Skip to content
Cyber Unboxed
Threat Intelligence

OSINT: Investigating With Nothing but Public Information

Open-source intelligence, or OSINT, is what you can learn without hacking anything: public records, websites, social posts and more.

2 min readBeginner Sep 17, 2026

Explain Like I'm Not a Hacker

It's detective work using nothing but what's already sitting in plain sight, like reading every sign on the street as you walk past.

The 30-second explanation

Everything anyone can legally look up: company websites, public records, domain registrations, social posts, code repositories. Piece enough of it together and it tells you a great deal.

How it works

  1. 1

    1. Question

    Decide exactly what you need to find out.

  2. 2

    2. Collect

    Gather public information from several independent places.

  3. 3

    3. Verify

    Cross-check it to rule out mistakes or planted data.

  4. 4

    4. Report

    Write the findings up with sources attached.

Defenders use open-source intelligence to check a suspicious domain, see who registered it and when, look for other sites on the same server, and read what researchers have already published about a campaign. Attackers use the same public information to plan a targeted phishing attempt, which is why organisations audit their own public footprint too. The real skill is verifying sources, since anything public can just as easily be wrong, outdated, or planted.

Real-world example

An analyst receives a suspicious link. Public domain records show it was registered only days earlier, and a quick search turns up other reports of the same domain used in phishing elsewhere. That's already enough to block it and warn colleagues before anyone clicks.

How to spot it

  • Over-sharing staff

    Public posts that reveal roles, tools and everyday routines.

  • Exposed documents

    Files or repositories that leak internal details they shouldn't.

  • Lookalike domains

    Newly registered names sitting suspiciously close to your own.

  • Single-source claims

    A finding resting on only one unverified page.

What to do

  1. 1Search for your own organisation the way an attacker would, and reduce what turns up.
  2. 2Verify anything you find against at least two independent sources before trusting it.
  3. 3Stay within legal and ethical limits: being public doesn't mean it's free of privacy concerns.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading