Common OSINT sources

  • Technical: DNS records, certificate transparency logs, WHOIS data, internet-wide scan data and search engine results.
  • Code and documents: public repositories, paste sites, exposed cloud storage and document metadata.
  • People: professional networking sites, social media, conference talks and company websites.
  • Organisational: Companies House filings, job adverts, press releases and supplier announcements.

How attackers use OSINT

Reconnaissance is the first stage of most attacks. Attackers use OSINT to map an organisation's external attack surface, build lists of staff and email formats for phishing, learn which technologies are in use from job adverts, and find leaked credentials or secrets. Very little of this requires breaking any law, because the information is already public.

How defenders use OSINT

  • Discovering internet-facing assets and shadow IT.
  • Finding exposed secrets, documents and personal information before attackers do.
  • Assessing executive and staff exposure for social engineering risk.
  • Researching threat actors and campaigns as part of threat intelligence.

How DarkInvader helps

DarkInvader's OSINT Monitoring runs automated modules that gather intelligence on your company and domain, surfacing work emails, personal information, exposed code and secrets, and compromising social media content, so you can act before attackers use it.

Explore OSINT Monitoring

Frequently asked questions

Is OSINT legal?

Collecting publicly available information is generally legal, but how it is gathered and used still matters. Processing personal data must comply with UK GDPR, and accessing systems without permission is not OSINT.

What is the difference between OSINT and threat intelligence?

OSINT is a source of information, namely public data. Threat intelligence is the analysed product used to make decisions, and it can draw on OSINT as well as closed and commercial sources.

What can OSINT reveal about my company?

Typically your domains and subdomains, technologies in use, staff names and email formats, leaked credentials, exposed documents and code, and supplier relationships. An OSINT review shows what an attacker could learn before contacting you at all.

Related terms and reading

Sources