Open-Source Intelligence, Explained
The information is already public. The skill is finding it before someone else does - and knowing whether it's worth anything when you do.
Lessons are readable without an account. The planner cites them. It does not collect the records for you.
What's New & Updated
Five defensive OSINT lessons
Email headers, lookalike domains, certificate logs, threat-actor profiles, and STIX sharing. Own or authorised domains only.
theHarvester: public emails and hosts
A passive run on a domain you control. A keyed source with no key is a skip. Active DNS and scanning flags stay off.
Core tracks, written out
The 19 longer modules now have worked steps, an exercise, and a stated legal line. Start with the intelligence cycle.
Twelve tool briefings
Sherlock, Holehe, Maigret, and the rest. Own accounts only. Holehe does not notify the address. Numint stays offline.
FindMe: when to stop collecting tools
Run one plain username search on your own handle, then retire a redundant checker instead of installing another.
Lesson spotlight
Latest lesson, and the one still in the queue
Next up
HIBP (API) (not written yet)
Breach exposure checks on an email you own are next in the writing queue. There is no HIBP lesson on this site yet.
One job · not a chatbot
Paste a target. Get a case file.
The archive stays the archive. This layer turns a collection question into a cited investigation plan: intelligence cycle, OPSEC, and links to real modules.
Open the Case File PlannerLearning Modules
Nineteen longer tracks, then the short briefings. Each one states the question, the method, and where to stop.
OSINT Fundamentals
The intelligence cycle, source judgment, and the part where you stop opening tabs and write the question down.
Kali Linux Mastery
Nmap, directory checks, Maltego, and Wireshark, with the authorization line written down before the first scan.
Digital Forensics
Disk, browser, and timeline work for cases you are allowed to touch. A policy or a warrant comes before the coffee.
Geolocation and Imagery OSINT
Master the techniques of determining locations from photos, videos, and descriptive information. From EXIF data to visual clues, learn to pinpoint locations with precision.
OSINT Methodology & Structured Workflow
Build a repeatable investigation workflow that keeps you organised, focused, and defensible.
Email & Username Intelligence
Trace email addresses and usernames across platforms to build identity profiles and connection maps.
Domain and Website Investigations
Learn to investigate websites and domains for intelligence. Trace ownership, hosting, history, and connections.
Company & Organisational Intelligence
Research companies, their structure, leadership, and digital footprint using open sources.
Digital Identity Analysis
How public traces form a working identity, and how often they belong to three different people.
People Profiling
Public records, disambiguation, and how to stop building a file on the wrong person.
Social Media Investigations
Platform structure, usernames, images, and what a posting pattern can and cannot prove.
Social Media Intelligence
Uncover insights from social platforms. Learn to read between the posts and tweets.
Telegram OSINT Investigations
Master the art of gathering intelligence from Telegram - one of the most valuable OSINT sources for monitoring groups, channels, and user activity.
Geospatial Intelligence (GEOINT)
Learn to analyze geographic data for investigations. Connect locations to patterns and patterns to people.
Network Reconnaissance
Map what a network publishes about itself. Passive first. An open port is not an invitation.
Dark Web Research
What is actually on onion services, how to read a leak notice, and when to close the laptop.
Cryptocurrency Investigations
Learn blockchain analysis basics for tracing transactions, identifying wallets, and connecting crypto activity to real-world entities.
Breach Data Analysis
Learn how to search, analyse, and interpret data from known security breaches for OSINT investigations. Understand credential stuffing, exposure assessment, and timeline analysis.
OSINT Reporting and Presentation
Transform raw intelligence into actionable reports. Learn structured analytical techniques, source citation standards, and how to present findings to different audiences.
Quick Briefings
Short reads. The longer tracks stay above.
Foundations curriculum
What the free beginner track actually covers, and the two things it will not do for you.
Public communities as sources
Forums, groups, and comment threads are sources. They are also where a rumour gets a standing ovation.
OSINT Resources
What this site actually keeps on the shelf, and how to use an outside tool without adopting it.
Sherlock: One Username, 400 Doors
Check where a username exists across hundreds of sites, then do the part the tool can't: decide which hits are actually the same person.
Holehe: Asking the Front Desk if You've Checked In
Find which sites an email address is registered on, why that works, and why some of these checks are one wrong flag away from emailing the person you're researching.
Numint: Start With the Digits, Not the Drama
Parse a phone number offline with libphonenumber, learn what presence checks are (and why this lesson never runs them), and keep phone OSINT on the safe side of the line.
Maigret: Sherlock With a Bigger Rolodex
Run a broader username search, read recursive pivots carefully, and treat every FOUND as a lead until you open it yourself.
WhatsMyName: The Username Checklist You Can Read
Use the WhatsMyName web UI and JSON rules to check a handle, then learn how detection rules actually decide 'exists'.
User Scanner: Username and Email in One Noisy Suitcase
Use User Scanner's username checks on your own handle, keep any email experiment on your own address, and leave recovery-style modules alone.
GoSearch: One Binary, Three Hundred Doorbells
Install a single Go binary, check your own username across hundreds of sites, and compare the hit list to Sherlock without drowning in Python packaging.
Aliens Eye: Another Username Net (Use It to Argue With Yourself)
Run a third username checker on your own handle and practise reconciling disagreements between tools instead of trusting the longest list.
Linkook: Follow the Links They Publish About Themselves
Trace linked social accounts and emails from public profile connections — tradecraft that beats brute-force username blasting when the subject helpfully links their own footprints.
Socialscan: Available Versus Exists (Not the Same Thing)
Query a few major platforms for username and email availability using socialscan — on your own identifiers only — and learn why 'taken' is not a full profile.
Mailcat: Which Providers Know That Nickname?
Check which mail providers accept a nickname as an address — using only nicknames you own — without Tor theatre or anything that notifies a human inbox on purpose.
FindMe: The Simple Username CLI (And When to Stop Collecting Tools)
Run a straightforward username search on your own handle, use it as a cross-check, and practise retiring redundant tools instead of hoarding them.
theHarvester: Collect Public Emails and Hosts, Then Sort the Noise
A passive theHarvester run on a domain you control: which sources need keys, which results are stale, and which flags this lesson leaves off.
Reading Email Headers Like a Detective
Open the full headers, read the Received chain from the bottom, and treat SPF or DKIM passes as clues about which domain actually sent the mail.
Lookalike Domains: Typosquatting with dnstwist
Generate lookalikes of a domain you own or are authorised to monitor, keep the run to DNS checks, and triage the few that can actually send mail.
Certificate Transparency: The Internet's Public Diary
Search crt.sh for certificates on a domain you operate, inventory the names you forgot, and watch for lookalikes without treating every Let's Encrypt cert as an attack.
Building a Threat Actor Profile from Open Sources
Build a one-to-two page profile from public advisories and ATT&CK, grade every claim, and stop before fake personas, criminal forums, or bought leaks.
Sharing Intel: STIX, TAXII and MISP Without Tears
Tell STIX, TAXII, and MISP apart, mark the report with TLP 2.0, and put the bottom line in the first sentence so a human can use it.
The Asset Library
Checklists, operator notes, and blank templates for a clean investigation. The worksheets are empty on purpose.
Browse ResourcesGet the Case Files
New lessons, occasional tradecraft notes.
No spam, ever. Unsubscribe anytime. We trained our email bot better than that.