OSINT for Beginners: Investigate Anyone Online

Open Source Intelligence (OSINT) is the practice of collecting and analyzing information from publicly available sources to produce actionable intelligence. The term originated in military and intelligence communities but has become mainstream as the volume of public data on the internet has exploded.

You might need OSINT skills for entirely legitimate reasons: verifying that someone you met on a dating app is who they claim to be, checking whether a business contact's credentials are genuine, investigating online harassment directed at you or your family, or auditing your own digital footprint before a job search.

What makes OSINT powerful is not any single data point — it is the ability to connect multiple weak signals into a strong conclusion. A username alone tells you little. A username that appears on five platforms, linked to an email that appears in three data breaches, connected to a phone number registered on WhatsApp with a profile photo matching a face found in news articles — that tells a story.

The core OSINT skill is pivoting — using one piece of information to discover another. Every data point is both a finding and a search query for the next step. An email address leads to registered accounts. A username leads to profiles. A profile photo leads to other appearances of that face. A phone number leads to messaging app registrations. Each pivot expands the investigation.

The second core skill is correlation — evaluating whether multiple data points actually refer to the same person or entity. Similar usernames on two platforms might be coincidence (many people use 'john_smith_2024'). But similar usernames + same profile photo + same city mentioned in bios + same email domain = very likely the same person.

Professional investigators maintain a structured workspace: a spreadsheet or mind map tracking every pivot, the source of each data point, and the confidence level of each correlation. Without this discipline, investigations become chaotic and conclusions become unreliable.

OSINT does not require expensive software or hacking skills. The most effective toolkit combines free tools with a few specialized paid services.

For face search, tools like NexID, FaceCheck, and PimEyes convert a photo into a search query. For username enumeration, Sherlock and Maigret check a username across 300-400+ platforms automatically. For email intelligence, services like Holehe check if an email is registered on 120+ platforms, and HIBP reveals breach exposure history. For phone number intelligence, carrier lookup tools identify the operator, line type, and often location.

What transforms these individual tools from novelty searches into real intelligence is the workflow that connects them. Starting from a single photo, a face search might reveal an Instagram profile. That profile's username, when searched across platforms, reveals a GitHub account. That GitHub account's email address, when checked against breach databases, reveals a LinkedIn account. That LinkedIn account confirms the person's real name and employer. Each step adds context and confidence.

The aggregation layer is where NexID differs from single-purpose tools. Rather than manually pivoting between five or six different tools and correlating results in a spreadsheet, an integrated platform runs all searches in parallel and builds the connection map automatically. This is not a replacement for analytical thinking — you still need to evaluate the results — but it dramatically reduces the manual effort of multi-tool pivoting.

Let us walk through a realistic investigation. You receive a connection request on LinkedIn from someone claiming to be a VP of Sales at a well-known tech company. The profile looks professional, but something feels off. Here is how you would verify their identity using OSINT.

Step 1: Save their profile photo and run a face search. If the photo matches a stock photography model or a completely different person's social media, you have your answer immediately. If it matches other profiles with the same name — good, that is consistent.

Step 2: Search their claimed username (from LinkedIn URL) across other platforms. A real VP of Sales probably has a Twitter/X presence, maybe a personal website or Medium blog, and certainly a consistent professional identity across platforms. An impersonator usually has a thin digital footprint — a LinkedIn profile with few connections and little activity.

Step 3: Check their claimed email address. Most companies use predictable email formats (firstname.lastname [at] company.com). If you can guess their work email, check it against breach databases. A real employee's work email likely appears in corporate breaches. A fake email was created recently and has no history.

Step 4: Verify the claim itself. Does the company's actual website list this person? Does their LinkedIn connection network include other verified employees of the company? Do their endorsements come from real people or suspicious accounts?

Step 5: Synthesize. A genuine VP of Sales will have: a face that matches no one else, consistent identity across platforms, an email with years of history, verification through the company's own communications, and a connection network of real colleagues. An impersonator will fail on at least two or three of these checks.

OSINT operates in a legal gray zone that requires personal ethical standards beyond what the law technically permits. Just because information is publicly available does not mean every use of it is appropriate.

Acceptable uses: verifying the identity of someone you are interacting with, checking your own exposure, investigating suspected fraud or harassment directed at you, due diligence on business partners, and journalistic investigations in the public interest.

Unacceptable uses: stalking or harassing someone, doxxing (publishing someone's private information to enable harassment), building databases that profile people by race, religion, or political affiliation, accessing or distributing information obtained through hacking or data breaches (even if the breach data is publicly dumped), and investigating people out of idle curiosity with no legitimate purpose.

A useful test: would you be comfortable explaining your investigation and its purpose to a judge, to the person you investigated, or in a news article? If the answer is no, reconsider whether you should proceed.

Professional OSINT practitioners follow a documented methodology. They record what they searched, when, what they found, and what conclusions they drew. This creates an audit trail that protects them legally and professionally, and ensures that investigations can be reviewed for quality and ethics.

Confirmation bias is the biggest threat to investigation quality. Once you form a hypothesis, your brain filters for evidence that supports it and ignores evidence that contradicts it. The antidote is to actively search for disconfirming evidence. If you think Person A and Person B are the same individual, spend equal time looking for reasons they might not be.

Over-reliance on a single source is the second most common mistake. One tool says the email is registered on Instagram. Does that mean this specific person owns that Instagram account? Not necessarily — the email might have been recycled, the person might have deleted the account, or the registration check might have a false positive. Always cross-reference across at least two independent sources.

Scope creep is the third risk. An investigation that starts as 'verify this LinkedIn profile' can spiral into 'map this person's entire life.' Define your objective before you start, and stop when you have answered your original question. Going further than necessary is ethically questionable and legally risky.

• Confirmation bias: actively search for contradicting evidence.
• Single source reliance: cross-reference across 2+ independent sources.
• Scope creep: define your objective before starting, stop when answered.
• Documentation: record everything — sources, timestamps, conclusions.