Skip to content
Cyber Unboxed
Threat Intelligence

OSINT: Investigating With Nothing but Public Information

Open-source intelligence is what you can find out without hacking anything: public records, websites, social posts and more.

2 min readBeginner Sep 17, 2026

Explain Like I'm Not a Hacker

It is detective work using only what is lying in plain sight, like reading every sign on the street.

The 30-second explanation

Everything anyone can legally look up: company websites, public records, domain registrations, social posts, code repositories. Piece it together and it can tell you a lot.

How it works

  1. 1

    1. Question

    Decide what you need to find out.

  2. 2

    2. Collect

    Gather public information from several places.

  3. 3

    3. Verify

    Cross-check to avoid mistakes or planted data.

  4. 4

    4. Report

    Write up findings with sources.

Defenders use OSINT to check suspicious domains, see who registered them and when, look for other sites on the same server, and read what researchers have published about a campaign. Attackers use the same public information to plan targeted phishing, which is why organisations audit their own public footprint. The skill is in verifying sources, since anything public can also be wrong or planted.

Real-world example

An analyst receives a suspicious link. Public domain records show it was registered only days ago, and a search finds other reports of the same domain used in phishing. That is enough to block it and warn colleagues.

How to spot it

  • Over-sharing staff

    Public posts revealing roles, tools and routines.

  • Exposed documents

    Files or repositories that contain internal details.

  • Lookalike domains

    Newly registered names similar to your own.

  • Single-source claims

    A finding backed by only one unverified page.

What to do

  1. 1Search for your own organisation as an attacker would, and reduce what is exposed.
  2. 2Verify anything you find with at least two independent sources.
  3. 3Keep to legal and ethical limits: public does not mean free of privacy concerns.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading