Lesson 1.2

Who Uses OSINT?

Learning Objectives

Identify the major groups that use OSINT and what each is trying to accomplish
Describe a realistic OSINT workflow for each group
Explain why attackers and defenders use nearly identical techniques
Distinguish legitimate from illegitimate use based on authorization, purpose, and handling of results

One Toolbox, Many Hands

OSINT is dual-use: the same search, the same tool, and the same data can protect an organization or attack it. What separates a penetration tester from a criminal is not the technique. It’s:

Authorization — did someone with the authority to say yes actually say yes?
Purpose — why is the information being collected?
Proportionality — is the depth of research appropriate to the goal?
Handling — what happens to the results afterward?

Keep these four questions in mind as we walk through each group. Each section below follows the same pattern: goal → what they look for → a mini-workflow → output → boundaries.

The workflows below are simplified illustrations. The detailed methodology is in Module 3, techniques in Module 4, and sources in Module 5.

1. Penetration Testers and Red Teams

Goal: Find and demonstrate weaknesses before real attackers do, under a signed agreement.

What they look for:
- Domains, subdomains, and internet-facing services (the “attack surface”)
- Employee names, roles, and email format for authorized phishing simulations
- Technologies in use (from job postings, DNS records, and site fingerprints)
- Leaked credentials or exposed code that could provide a way in
- Physical details (badge designs, building entrances) for authorized physical tests

Mini-workflow: recon for an external pentest of Company X
1. Read the rules of engagement — which domains, IP ranges, and techniques are in scope? Are phishing and physical tests allowed?
2. Enumerate domains and subdomains passively (certificate logs, DNS history).
3. Identify what each subdomain runs (VPN portal? Webmail? Dev server?) using internet-scan search engines.
4. Build an employee list from LinkedIn and the company website; confirm the email format.
5. Check whether company email addresses appear in known breaches.
6. Hand the results to the testing phase: which systems to test first, and which pretexts would be realistic for the phishing simulation.

Output: The reconnaissance section of a pentest report, and a prioritized target list for active testing.

Boundaries: Everything is governed by the written scope. An employee’s personal Instagram or family members are usually out of scope even when the company is in scope (see Module 2).

2. Attackers

Understanding how attackers use OSINT is how defenders learn what to protect.

Types of attackers who rely on OSINT:
- Cybercriminals — ransomware affiliates, business email compromise (BEC) crews, and initial access brokers (criminals who break in and sell that access to others)
- Nation-state groups (often called APTs, advanced persistent threats) — long-term espionage and sabotage
- Scammers and fraudsters — targeting individuals with tailored scams
- Stalkers and harassers — targeting specific people (this is why doxxing is covered in Module 2)

What they look for:
- Who has access to money or sensitive systems (finance, HR, IT admins, executives)
- Who the organization’s vendors and partners are (to impersonate them)
- Timing opportunities (executive travel, new employees, mergers, tax season)
- Personal details that make a message believable or help answer security questions

Mini-workflow: a business email compromise (BEC) setup
1. Identify the CFO and accounts-payable staff from LinkedIn and the company’s “About” page.
2. Find vendors through press releases, vendor case studies, and job postings.
3. Learn the email format and the style of real company emails (signatures, tone) from public documents.
4. Watch social media for the CEO posting about a conference trip.
5. While the CEO is traveling, send accounts payable an urgent “wire this payment to our vendor’s new account” email from a lookalike domain.

Why this matters for defenders: every step used only public information. No hacking was needed until the final email. That’s why reducing exposure (Module 9) and training staff are so important.

Boundaries: None — that’s the problem. Attackers ignore scope, law, and ethics, which is why defenders must assume anything public will be used.

3. Defenders: SOC Analysts, Threat Intelligence, and Attack Surface Teams

Goal: Find what the organization exposes before attackers do, and understand the threats targeting it.

Common defender roles that use OSINT:
- SOC (Security Operations Center) analysts — investigate alerts (Is this IP address known to be malicious? Who registered this suspicious domain?)
- Threat intelligence analysts — track threat actors, their tools, and their infrastructure
- Attack surface management (ASM) teams — continuously inventory internet-facing assets
- Digital risk protection (DRP) teams — watch for brand impersonation, leaked data, and executive threats

What they look for:
- Leaked employee credentials and stealer logs (see Module 6)
- Lookalike or typosquatted domains registered to phish employees or customers
- Fake social media accounts impersonating executives or the brand
- Secrets accidentally pushed to public code repositories
- Forgotten subdomains and exposed services
- Mentions of the organization on criminal forums or ransomware leak sites

Mini-workflow: a weekly exposure check
1. Search certificate transparency logs for newly issued certificates on domains that look like the company’s (e.g., companyx-login.com).
2. Review alerts from a credential-leak monitoring service; force password resets for any confirmed exposures.
3. Run secret scanning across the organization’s public code repositories.
4. Search social platforms for accounts impersonating the CEO; file takedown requests.
5. Compare this week’s internet-facing services with last week’s to spot anything new or unexpected.
6. Report findings and track fixes.

Mini-workflow: pivoting on a phishing email (threat intel)
1. A phishing email links to companyx-sso[.]com.
2. Look up the domain’s registration date, registrar, and hosting IP.
3. Check what other domains are hosted on the same IP or were registered with the same details.
4. Discover five more lookalike domains that haven’t been used yet.
5. Block all six before the next wave of phishing emails arrives.

Output: Blocked domains, reset passwords, takedowns, fixed exposures, and threat reports for leadership.

Boundaries: Defenders focus on their own organization’s assets and on threat actor infrastructure. Researching individual employees’ personal lives is usually inappropriate even for defensive purposes.

4. Journalists and Researchers

Goal: Verify what happened, hold powerful actors accountable, and debunk false claims.

What they look for:
- Photos and videos of events, and proof of where and when they were taken
- Satellite imagery showing changes over time
- Flight and ship tracking data
- Corporate records linking people and companies
- Social media activity of public figures and organizations

Mini-workflow: verifying a viral video
1. Find the earliest upload — is this actually new, or recycled from an older event?
2. Extract keyframes and run reverse image searches.
3. Geolocate: match buildings, signs, road layouts, and terrain to satellite and street-level imagery.
4. Chronolocate: estimate the time from shadows, weather, and other posts from the same place.
5. Cross-check with independent sources (other videos, eyewitness posts, official statements).
6. Publish the findings along with the methodology so others can check the work.

Example organizations: Bellingcat is the best-known civilian open source investigation group; many major newsrooms now have dedicated visual investigation teams.

Output: Published investigations, fact-checks, and evidence used by courts and human rights bodies.

Boundaries: Journalistic ethics, public interest tests, and care for victims and bystanders. Publishing methodology is a hallmark of credible open source journalism.

5. Law Enforcement and Government

Goal: Investigate crimes, find missing people, and support national security decisions.

What they look for:
- Suspects’ public social media activity, photos, and connections
- Evidence people post about their own crimes
- Leads in missing persons cases
- Public information about foreign governments, militaries, and events

Mini-workflow: developing a lead
1. A tip identifies a possible suspect by username.
2. Search for the username across platforms to find linked accounts.
3. Review public posts, photos, and check-ins for evidence and location clues.
4. Document everything with timestamps and preserve it for court (chain of custody, see Module 7).
5. Use the OSINT findings to justify formal legal process (such as a warrant) for non-public data.

Output: Investigative leads, evidence packages, and intelligence reports.

Boundaries: Government agencies operate under laws and internal policies that limit how they collect and keep information about people, especially their own citizens. OSINT often provides the lead; formal legal process is needed for anything non-public.

Example: After the January 6, 2021 Capitol attack, many federal cases cited evidence from participants’ own public posts and tips submitted by online volunteers (see 1.3-why-osint-matters.md).

6. Businesses

Private companies use OSINT for many non-security purposes too.

Business use	What it involves
Due diligence	Researching a company or executive before a merger, investment, or partnership (lawsuits, sanctions, bad press, hidden ownership)
Competitive intelligence	Tracking competitors’ products, hiring, patents, and public statements
Fraud investigation	Checking whether a customer, vendor, or claim is legitimate
Trust and safety	Finding fake accounts, scam networks, and abuse on a platform
Brand protection	Finding counterfeit products and fake websites using the brand
Executive protection / physical security	Monitoring for threats against executives or events (e.g., a security operations center watching for protests near a company event)
Supply chain / third-party risk	Checking whether suppliers have been breached or are financially unstable

Mini-workflow: vendor due diligence
1. Confirm the vendor is a registered business and identify its officers.
2. Search court records for lawsuits and regulatory actions.
3. Search news and breach trackers for past security incidents.
4. Check sanctions lists and adverse media.
5. Summarize risks for the procurement team.

Boundaries: Background checks used for employment, housing, or credit decisions in the US are regulated (the Fair Credit Reporting Act — see Module 2). Competitive intelligence must stay legal; stealing trade secrets is not OSINT.

7. Volunteers and Nonprofits

OSINT has a large volunteer community doing public-interest work.

Trace Labs

A nonprofit that crowdsources OSINT to help find missing people.
Runs Search Party CTFs: roughly four-hour capture-the-flag events where teams gather open source information on real missing persons cases.
Cases come from law enforcement agencies, public missing persons registries, or community submissions, and must involve an explicit or implicit request from law enforcement for public help.
There are no fixed “flags.” Instead, categories of information earn points based on usefulness — for example, identifying a friend’s profile that interacts with the missing person earns a small number of points, while information about the person’s current location can earn far more.
Volunteer analysts review submissions and turn them into intelligence reports for the law enforcement agencies involved.
Participants follow strict rules of conduct, including not contacting the missing person or their family and friends (verify before class against the current Trace Labs participant guide).

Bellingcat Volunteer Community

Volunteers contribute to Bellingcat projects. Since Russia’s 2022 invasion of Ukraine, Bellingcat and its volunteers have geolocated more than 2,500 incidents of civilian harm (February 2022 to December 2025).

Crowdsourced investigations

Groups like Sedition Hunters examined public photos and videos from January 6, 2021 and submitted tips to the FBI.
Crowdsourcing is powerful but risky: amateur investigators have wrongly accused innocent people in past events (covered in Module 7).

Boundaries: Good volunteer programs have clear rules, vet their cases, and route findings to the proper authorities instead of publishing them.

8. Everyday People

Most people do OSINT without calling it that:
- Checking reviews and records before hiring a contractor
- Verifying that an online seller or rental listing is real
- Looking up a date before meeting in person for safety
- Checking whether their own email appears in a data breach

This is worth mentioning to students because it shows OSINT is a life skill, not only a job skill — and because it’s a reminder that anyone can look you up too.

Same Technique, Different Intent

Technique	Pentester	Attacker	Defender	Journalist
Build an employee list from LinkedIn	Targets for an authorized phishing simulation	Targets for real spear phishing	Who needs extra security awareness training	Potential sources to interview
Find subdomains in certificate logs	In-scope systems to test	Systems to break into	Forgotten systems to shut down	Evidence of an unannounced product or project
Geolocate a photo	Identify an office location for an authorized physical test	Find where a target lives	Check whether employee posts reveal sensitive sites	Verify where an event happened
Search breach data for company emails	Show the client their exposure	Try the passwords (illegal)	Force password resets	Report on the scale of a breach

Discussion prompt: in each row, what specifically makes the attacker column wrong? (Answer: no authorization, harmful purpose, and illegal or harmful use of the results.)

Key Terms

Dual-use: A technique or tool that can be used for both beneficial and harmful purposes.
Rules of engagement (RoE): The written agreement that defines what a security tester is allowed to do.
Attack surface: All the points where an attacker could try to get into an organization.
Business email compromise (BEC): A scam where attackers impersonate executives or vendors to trick employees into sending money or data.
Initial access broker (IAB): A criminal who gains access to organizations’ networks and sells that access.
APT (advanced persistent threat): A well-resourced, usually state-backed group conducting long-term operations.
SOC (Security Operations Center): The team that monitors and responds to security alerts.
Attack surface management (ASM): Continuously discovering and monitoring an organization’s internet-facing assets.
Digital risk protection (DRP): Monitoring external sources for brand abuse, leaks, and threats.
Geolocation / chronolocation: Determining where / when a photo or video was taken.
Due diligence: Researching a person or organization before a business decision.

Key Takeaways

OSINT is dual-use: the same techniques serve pentesters, attackers, defenders, journalists, and investigators
Authorization, purpose, proportionality, and handling separate ethical use from abuse
Attackers can prepare a BEC scam using only public information
Defenders use OSINT to find leaks, lookalike domains, and forgotten systems first
Journalists and volunteers (Bellingcat, Trace Labs) use OSINT for accountability and missing persons
Businesses use OSINT for due diligence, fraud, brand protection, and physical security
Assume anything public about you or your organization will eventually be used

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.