Most people who ask me about OSINT want a tool list. They want the twelve browser extensions and the one Python framework that turns a name into a dossier. I understand the impulse, and I will give you the list further down, but I want to say the uncomfortable part first: the tools are the least durable thing in this discipline. Half of what I used five years ago is dead, rate-limited, paywalled, or quietly returning stale data. The method survives. The method is what makes one analyst reliable and another one a generator of confident nonsense.
So this is an overview of both, in the order that actually matters.
Start With the Requirement, Not the Tool
Every bad OSINT product I have reviewed shares one origin: somebody started collecting before they knew what question they were answering. They ran the domain through six enumeration services, pulled 400 subdomains, screenshotted everything, and produced a report that told the client nothing they could act on.
Write the requirement down in a single sentence before you touch a keyboard. Not “research this company” but “identify which of this company’s public-facing systems are hosted outside its stated jurisdiction, as of this month.” That sentence tells you which collection surfaces are relevant, which are noise, and — critically — when you are finished. Without it, collection expands until you run out of patience, and the report reflects your fatigue rather than the evidence.
The traditional intelligence cycle still applies, in compressed form: requirement, collection plan, collection, processing, analysis, dissemination. The part practitioners skip is the collection plan. Ten minutes deciding which surfaces you will search, in what order, and what would count as a negative result will save you a day.
The Collection Surfaces
I organise tooling by the surface it interrogates rather than by vendor, because vendors churn and surfaces do not.
Search and discovery
Operator-driven search is still the highest-yield technique in the field, and it is the one most people never learn properly. Site, filetype, intitle, inurl, and exact-phrase operators against multiple engines will out-perform an expensive platform on most tasks. Run the same query against Google, Bing, Yandex, and a regional engine appropriate to your target’s language — the indexes diverge substantially, and Yandex in particular surfaces Russian-language and image results the Western engines never return.
Infrastructure and domains
- Certificate transparency logs (crt.sh and equivalents) for subdomain discovery — passive, complete, and free
- Passive DNS and historical records for pivoting between hosts and owners over time
- Shodan, Censys, and ZoomEye for exposed services, banners, and device fingerprints
- Amass, theHarvester, and SpiderFoot for automated enumeration and correlation
- Maltego where the relationships between entities matter more than the entities themselves
Distinguish passive collection from active. Certificate logs and passive DNS touch nothing belonging to the target. Port scanning and direct probing do, and in many jurisdictions that shifts your activity from research to something a prosecutor could characterise differently. Know which side of that line each tool sits on before you run it.
Corporate and public records
Company registries, beneficial-ownership filings, procurement databases, court dockets, sanctions and enforcement lists, and leaked-document archives held by investigative consortia. OpenCorporates and the OCCRP’s Aleph are the usual entry points, but the national registries themselves are richer and frequently free. Corporate records are the most under-used surface in commercial OSINT and the most persuasive in a finished product, because they are documentary rather than inferential.
Geospatial and imagery
Satellite archives, street-level imagery, OpenStreetMap querying through Overpass, terrain and shadow tools for chronolocation, and volunteered geographic data. Geolocation work is the most method-dependent part of OSINT: it is a process of generating hypotheses from terrain features, signage, vegetation, road markings, and sun angle, then falsifying them one at a time. The tool does not find the location. You do.
Transport and movement
Automatic identification system data for vessels, ADS-B feeds for aircraft, flight and shipping registries, and port call records. These are exceptionally good sources because the underlying transponders broadcast continuously and the historical archives are deep. They are also routinely misread — a vessel going dark on AIS is a data point, not a finding.
Media, archives, and provenance
Web archives and page-snapshot services, reverse image search across several engines, video keyframe extraction and verification suites, and metadata inspection where the file has survived the platform’s stripping. Assume any image or video sourced from a social platform has been re-encoded and stripped of EXIF. Provenance has to be established from content, not from metadata you hope is still attached.
Tradecraft: Do Not Contaminate Your Own Collection
Your research infrastructure is part of the investigation. If your browsing profile, IP, account history, or timing tells the target that someone is looking, you have altered the thing you are measuring — and in adversarial work you have created a risk to yourself and possibly to a source.
Practical minimums: a dedicated machine or virtual machine that never touches your personal accounts, a browser profile with no cross-contaminating logins, deliberate control over what your traffic reveals, and research accounts that are consistent, aged, and unremarkable rather than freshly created and obviously synthetic. Keep a separation between the identity that collects and the identity that publishes.
Equally important and less discussed: do not contaminate the record. Log every query, every source, every retrieval time, and hash your captured artifacts. Pages change and disappear. A screenshot with no URL, no timestamp, and no hash is an assertion, not evidence, and it will not survive contact with a lawyer, an editor, or a serious adversary.
Verification Is the Job
Collection is easy now. Verification is what you are actually paid for, and it has a structure.
Grade the source and the information separately. The old Admiralty convention — reliability of the source on a letter scale, credibility of the specific claim on a numeric scale — remains the cleanest way to express that a normally reliable outlet has published something you cannot corroborate, or that a dubious channel happens to be right this time. Analysts who collapse those two axes into a single impression of trustworthiness produce brittle work.
Then look for genuine independence between corroborating sources. Three outlets carrying the same wire copy is one source. Two social accounts posting the same image is one image. Circular reporting is the most common failure mode in open-source analysis, and it is nearly invisible unless you deliberately trace each claim to its origin.
Finally, state your confidence and your uncertainty explicitly, and separate what you observed from what you inferred. “The domain resolved to an address in this range on this date” is an observation. “The company operates infrastructure in that country” is an inference, and it can be wrong for a dozen mundane reasons — CDNs, resellers, stale records, shared hosting.
The Constraints Are Real
Publicly accessible is not the same as lawfully collectible, and lawfully collectible is not the same as ethically usable. Data protection regimes apply to open-source collection about identifiable people, and they apply regardless of how easy the collection was. Terms of service govern automated scraping. Facial recognition search against private individuals is prohibited or heavily restricted in a growing number of jurisdictions, and even where it is not, it produces false matches at a rate that should terrify anyone attaching a name to a face in a published report.
Ask, before every collection step, whether the intrusion is proportionate to the requirement, and whether you could defend the step in front of a regulator. If the honest answer is that you would rather not explain it, do not take the step.
What Separates Practitioners From Enthusiasts
Enthusiasts accumulate tools. Practitioners accumulate judgement about which surfaces answer which questions, discipline about recording what they did, and a willingness to write “not established” in a report that a client would prefer said something more dramatic.
The stack changes every year. The habits do not.
Leave a Reply