OSINT Methodology

A repeatable, professional workflow turns scattered searches into a defensible investigation. This methodology is intentionally tool-agnostic · apply it regardless of which tools from the directory (opens in a new tab) you use.

Core principle: every OSINT finding is a hypothesis until it has been independently verified. Treat your output as an assessment with a stated confidence level, not a fact.

1. Define Objective#

Write down, in one or two sentences, exactly what question you are trying to answer (e.g., "Does this domain belong to a legitimate organization?", "Is this username associated with a known threat actor alias?"). A clear objective prevents scope creep and unnecessary data collection.

2. Collect Known Identifiers#

List every starting point you already have: name, username, email, domain, IP, phone number, image, company name. These "seeds" drive every subsequent step.

3. Passive Discovery#

Begin with sources that require no interaction with the target: search engine caches, WHOIS/RDAP records, public breach-notification indexes, archived pages (Wayback Machine), and public records. See resources/search-engines.md (opens in a new tab).

4. Search Engines#

Use general-purpose and specialized search engines with advanced operators (site:, filetype:, intitle:, "exact phrase") to surface indexed content that direct browsing would miss. See tools/search-engines (opens in a new tab).

5. Username Correlation#

Check whether a username appears consistently across platforms using tools such as Sherlock (opens in a new tab), Maigret (opens in a new tab), or the WhatsMyName (opens in a new tab) database. Treat every hit as unverified until manually confirmed.

6. Email Intelligence#

Check where an email address is registered (Holehe (opens in a new tab), Epieos (opens in a new tab)) and whether it appears in known breach datasets (Have I Been Pwned (opens in a new tab), h8mail (opens in a new tab)).

7. Domain / IP Intelligence#

Map infrastructure using passive DNS and attack-surface tools (Amass (opens in a new tab), Subfinder (opens in a new tab), Assetfinder (opens in a new tab), dnsx (opens in a new tab)) and internet-wide scan indexes (Shodan (opens in a new tab), Censys (opens in a new tab)).

8. Image Analysis#

Use reverse image search (TinEye (opens in a new tab), Google Lens (opens in a new tab), Yandex Images (opens in a new tab)) to find the origin, prior appearances, or context of an image.

9. Metadata Analysis#

Extract embedded metadata (camera model, GPS coordinates, timestamps, authorship) from files using ExifTool (opens in a new tab) or MediaInfo (opens in a new tab). Note that most social platforms strip metadata on upload · metadata is most useful on files obtained directly, not from social media.

10. Cross-Source Correlation#

Line up findings from every step above. Look for consistent, independently-sourced overlaps (same alias + same avatar + same email domain, for example) rather than relying on any single source.

11. Verification#

For each significant finding, ask:

• Can I confirm this through a second, unrelated source?
• Could this be a coincidence (shared name/username), a spoofed account, or stale/cached data?
• Would this finding hold up if someone else tried to reproduce it?

12. Documentation#

Record the source, timestamp, method, and raw evidence (with screenshots/archives) for every finding that feeds into your conclusion. Undocumented findings are not reproducible and should not be relied upon.

13. Confidence Assessment#

Grade your overall conclusion honestly, for example:

Present findings with their confidence level attached · never present a low-confidence lead as a confirmed fact.

Before starting any investigation, review OPSEC and Legal & Ethical Use.