What Is OSINT? A Practical Introduction

The twenty-minute version you have probably already done

Someone you have never met wants a deposit for a flat, and the listing looks a little too good. So you paste their name into a search engine, then the email address from their message, then the phone number. Twenty minutes later you either feel better or you don't. If you did that, you have done OSINT in its smallest form.

The longer definition: OSINT is intelligence produced from publicly available information. The word that matters is intelligence. A fraud analyst asking "is this new customer who they claim to be?", a journalist asking "who registered the domain behind this campaign?" and a security team asking "which of our staff addresses show up in breach data?" are all doing it. What they share is a question someone needs to act on, and an answer they can defend.

"Open" means accessible without special privileges: no hacking, no logging in as someone else, no insider access. It does not mean free of rules, and we get to those further down.

OSINT is not about finding a lot. It is about finding enough to answer one question, and knowing how sure you are.

Where the information comes from

Most investigations draw on a handful of source families. Knowing them helps you pick a sensible starting point instead of searching everything at once.

Source family	Examples	Typical question
Online accounts	Social profiles, forums, code hosting, gaming platforms	Does this identifier belong to a real, active person? What do they say about themselves?
Identifiers	Email addresses, usernames, phone numbers	Which services is this registered on? Is it disposable?
Breach data	Disclosed data breaches and their metadata	Was this address exposed, when, and which data types leaked?
Infrastructure	WHOIS/RDAP, DNS records, certificate logs such as crt.sh	Who runs this domain, and when was it set up?
Archives	The Wayback Machine, cached pages	What did this page say before it was edited or deleted?
Public records	Company registers, court records, official gazettes	Who are the directors? Is this business registered at all?
Media	Images, video, documents and their metadata	Where and when was this taken? Has it appeared elsewhere?

Identifiers are usually the most productive way in, because people reuse them. Our guides on finding accounts linked to an email address and username investigations go through those first hops in detail.

Pivoting: how one clue becomes five

If you remember one technique from this article, make it the pivot. You take a result from one search and use it as the input for the next. Each hop is small and each one rests on evidence, but a few hops can take you a long way from where you started.

Read it from the top. The address alone says little. The old breach record ties it to a handle, the handle turns up on a code host, and the bio there links to a website with a contact page. None of those steps needed a login, a message or a trick.

The cycle professionals follow

Analysts work in a loop usually called the intelligence cycle. You can skip the military vocabulary, but the steps prevent the two classic failures: collecting far more than you need, and reporting things you never checked.

1. Ask a clear question

   Write down the question, who needs the answer and what you are allowed to do. "Is the seller at jane.doe@example.com plausibly a real person with a history?" is workable. "Find everything about Jane" is not.

2. Collect from open sources

   Gather only what serves the question. For every item, note the source, the time and the exact query, because pages change and profiles vanish.

3. Clean up and sort

   Remove duplicates, put timestamps in one time zone, and mark each result as confirmed or merely possible.

4. Connect and check

   Join the pieces and test the boring explanations too. Two accounts called jdoe-dev might be one person or two strangers. Look for a shared avatar, a linked URL or a matching bio.

5. Report with sources

   State the answer, how confident you are and where each claim comes from, so a colleague can check your reasoning without asking you.

Who uses it, and for what

Security teams map their organisation's exposure: leaked staff credentials, forgotten subdomains, impersonation accounts. Fraud and trust and safety teams check whether a sign-up, seller or applicant uses a disposable email or phone number, or an identity with no history at all. Journalists and researchers verify sources and check whether a photo is what it claims to be. Due diligence and compliance analysts confirm that companies and their officers exist and match what they declare.

And then there is the group that gets mentioned least: ordinary people auditing themselves. Searching your own email, username and phone number and reading the results like a stranger would is the fastest way to learn what you have left lying around.

Passive versus active: the line that matters most

Passive collection reads information without interacting with the subject: checking whether an address is registered on a site, reading a public profile, looking up breach records. Active collection involves contact: sending a message, adding someone as a friend, creating a fake persona. Active techniques carry legal and ethical risk, and they can alert the person, which in many cases ends the investigation and sometimes puts people at risk.

TraceFind lookups are passive. An email, username or phone search never notifies the person being looked up. That is a design choice, not a loophole: the point is to learn from what is already public, not to provoke a reaction.

A short worked example

The limits that keep it legitimate

Public availability does not make every use lawful. A few principles apply nearly everywhere, and in the EU and UK the GDPR spells them out.

• A purpose and a lawful basis. Fraud prevention, security and journalism are recognised purposes, but you must be able to explain why the processing is necessary.
• Minimise. Collect what answers the question, then stop. No profiles "just in case".
• Stay on the open side. Logging in to someone else's account, guessing passwords or using leaked credentials is unauthorised access, whatever the motive.
• No harassment, no exposure. Stalking, doxxing and publishing private details are harmful and often criminal.
• Write it down. Record what you searched, when and why. It protects you and the person you researched.

Where to start

Start with yourself. Search your main email address, your usual username and your phone number, then look at the results the way an investigator would: what could a stranger learn, and how sure could they be? It makes the power of open sources concrete, and it explains why the limits above exist. When you want to run a whole case, our investigation workflow shows one from question to report, and the canvas tutorial shows how to keep it organised.

Frequently asked questions