC Self-Audit

Before investigating anyone else, make sure your own setup doesn't leak your real identity.

  1. Browser fingerprint check: Visit amiunique.org/fingerprint Visit browserleaks.com
  2. DNS leak test: Visit dnsleaktest.com — run extended test with and without VPN/Tor
  3. WebRTC leak test: Visit browserleaks.com/webrtc — WebRTC can leak your real IP even behind a VPN
  4. Check YOUR file metadata: exiftool test_document.docx exiftool test_photo.jpg Your name, device, and GPS may be embedded!
  5. Scrub metadata before sharing anything: exiftool -all= image.jpg sudo apt install mat2 -y mat2 document.docx
  6. Audit sock puppet accounts: any cross-links to your real identity? Same phone? Same email? Same password? Same profile photo?

Tip: The #1 OPSEC failure is cross-contamination between personal and investigation accounts. Use separate VMs, browsers, and credentials for EVERY investigation.

Evidence Preservation

  1. Hunchly (paid, ~$130/yr): Visit hunchly.com — Chrome extension that auto-captures every page with timestamps, URLs, full page snapshots
  2. SingleFile (free alternative): Firefox/Chrome extension — saves complete web pages as single .html files
  3. Always screenshot with URL bar visible + timestamp
  4. Archive.today: submit URLs to archive.ph for independent preservation
  5. For legal proceedings: hash your evidence files (sha256sum) and document chain of custody

Writing OSINT Reports

Your investigation is only as good as your report. Use the Admiralty/NATO confidence system to rate every finding.

  1. Report structure: 1. Executive Summary — 1 paragraph, key finding + significance 2. Scope — what, when, authorization 3. Methodology — tools, queries, data sources 4. Findings — each with source, date, confidence level, evidence 5. Attribution — who, confidence, evidence chain 6. Recommendations — actionable next steps 7. Appendices — raw data, IOC lists, tool output
Confidence Level Meaning When to Use
Confirmed Multiple independent sources agree 2+ tools/sources corroborate
Probable Strong evidence from 1–2 sources Single reliable source
Possible Some evidence but incomplete Indirect indicators only
Doubtful Weak or contradictory evidence Conflicting information
Improbable Evidence contradicts the claim Likely a false positive

Automating OSINT Collection

Once you understand manual techniques, automation lets you scale investigations and monitor continuously.

  1. SpiderFoot — automated OSINT framework, 200+ data sources: pip3 install spiderfoot spiderfoot -l 127.0.0.1:5001 Open browser → create scan → enter target → review results
  2. Recon-ng — modular framework (built into Kali): recon-ng marketplace install all workspaces create investigation1 db insert domains example.com modules load recon/domains-hosts/hackertarget run show hosts
  3. Custom Python — combine tools programmatically: import subprocess target = "example.com" for t in ["A","MX","TXT","NS"]: r = subprocess.run(["dig",target,t,"+short"], capture_output=True, text=True) print(f"{t}: {r.stdout.strip()}")