OSINT Tools

What OSINT Is and Why Analysts Need It Daily

OSINT (Open-Source Intelligence) is the collection and analysis of publicly available information to produce actionable intelligence. MITRE ATT&CK maps information gathering to T1596 (Search Open Technical Databases) and T1593 (Search Open Websites/Domains).

For SOC analysts, OSINT is a daily operational requirement. Every phishing triage, every suspicious connection in a SIEM, every alert about a domain you’ve never seen — all of these require OSINT validation. A good analyst goes into an investigation knowing which tool answers which question. Combine OSINT findings with MISP for structured threat intel sharing.

OSINT Tool Reference by Category

File and Hash Analysis

Domain and DNS Reconnaissance

IP Address and Network Intelligence

Email Analysis

Credential Leak Monitoring

Social Media and Persona Intelligence

Automated OSINT Platforms

OSINT Triage Workflows

Phishing Domain Investigation

1. Enter the URL into URLScan.io — see the rendered page, loaded resources, redirect chain
2. Check the domain on crt.sh — find all subdomains and certificate issuance dates
3. Query SecurityTrails for historical DNS — when was the domain first seen?
4. Check DomainTools WHOIS — who registered it? How old is the domain?
5. Submit any file downloads to VirusTotal — hash check and sandbox analysis
6. Check Have I Been Pwned — is the targeted email in any breaches?
7. AbuseIPDB — is the hosting IP known for malicious activity?

Expected output: A report containing the domain registration details, hosting infrastructure, active URL state (live/defanged), malware detection rates (if any), and a confidence score for maliciousness.

Malicious IP Investigation

1. IPinfo for geolocation, ASN, and hosting provider
2. GreyNoise for classification (internet noise or targeted?)
3. Shodan for open ports and services on the IP
4. AbuseIPDB for report history
5. VirusTotal (IP tab) — has this IP been associated with malware samples?
6. SpiderFoot — run automated OSINT for deep correlation
7. Passive DNS via SecurityTrails — what domains resolve to this IP?

Expected output: A determination of whether the IP is hostile infrastructure (C2 server, phishing host, scanner) or benign background noise, with supporting evidence.

Credential Leak Assessment

1. Enter the email address on Have I Been Pwned
2. Search the leak context — was it a service breach (company SaaS account) or a paste dump?
3. Check DeHashed for associated passwords (if authorized)
4. Review the breach details — what data was exposed (password, credit card, SSN)?
5. Alert the affected user to reset credentials
6. Monitor for subsequent login attempts using the leaked password (password spray)

Expected output: A list of affected accounts, the data exposed, and recommended actions (password reset, MFA enable, account review).

OSINT Ethics and Operational Security

• Stay within legal boundaries. OSINT means using publicly available data. Do not attempt to access private accounts, exploit vulnerabilities, or engage in social engineering without explicit authorization.
• Use research-only infrastructure. Create separate accounts for OSINT work — do not use your corporate identity on reconnaissance tools. Be aware that Shodan, crt.sh, and VirusTotal track queries.
• Document your sources. Every finding must be traceable to a specific tool query at a specific time. “VirusTotal 3/72 detection on 2026-05-22 at 14:30 UTC” is evidence. “VirusTotal flagged it” is not.
• Be aware of OPSEC. Attackers also use these tools. They monitor crt.sh and Shodan for new infrastructure. They check if their C2 IPs are on blocklists. Your OSINT queries may be visible.

Related

• Kill Chain — covers the kill chain concepts
• Azure Sentinel — detection and response for T1654 techniques
• BloodHound — detection and response for T1087 techniques

Sources

• OSINT Framework
• MITRE ATT&CK T1596
• SANS OSINT Resources
• SpiderFoot Documentation
• Have I Been Pwned API