10 top OSINT data sources and how to use them

Open source intelligence (OSINT) is only as strong as the sources behind it. When an investigation stalls, the cause is rarely a lack of analytical skill. More often, the relevant data was held in a source that was never considered or reviewed.

The open source world offers far more than social media, including court dockets, corporate filings, domain records, certificate logs, satellite imagery and community forums. Each category answers a different investigative question, and selecting the right one early can determine whether a case produces a solid lead or reaches a dead end.

This article outlines 10 categories of OSINT data sources and explains how to apply each in a real investigation. It focuses on the sources themselves rather than the tools used to query them. Readers who want hands-on practice can begin with our free OSINT tools and map each one to the corresponding source type below.

Social media platforms are often the richest source of behavioral and relational data available to OSINT investigators. Public profiles on networks such as X, Facebook, Instagram, TikTok, Snapchat, LinkedIn, Telegram and YouTube show who a subject associates with and where they spend time. They also capture what the subject says in their own words.

These platforms provide context that formal records cannot, including tone, affiliations, real-time activity and a visible network of contacts. Some also offer location-based views of public content, such as Snapchat’s Snap Map, which displays publicly shared, geotagged Stories that analysts use to follow protests and other breaking events as they unfold.

To use social media effectively, investigators should pivot on selectors rather than read through feeds. Starting from a confirmed username, an analyst can search other platforms for the same handle or profile photo. Repeated bio wording across accounts offers another useful match. In a threat investigation, a single reused handle can link an anonymous marketplace seller to a personal profile that discloses a home city. Because the Horizon® platform aggregates more than 600 data sources, these cross-platform pivots take place in a single view rather than across dozens of browser tabs.

Public and government records are the most defensible OSINT source because they carry official authority. Court dockets, voter files, property deeds, business licenses, sanctions lists and regulatory filings are collected and published by government agencies, so findings drawn from them can withstand scrutiny in a briefing or a courtroom.

These records provide verified identity anchors, such as a legal name or an address history, and can surface consequential findings like a court judgment or an OFAC sanctions match. Every detail can be traced back to the agency that issued it.

Public records give investigators a way to verify leads that social media can only suggest. When a profile hints at a business relationship, an analyst can consult the relevant court docket or county property record to confirm it. In a due diligence investigation, a single federal PACER filing can reveal a fraud judgment the subject never disclosed.

Business and corporate registries reveal the ownership and structure behind a company, with national registers such as UK Companies House and the SEC’s EDGAR system in the United States recording directors, shareholders, filing histories and registered addresses. OpenCorporates aggregates this kind of data from more than 140 jurisdictions into a single searchable database.

Registries provide the corporate framework of an entity, showing who controls it and when it was formed. They also identify other companies that share the same officers or address, which can help expose shell structures and point toward concealed beneficial owners.

In practice, investigators should treat a registered address or director name as a pivot point, since a single shared address can link a dozen dormant companies to one operator. In a fraud investigation, cross-referencing a director across Companies House filings may reveal a pattern of dissolved firms that suggests deliberate misconduct.

These records connect online infrastructure to the people and organizations behind it. Together, a website’s registration details, historical name servers, mail records and hosting IP address form a technical fingerprint that can tie otherwise separate sites together.

Website domain records provide infrastructure pivots. Even when registrant details are hidden behind a privacy service, a reused name server or common IP block can link a fraudulent site to a wider network, particularly when the registration dates also match.

Investigators often use domain data to expand outward from a single lead. In a phishing investigation, one malicious web domain often shares an IP address with dozens of others built by the same actor. Because shared hosting can place thousands of unrelated sites on one IP, analysts should look for additional overlaps before attributing them to a single operator. Advanced search operators strengthen this work, and ShadowDragon®’s free Dork Assistant helps investigators build precise queries that surface related subdomains and exposed pages.

Certificate transparency logs are public records of the TLS certificates issued by publicly trusted certificate authorities. Since 2018, Chrome has required these certificates to be logged, so services such as crt.sh allow anyone to see which hostnames an organization has secured.

These logs offer visibility into infrastructure that a subject may not publicize. When a company obtains a certificate for a new subdomain, that hostname appears in the log, often before the site goes live, which can expose staging servers and forgotten assets that were never meant to be found.

Investigators should use certificate logs to map an organization’s actual attack surface and to identify infrastructure it hasn’t disclosed. In an incident response engagement, searching crt.sh for a target domain can reveal a “vpn” or “admin” subdomain absent from public listings, which can then feed back into DNS and WHOIS analysis.

Geospatial and satellite imagery place events and claims in the physical world. Free platforms such as Google Earth and Bing Maps provide dated aerial and satellite imagery. Sentinel Hub offers frequently updated but lower-resolution satellite data, which suits tracking larger-scale changes. Street-level photography adds ground-level detail, allowing analysts to confirm signage and building layouts.

This source offers proof of location and evidence of change over time. A dated satellite image can confirm that a structure existed on a given day, and comparing images from different dates can reveal new construction or damage.

Investigators often use imagery to verify or disprove a location claim. When a subject posts an uncaptioned photo, an analyst can match visible proof points in the photo against mapping imagery to identify the exact intersection. Shadow length and direction can also help estimate when the photo was taken. Analysts cross-check imagery providers before reaching a conclusion, since capture dates and resolution vary between platforms.

Breach and leaked-data sets include personally identifiable information exposed in past security incidents. Exposure-check services, such as Have I Been Pwned, allow analysts to verify whether an email address was present in a breach, as well as determine which breaches it was present in, without revealing the contents of the breach itself.

What these sets offer is correlation power. Knowing that an email, username or phone number appeared in the same breach can link accounts that otherwise look unrelated, and can help resolve an identity that social media alone leaves ambiguous. Breach metadata also helps establish timelines, such as when an account existed or when credentials were likely exposed.

Breach data sits in a gray zone of open source intelligence. It is widely circulated, but never meant to be public. Exposure-check services carry the least risk because they confirm presence without revealing contents. Working with raw dumps is a different matter: depending on jurisdiction, it can raise privacy and data protection obligations. Investigators should access breach data only with clear legal authority and organizational approval.

Organizations should treat breach data as an additional correlation layer in defensive operations and fraud investigations, including work to attribute activity to specific actors. If an investigator is working on an account takeover case, they can check to see if a suspect email match was included in the same breach as the victim’s email. Security teams can also verify if their organization’s domains were part of a breach to determine if there are exposed accounts they should know about. Like other facets of OSINT, findings in breach data should be treated as a lead that needs to be supported before it can be used as fact.

News and media archives preserve past reporting, obituaries, press releases and public statements. Resources such as Google News and the Internet Archive help investigators uncover older coverage a subject may prefer to keep out of view, while regional newspaper archives provide access to local reporting.

These archives provide historical context and named associations. A decade-old article can identify a former business partner or reveal a past controversy that shapes the current investigation.

Investigators should use news archives to build background and verify claims about a subject’s history. In a reputational risk investigation, a single archived local report can contradict a subject’s stated employment record. Analysts should also search alternate spellings and translated terms so that foreign-language coverage is not overlooked. ShadowDragon® does not retain data; the platform helps investigators reach public sources and attributes each result to its origin, but does not scrape or store.

Online communities are where subjects often speak most candidly to their peers. Reddit, public Discord servers, niche hobby boards and GitHub host discussions and code that rarely appear on mainstream platforms, while paste sites such as Pastebin collect dumped text that can be just as revealing.

These sources offer insight into unguarded intent and technical detail. An actor planning fraud may share methods openly on a forum, and a developer may leak a credential in a public paste without realizing it.

Investigators should use these communities to assess capability and intent. In a threat assessment, a subject’s post history on a specialist forum can reveal skills and grievances that a polished public profile conceals. Security teams should also monitor paste sites for their organization’s domains and email addresses so that exposed credentials can be identified and reset early. Any access to closed or invite-only communities should follow the same legal and organizational controls that govern dark web research.

Dark web sources include marketplaces and forums reachable through anonymizing networks such as Tor, as well as the leak sites that ransomware groups use to publish stolen data. These venues host stolen data and illicit sales, along with actor communications that never reach the indexed web. In recent years, much of this activity has also moved to Telegram, where cybercriminal channels and groups advertise stolen data and sell network access without the friction of hidden services.

The dark web offers early warning and attribution leads. A company’s data may appear on a leak site before a breach becomes public, and a vendor’s persistent alias can connect dark web activity to an identity on the open web.

Investigators should use dark web sources to detect exposure and identify threat actors, always under strict legal and safety controls. In a brand protection engagement, monitoring leak forums and Telegram channels can surface stolen customer records within hours of their posting. A username reused across a dark web market and a public forum is often the detail that unravels an alias. Analysts should never engage directly with actors without authorization and sound operational security. For a broader view of the tooling that supports this work, see ShadowDragon®’s roundup of the best OSINT tools.

Analysts should evaluate an OSINT source by grading two factors separately: the reliability of the source and the credibility of the specific information it provides. This approach has been standard practice for decades under the Admiralty System, also known as the NATO System, which is codified in NATO doctrine AJP-2.1 and taught by the SANS Institute for cyber threat intelligence work.

The system grades information on two axes. Source reliability runs from A, completely reliable, to F, reliability cannot be judged. Information credibility runs from 1, confirmed by other independent sources, to 6, truth cannot be judged. A federal court filing might rate A1, while an anonymous forum post making the same claim might rate F3 until it is corroborated.

Investigators should assign a grade before acting on any finding. Even a reliable source can carry uncorroborated information that requires a second source to confirm. This is why the 10 categories above work best in combination. A claim from a forum might begin at C3, but once a public record and a dated satellite image confirm it, its credibility rating can rise to C1.

No single source can resolve a full investigation. Social media reveals behavior, records establish identity, infrastructure supports attribution and imagery confirms location, so the core skill lies in knowing which source answers the question at hand.

The U.S. Intelligence Community underscores the strategic importance of this discipline in its 2024 open source strategy:

“[Open source intelligence] is vital to the IC’s mission, providing unique intelligence value and enabling all other intelligence collection disciplines.”

Office of the Director of National Intelligence and CIA, IC OSINT Strategy 2024-2026, March 2024.

Breadth is essential. Because no category stands on its own, effective analysis depends on combining sources until a conclusion holds.

This is where aggregation becomes critical. Checking more than 600 sources manually is slow and prone to error, and every missed source is a potential missed lead. Horizon® Identity brings these categories into a single query, so a selector confirmed on social media can pivot directly into public records and domain data without the analyst leaving the workspace.

Knowing the sources is only half the work, and investigations are won by reaching them quickly and pivoting between them without losing the thread. To see how one unified workspace brings these categories together, request a demo of the Horizon® platform and watch one selector move across every source type.