Investigate a claim or file
Turn your findings into a structured research note.
For beginners
Start with what you have
OSINT means finding and carefully verifying publicly available information through legitimate and safe sources. Without getting lost in complex tools, start with a safe research workflow built for the information you have.
Quick start
What do you have?
You do not need to know a tool name. Just choose the type of information you want to check.
A domain or websiteCheck registration, DNS, certificates, and archive history without interacting with the target.Open this workflow An imageLook for older copies, then check time, location, and context clues.Open this workflow A usernameTreat matching usernames as a lead, not proof that two accounts belong to the same person.Open this workflow A news or social media claimFind the earliest source, check the date, and look for independent support.Open this workflow An IP address or IOCUse defensive intelligence sources to understand context without visiting the target.Open this workflow A CVE or exploit claimCompare the vendor advisory, NVD, KEV or EPSS, and the impact on your environment.Open this workflow
Not sure which one fits? Let the decision tree guide you with a few questions.
In every investigation
Three core research steps
- 01
Define the question
Write what you want to learn in one sentence. Separate the person, place, date, and claim.
- 02
Start with the safest flow
Use open and passive sources first. Do not sign in to suspicious links or run unknown files.
- 03
Check with a second source
Do not trust one result. Note the date, earliest source, and independent evidence that supports it.
Choose by goal
What do you want to do?
Follow a live development
Collect incoming information, verify it, and track its status in one place.
Learn from solved cases
See which methods were used in real examples and why.
Find tools and resources
Browse sources organized by purpose, method, and risk notes.
Your first 10-minute practice
Check one news headline in two sources
Copy the headline, find the earliest source, compare publication dates, and note whether an independent source supports it. Before writing “verified,” record what is still missing.
Open the practice lab