OSINT methods
Practical, step-by-step guides to the most common and effective OSINT techniques — from geolocating a photo to mapping a domain's infrastructure.
How to Geolocate a Photo From Visual Clues
A step-by-step method for pinning down exactly where a photo was taken — even with no metadata — by reading the image and matching it against satellite and street-level imagery.
Read the methodarrow_forwardHow to Verify a Photo With Reverse Image Search
A practical workflow for checking whether an image is genuine, when it first appeared, and whether it really shows what it claims — before you trust or share it.
Read the methodarrow_forwardHow to Find Every Account Linked to a Username
A method for taking a single handle and mapping the full set of accounts tied to it across platforms — the foundation of people-focused investigations.
Read the methodarrow_forwardHow to Investigate an Email Address
A workflow for turning an email address into intelligence: breach exposure, the services it's registered with, and the accounts and identity behind it.
Read the methodarrow_forwardHow to Map a Domain's Infrastructure
A reconnaissance method for enumerating a domain's subdomains, DNS records, certificates, and related assets to reveal an organisation's full online footprint.
Read the methodarrow_forwardHow to Set Up a Safe OSINT Research Environment
A setup method for investigating cleanly and safely — a compartmentalised browser, research accounts, and the OPSEC habits that protect both you and your findings.
Read the methodarrow_forwardHow to Investigate a Phone Number
A method for turning a phone number into intelligence — the carrier and region, the accounts it's linked to, and the identity behind it — using only public sources.
Read the methodarrow_forwardHow to Verify a Video
A frame-by-frame method for checking whether a video is authentic, when and where it was filmed, and whether it shows what it claims — before you trust or share it.
Read the methodarrow_forwardHow to Recover Deleted or Changed Web Pages
A method for retrieving pages, posts, and files that have been deleted or edited — using web archives and caches to prove what a source once published.
Read the methodarrow_forwardHow to Research a Company
A due-diligence method for uncovering a company's real owners, structure, litigation, and reputation from public records — the backbone of vetting a partner or target.
Read the methodarrow_forwardHow to Extract and Analyze File Metadata
A method for pulling the hidden data inside photos and documents — locations, authors, timestamps, and software — that reveals far more than the visible content.
Read the methodarrow_forwardHow to Trace a Cryptocurrency Transaction
A method for following money across a public blockchain — from a wallet address through transactions to exchanges and clusters — using open block explorers.
Read the methodarrow_forwardHow to Use Advanced Search Operators (Dorking)
A method for building precise search queries with operators like site:, filetype:, and intitle: to surface documents and pages that ordinary searches never reach.
Read the methodarrow_forwardHow to Monitor an Unfolding Event in Real Time
A method for turning the chaos of live social feeds and sensor data into verified situational awareness during a breaking event — without amplifying misinformation.
Read the methodarrow_forwardHow to Track a Flight, Ship, or Vehicle
A method for following aircraft, ships, and ground transport in near-real time using public tracking feeds — adding a physical dimension that social media alone can't provide.
Read the methodarrow_forwardHow to Investigate a Social Media Account
A method for deeply analysing a single social-media profile — its network, posting patterns, and leaked details — to understand who is behind it and what it reveals.
Read the methodarrow_forwardHow to Reduce Your Own Digital Footprint
A defensive method for finding and removing the public information that exposes you — data-broker listings, reused identifiers, leaked credentials, and revealing metadata.
Read the methodarrow_forwardHow to Check if a Website Is Legitimate
A method for quickly assessing whether a website is a genuine business or a scam or phishing site — using registration, infrastructure, reputation, and content signals.
Read the methodarrow_forwardHow to Create a Research Sock Puppet Account
A method for building and maintaining a believable, well-separated investigative persona so you can research online without exposing your real identity or contaminating your findings.
Read the methodarrow_forwardHow to Investigate an IP Address
A workflow for turning a single IP address into intelligence — its owner, location, hosting, the domains it serves, and its reputation — using only open sources.
Read the methodarrow_forwardHow to Preserve and Document OSINT Evidence
A method for capturing online evidence so it stays trustworthy — with timestamps, hashes, and provenance — instead of a folder of screenshots nobody can verify later.
Read the methodarrow_forwardHow to Map a Social Network
A method for turning a set of accounts into a relationship map — who connects to whom, how strongly, and where the real influence sits — using link analysis on open social data.
Read the methodarrow_forwardHow to Research the Dark Web Safely
A cautious method for finding and reading dark-web mentions of a name, brand, or breach — how to look without exposing yourself, and how to weigh what you find.
Read the methodarrow_forwardHow to Fingerprint a Website's Technology
A method for reading the technology behind a website — its stack, trackers, and analytics IDs — and using shared identifiers to link it to other sites the same operator runs.
Read the methodarrow_forwardHow to Chronolocate a Photo or Video
A method for establishing when a photo or video was captured — not just where — using shadows, weather, celestial position, and on-scene clues to pin down the date and time.
Read the methodarrow_forwardHow to Automate OSINT Monitoring
A method for turning a one-off search into a standing collection system — alerts, feeds, and saved queries that surface new information on a person, brand, or topic without you checking manually.
Read the methodarrow_forwardHow to Analyze a Data Breach Responsibly
A method for working with leaked or breached data to check exposure and corroborate identities — safely, legally, and without amplifying harm.
Read the methodarrow_forwardHow to Debunk Viral Misinformation
A method for checking a fast-spreading claim, image, or video before you believe or share it — tracing it to its origin and testing it against evidence.
Read the methodarrow_forwardHow to Search Public Records for a Person
A method for building a picture of a person from public records and data-broker sources — addresses, businesses, and affiliations — legally and with an eye to accuracy.
Read the methodarrow_forwardHow to Build a Complete OSINT Profile on a Person
A repeatable method for assembling scattered public traces — accounts, records, and images — into a single, well-sourced profile of a person without jumping to conclusions.
Read the methodarrow_forwardHow to Detect Fake or Bot Social Media Accounts
A method for judging whether a social media account is a real person, a bot, or part of a coordinated network — from profile signals to behavioural patterns.
Read the methodarrow_forwardHow to Trace an Email's Origin From Its Headers
A method for reading the hidden headers of an email to reveal the servers it passed through, its likely origin, and whether it was spoofed.
Read the methodarrow_forwardHow to Investigate a Cryptocurrency Scam or Rug Pull
A method for tracing a crypto scam — from the fraudulent token or address to the wallets, exchanges, and people behind it — using public blockchain data.
Read the methodarrow_forwardHow to Monitor for Leaked Credentials and Breaches
A method for setting up ongoing monitoring so you learn quickly when an email, password, or domain appears in a data breach — for yourself or an organisation.
Read the methodarrow_forwardHow to Geolocate a Wi-Fi Network (BSSID/SSID)
A method for locating a wireless network from its name or hardware identifier, using public wardriving databases to turn an SSID or BSSID into a place.
Read the methodarrow_forwardHow to Verify the Credibility of a News Source
A method for judging whether a news outlet or article is trustworthy — examining ownership, track record, sourcing, and corroboration before you rely on it.
Read the methodarrow_forwardHow to Analyze a Mobile App (APK) for OSINT
A method for pulling intelligence out of a mobile app — its permissions, embedded endpoints, trackers, and developer identifiers — without deep reverse engineering.
Read the methodarrow_forwardHow to Build an Investigation Timeline
A method for turning scattered, timestamped evidence into a single chronological timeline that exposes sequence, gaps, and contradictions.
Read the methodarrow_forwardHow to Conduct OSINT Due Diligence on a Business
A method for vetting a company from public sources — ownership, financials, litigation, reputation, and infrastructure — before a deal, partnership, or investment.
Read the methodarrow_forward