What is OSINT?

OSINT is intelligence derived from sources that are legally and technically accessible to anyone — websites, social platforms, official registries, leaked datasets indexed by search engines, satellite imagery, public broadcasts, academic literature, code repositories, and more.

The distinction is not the data itself but the method: an OSINT analyst transforms raw, scattered, often unreliable signals into a structured product — a timeline, an attribution, a network map, a risk assessment — through verification, correlation and contextual analysis.

The term was coined in the U.S. intelligence community in the 1940s — the Foreign Broadcast Information Service (FBIS) monitored Axis radio broadcasts during WWII. For decades, OSINT was a discreet complement to human (HUMINT) and signals (SIGINT) intelligence.

The 2000s consumer internet inverted the ratio. By the 2010s, groups like Bellingcat proved that open sources alone could attribute war crimes, identify GRU officers, and reconstruct conflicts in near real-time. The 2020s normalised OSINT in newsrooms, corporate security, humanitarian work, and digital forensics.

OSINT is an umbrella. Modern investigations usually combine several disciplines:

• Open web — websites, blogs, forums, archived snapshots.
• Search engines — Google, Bing, DuckDuckGo, plus specialised dorks.
• Social platforms — public profiles, posts, follower graphs.
• Government & legal registries — companies, courts, sanctions lists, land records.
• Geospatial data — satellite imagery, OpenStreetMap, flight & marine trackers.
• Technical infrastructure — WHOIS, certificate transparency, Shodan, Censys.
• Code & developer ecosystems — GitHub, GitLab, npm, PyPI, paste sites.
• Media & broadcast — news archives, podcasts, TV captures.
• Leaked & breach datasets — handled under strict legal/ethical constraints.

Professional OSINT follows the classic intelligence cycle — adapted for open sources:

1. 1
   Direction

   Define the question. "Who runs this company?" is answerable; "Tell me about them" is not.

2. 2
   Collection

   Gather raw data with reproducible queries. Preserve provenance: archive every page, hash every file, record timestamps.

3. 3
   Processing

   Normalise, deduplicate, translate, transcribe, extract entities. This is where most modern AI tooling sits.

4. 4
   Analysis

   Correlate signals across sources, build timelines and network graphs, test alternative hypotheses, score confidence.

5. 5
   Dissemination

   Produce a clear, sourced report. Each claim links back to evidence with a verifiable URL or archive.

6. 6
   Feedback

   Stakeholders refine the question, new leads emerge, the cycle repeats.

"Public" does not mean "free of obligation". OSINT practitioners operate under overlapping rules:

• Data protection — GDPR, UK DPA, CCPA and equivalents apply to personal data even when it is publicly accessible.
• Computer misuse — exceeding a site's authorisation (credential reuse, scraping behind logins) can be criminal.
• Terms of service — automated collection may breach contractual terms even when technically permitted.
• Jurisdiction — your home law, the target's jurisdiction, and the platform's all apply simultaneously.
• Proportionality — collect what is necessary, retain only what is justified, anonymise where possible.

• Isolate — investigation activity on a dedicated VM, browser profile, identity.
• Hide attribution — VPN/residential egress matched to the case, never your home IP.
• No real accounts — never log into targets with personal credentials; use sock-puppets in compliance with platform rules.
• Archive immediately — Wayback, archive.today, local WARC. Targets delete fast.
• Chain of custody — record who collected what, when, and how; preserve original artefacts unmodified.

Large language models, multimodal models, and agentic systems have compressed tasks that used to take days into minutes: entity extraction at scale, cross-language transcription, face and object detection, automated geolocation hints, and narrative summarisation.

They also introduce new failure modes: hallucinated citations, confident misidentification, synthetic media at industrial scale, and prompt-injection from adversarial pages.

• Confirmation bias — you found three sources, but they all repeat the same wrong tweet.
• Single-source attribution — one cropped photo is not a geolocation; corroborate with shadows, EXIF, terrain, language.
• Stale data — WHOIS, DNS and social profiles change. Always note collection timestamps.
• Mistaken identity — common names, recycled handles and lookalike profiles produce false positives constantly.
• Operational leakage — your queries themselves can tip off the target. Throttle, route, and time access deliberately.

The framework on this site is organised exactly like a working investigation: by what you are trying to discover (people, infrastructure, imagery, code, finance, etc.). Pick a discipline and explore — every tool is annotated with a confidence score, license, and last-commit signal so you know what you are about to run.