Post

OSINT Compendium

Posted
By enonethreezed
17 min read
OSINT Compendium

OSINT Tooling Catalog & Investigation Playbooks

Executive summary for leadership

  • This document consolidates OSINT tools and repeatable playbooks to accelerate investigations, due diligence, threat triage, and incident response while reducing ad‑hoc tool sprawl.
  • Primary risks are legal/regulatory exposure (privacy, platform terms), operational security (pivot leakage), and evidentiary weakness (poor capture, unverifiable sources).
  • Governance is non‑optional: define acceptable use, conduct privacy impact assessment where required, set retention and access controls, and ensure vendor due diligence for paid platforms.
  • Operationalize via standard playbooks, controlled environments (separate profiles/VMs), and evidence handling (time-stamped capture + hashing).
  • Measure effectiveness via case cycle time, rework rate (false leads), and evidentiary acceptance rate in internal/legal review.

Table of contents

Scope and intended use

  • Intended audience: security operations, investigations, fraud/abuse, compliance, corporate security, threat intel.
  • Scope: publicly available information and legitimately accessed data sources. This is not a guide to bypass access controls, scrape in violation of terms, or obtain data unlawfully.
  • Outputs: leads, hypotheses, and evidence artifacts; all conclusions must be corroborated.

Governance and compliance

[!IMPORTANT] Treat OSINT as regulated data processing when it involves personal data. If your organization operates in the EU/UK or similar jurisdictions, validate lawful basis, proportionality, retention, and security controls.

  • Acceptable use: define permitted purposes (e.g., fraud prevention, incident response), prohibited purposes (e.g., personal stalking, employment decisions without due process).
  • Platform terms: many sources forbid automated collection; use APIs where available and document terms constraints in case notes.
  • Data protection: minimize data, segregate cases, limit access by role, apply retention schedules, and log access to sensitive artifacts.
  • Sanctions / export controls: validate tool vendors, hosting regions, and any restricted entities before procurement or use.
  • Cloud AI: never paste sensitive PII, credentials, non-public indicators, or unique pivots into cloud LLMs. Redact and/or use local tooling.

Operating principles

  • Triangulate: no single source is authoritative; corroborate across independent sources.
  • Preserve context: capture full pages, not just snippets; record timestamps and access paths.
  • Minimize pivot leakage: avoid logging into personal accounts or reusing cookies/profiles across cases.
  • Document assumptions: explicitly separate facts, inferences, and unknowns in notes.

Quickstart playbooks

1) Person identity resolution (non-invasive)

  1. Start with unique identifiers (email, username, domain, or organization) before names.
  2. Run username/email pivots and capture results (screenshots + URLs).
  3. Validate with independent sources (archives, official registries, multiple platforms).
  4. Build a minimal identity graph (handles, emails, domains, known associates) and note confidence levels.

2) Company due diligence and ownership signals

  1. Identify official web presence and corporate identifiers (legal name, registration number, VAT).
  2. Use company registries and business intelligence sources; corroborate across jurisdictions.
  3. Review media and sanctions context; preserve citations and capture snapshots.
  4. Map infrastructure: domains, certificates, ASNs, hosted services; correlate with known brands cautiously.

3) Image/video verification

  1. Extract metadata and generate hashes of files; store originals read-only.
  2. Run reverse search across multiple engines; compare earliest known appearance via archives.
  3. Check manipulation/provenance signals (content credentials where present) and look for inconsistencies (shadows, EXIF gaps, compression artifacts).
  4. Document why a match is credible (visual landmarks, upload timing, independent reposts).

4) Geolocation and timeline

  1. Collect candidate location hints (signage, terrain, weather, transport lines).
  2. Confirm with maps + satellite and street-level sources; record coordinates and reference imagery.
  3. Use time cues (sun angle, shadows, known schedules) cautiously; always label as inference.

5) Crypto wallet and transaction triage

  1. Identify chain, address format, and first/last activity; keep chain-specific explorers as sources of record.
  2. Use on-chain explorers and (where authorized) analytics platforms to cluster activity and identify counterparties.
  3. For high-stakes cases, preserve transaction pages and include block numbers, timestamps, and transaction hashes in notes.

6) Infrastructure and attack-surface context

  1. Enumerate domains/subdomains and certificates; map to hosting/ASN and known services.
  2. Monitor new issuances, DNS changes, and exposed services; document tool versions and timestamps.

OPSEC baseline

  • Use a dedicated browser profile (or VM/container) per case; avoid cross-case cookies and auto-logins.
  • Prefer read-only viewing; avoid interacting with targets (no follows/likes/messages).
  • Consider a research network boundary (VPN, egress controls) and prevent accidental account correlation.
  • Avoid reusing unique pivots in third-party tools that may log queries; treat paid enrichment and AI as data processors.

Evidence handling

  • Capture URLs, timestamps (with timezone), and page snapshots (PNG/PDF plus WARC/SingleFileZ) for key artifacts.
  • Hash downloaded files (SHA‑256) and store hashes alongside originals.
  • Keep a case log separating facts, inferences, and open questions; include tool versions for reproducibility.
  • Store evidence read-only; prevent cross‑contamination by separating storage per case.

Tool catalog

Legend (optional tagging): [Free] [Freemium] [Paid] [API] [Dataset] [Extension] [Account] [Cloud]

Core indexes

  • Bookmarks — Comprehensive list of various OSINT bookmarks.
  • OSINT Framework — A comprehensive collection of OSINT tools and resources.

General OSINT

Search Engines

Username and Email Investigation

  • Clearbit — Data enrichment for companies and individuals.
  • FaceCheck — Find people by their picture
  • FaceSeek — another reverse search for faces
  • Pipl — Deep web people search (Note: primarily a paid service).
  • Spokeo — People search engine.
  • TruePeopleSearch — Free people search in the U.S.
  • Webmii — People search engine
  • WhitePages — Find people and contact information

Social Media

  • Bluesky/AT Protocol:
  • Facebook Friends — graph search alternative
  • Facebook Graph Search — Advanced Facebook search techniques.
  • Facebook ID Lookup — to find ID of a user on Facebook
  • Facebook Search — searching for posts
  • Mastodon/Fediverse:
  • Meta Content Library — Researcher‑gated content search (CrowdTangle successor)
  • Picuki — View Instagram profiles and posts without an account.
  • RedTrack.social — Reddit user analysis and post history tracking
  • Reveddit — View removed Reddit content for context
  • Search4Faces — search for a face in social media.
    • SkyView — Follower graphs and network analysis
  • snscrape — Actively‑maintained CLI scraper for X/Twitter, Reddit, Telegram, and more. Prefer this over Twint.
  • Social Blade — Analytics for YouTube, Twitch, Instagram, and more.
  • Threads by Instagram: Use Instagram OSINT tools; Threads shares Instagram account infrastructure
  • Tokboard — TikTok trend and profile analytics (APIs change frequently)
  • Twint (unstable; breaks when APIs change) — use only if snscrape cannot cover a need.

Phone Number

Public Records and Company Information

Leaks

Cryptocurrency OSINT

Blockchain Analysis

  • Blockchain.com Explorer — Bitcoin and crypto search engine
  • Blockchair — Bitcoin block explorer
  • BSCScan — BNB Smart Chain explorer
  • Cielo — Multi-chain wallet tracking (EVM, Bitcoin, Solana, Tron, etc)
  • Dune — Analytics platform to query blockchain data
  • Etherscan — Ethereum blockchain explorer
  • Impersonator — Chrome extension to spoof login to dApps
  • MetaSuites — Chrome extension for additional data on block explorers
  • OKLink — Multichain explorer and analytics [Freemium]
  • PolygonScan — Polygon PoS blockchain explorer
  • Solscan — Solana blockchain explorer
Layer 2 / Rollup Explorers

Wallet Investigation

Transaction Tracking

  • Arkham — Multichain block explorer, entity labels, graphs, alerts
  • BitQuery — Blockchain data analysis and APIs
  • Breadcrumbs — Visual graphing and labeling for crypto flows [Freemium]
  • Bubblemaps — Holder concentration visualization; identify whale clusters
  • CipherTrace — Cryptocurrency intelligence
  • CryptoTaxCalculator — Track PNL for an address
  • Dextools — DEX trading analysis and charts
  • GraphSense — Cryptocurrency analytics platform
  • MetaSleuth — Similar to TRM but intended for retail users
  • Nansen — On-chain analytics with Smart Money labels (paid; expensive)
  • Token Sniffer — Honeypot and scam token detection
  • TRM — Create graphs for addresses/transactions
  • Whale Alert — Track large crypto transactions

Bridge Monitoring

NFT Analysis

  • Alchemy NFT API — NFT metadata and ownership APIs [Freemium]
  • DappRadar — Track NFT sales and marketplace activity
  • Nansen — NFT analytics platform
  • NFTScan — Multi-chain NFT explorer
  • OpenSea — NFT marketplace explorer
  • Reservoir — Unified NFT metadata and market data API [Freemium]

Exchange Intelligence

Media Intelligence

Image Analysis

Browser Extensions

Video Analysis

Metadata Extraction

GeoSpatial Intelligence

Satellite Imagery and Mapping

Tools and Applications

  • C2PA Verify — Verify embedded content credentials
  • GeoNames — Geographical database.
  • KartaView — Open-source street-level imagery.
  • Mapillary — CrowdSourced street-level imagery.
  • Marble — Virtual globe and world atlas.
  • Overpass Turbo — Advanced querying of OpenStreetMap data.
  • PeakVisor — Identify mountain peaks.
  • SAS Planet — Satellite imagery viewing application.
  • SunCalc — Sun position calculator for Chronolocation.

Street View

Flight OSINT

Maritime OSINT

AI‑Assisted OSINT Platforms

Commercial/Enterprise AI Tools

  • Cylect — AI‑powered entity extraction and link‑analysis workspace
  • DarkOwl Vision — AI-powered darknet data collection and analysis
  • Fivecast Matrix — Generative‑AI triage and risk scoring for large social‑media datasets
  • Recorded Future — AI-driven threat intelligence and entity tracking

AI-Powered Analysis

[!WARNING] Treat cloud AI prompts as potentially retained by providers and/or their subprocessors. Do not paste sensitive PII, non-public indicators, credentials, or unique pivots. Use redaction, synthetic examples, or local models.

  • Anthropic Claude — Large-document review and synthesis (use only with sanitized inputs) [Cloud]
  • Google Gemini — Multimodal analysis and research assistance (use only with sanitized inputs) [Cloud]
  • Microsoft Copilot — Bing-backed search assistance for generic queries (avoid pasting sensitive pivots) [Cloud]
  • OpenAI ChatGPT — General-purpose analysis, text extraction, data triage (use only with sanitized inputs) [Cloud]

  • Perplexity — Web search + citation-style answers for background context (avoid pasting sensitive pivots) [Cloud]

  • Local / self-hosted LLM runners (privacy-preserving):
    • Ollama — Run open models locally

Specialized AI OSINT Tools

Archiving & Snapshots

  • ArchiveBox — Self-hosted web archiving; captures HTML, PDF, screenshots, media
  • archive.today — One‑page content archiver with screenshot capability
  • Hunchly — Evidence capture tool for investigators (paid)
  • Kasm Workspaces — Containerized OSINT workspace images (browser isolation)
  • SingleFileZ — Browser extension for offline single-file HTML archives
  • URLScan.io — On‑demand webpage scan with full resource map and screenshot

Automation

Workflows and schedulers

  • Apache Airflow — Workflow orchestration for complex data pipelines
  • Cronicle — Distributed task scheduler for recurring OSINT jobs
  • Huginn — Agent-based automation for monitoring, scraping, alerting
  • n8n — Self-hosted workflow automation for OSINT pipelines (e.g., monitor RSS → scrape → alert)
  • Prefect — Modern workflow orchestration; easier than Airflow

Headless browsing and crawling

Additional Tools

IP and Network Analysis

ASN/BGP & Internet Measurement

Certificates & CT Monitoring

Social Media Intelligence

Telegram & Messaging Analytics

  • Combot — Group analytics (partially paid)
  • WeChat OA search via Sogou Weixin: Search WeChat Official Accounts content
  • Telemetr — Channel growth, overlaps, forwards
  • TGStat — See: Additional Tools → Telegram & Messaging Analytics.
  • **[t.me/s/](https://t.me)** — Public channel feed view (replace with channel name)

Infrastructure & Attack‑Surface OSINT

  • Amass / Subfinder [Free]: Passive subdomain discovery (use responsibly)
  • BuiltWith — Tech stack enumeration; useful for pivoting to third‑party assets
  • Censys — Enumerate hosts and digital certificates across the internet
  • GreyNoise — Distinguish background internet noise from targeted scans
  • Netlas — Large‑scale HTTP/DNS/certificates pivots
  • Recon‑ng — Web‑based recon framework
  • RiskIQ PassiveTotal — Passive DNS/cert/host pivots
  • SecurityTrails — Passive DNS records and asset discovery
  • Shodan — Search engine for internet‑connected devices and services
  • SpiderFoot — Automated OSINT reconnaissance and correlation (self‑host or SaaS)
  • theHarvester — Subdomain, email, and metadata harvesting

Threat Intel & IOCs

Malware Analysis & Sandboxes

RU/CN Corporate & Registries

Regional Search Engines

Sanctions & Compliance

Changelog

  • 2026-02-10: Restructured into executive summary, governance, playbooks, OPSEC/evidence handling, and normalized tool formatting.
osint
tooling
This post is licensed under CC BY 4.0 by the author.