What Is OSINT? Open Source Intelligence From the Target’s Side

On the evening of September 1, 2019, a man in Tokyo allegedly followed a young singer from a train station to her apartment and assaulted her there. The BBC reported the case about a month later, citing Japanese media. According to those reports, the 26-year-old suspect told police how he had found her home. In a selfie she had posted online, a train station was reflected in her pupils, and he matched it using Google Street View. What is OSINT? This case is the uncomfortable answer: open source intelligence, the analysis of public sources.

By his account, he then studied videos she had filmed in her apartment and worked out the floor from the curtains and the angle of the light. She had not posted an address or a street name. No special tool was needed either, going by what he told police. It was enough to look at her public pictures for a long time, very closely, and put the pieces together.

Most explanations of what OSINT is are written for the people doing the research. They list tools and search tricks. This one takes the other side. It covers what open source intelligence actually is, how someone gets from your name to a targeted attack with it, and how you can look up what they would find.

What is OSINT?

The term comes out of the intelligence world. In its OSINT strategy published in March 2024, the US intelligence community defines it as “intelligence derived exclusively from publicly or commercially available information.” That second half matters. Data that can simply be bought counts as an open source as well. In the United States, where people-search sites sell names, addresses and relatives by the record, that is a very large category.

The same strategy calls OSINT the “INT of first resort,” the first place analysts look before they reach for wiretaps or human sources. Germany’s domestic and foreign intelligence services say almost the same thing on their own websites: open information usually sits at the start of the work.

The OSINT meaning has nothing to do with open source software. “Open source” simply means a source anyone can access, and “intelligence” is meant in the spy-agency sense of gathered and evaluated information. So open source intelligence is intelligence work done with material that is already out there.

What counts as out there today is enormous. News archives and court records, yes, but also every public profile, every uploaded photo, every review, every race-results PDF on a running club’s website. Together that makes up your digital footprint. Each trace on its own is usually harmless. It gets interesting when someone lays them side by side.

Reading public sources is legal. Using what you find to follow, harass or defraud a specific person is not, and stalking and fraud laws do not care how public each detail was. A growing number of state privacy laws also reach the companies that compile and sell profiles of people. None of this stops a determined attacker, but it is a line worth knowing about.

Who uses OSINT, and for what

The method is neutral. People use it to solve crimes and to prepare them, and both happen.

The best-known example of the good side is Malaysia Airlines Flight 17, shot down over eastern Ukraine on July 17, 2014, killing 298 people. The research group Bellingcat pieced together the route of an anti-aircraft missile system from photos and videos posted on social media by residents and soldiers. Their conclusion pointed to a Buk launcher of Russia’s 53rd Anti-Aircraft Missile Brigade from Kursk. On May 24, 2018, the international Joint Investigation Team reached the same conclusion and said at its press conference: “Earlier, the investigation collective Bellingcat came up with the same conclusion.” The investigators built their own evidence for court. The public material simply got there first.

Security researchers use OSINT to see how exposed a company looks from the outside. Businesses use it for background checks and due diligence, police for investigations, reporters for verification. And on the other side are scammers, stalkers and extortionists doing exactly the same thing with a different goal.

How public information turns into a targeted attack

If you are the person being researched, this is the part that matters most. Germany’s Federal Office for Information Security, the BSI, puts it plainly on its page about social engineering. Social networks, it writes, give attackers an easy way to collect background information on people “in the run-up to the attack” and to connect the pieces. That information lets them aim the attack more precisely and build trust faster, for instance by mentioning your hobbies, friends or colleagues.

The run-up is the key word. Research leaves no trace on your side. Nobody gets a notification when a stranger reads their profile or types their name into a search engine. You only notice something when the email, the call or the person at the door shows up, and by then they seem remarkably well informed.

The chain behind it is usually unremarkable. It starts with a name and works its way forward.

How attackers check your email address against accounts

One link in that chain deserves a closer look because so few people know about it. Plenty of websites will tell anyone whether an email address has an account.

It happens in three places. At login, a site says “wrong password” instead of “sign-in failed” and so confirms that the address is known. At sign-up, it says the address is already in use. And on the password reset page the reply differs depending on whether an account exists. The Open Worldwide Application Security Project, or OWASP, a nonprofit that publishes security standards for web developers, calls this account enumeration. Its testing guide notes that web applications often reveal when a username exists, “either as a consequence of mis-configuration or as a design decision.” Even response time can give it away, since sending a reset email takes a few hundred milliseconds longer than doing nothing.

For an attacker that is valuable. If they know you have an account with a particular payment app, delivery service or bank, they can write a phishing email that fits it exactly. They also know where to try passwords from old breaches, a technique known as credential stuffing.

You cannot switch this off yourself, the fix belongs to the site owners. OWASP tells them to give the same generic answer every time, along the lines of “If that email address is in our database, we will send you an email to reset your password.” What you can do is make the knowledge less useful. A separate address or alias for each important service is something no stranger can guess, and our piece on disposable email and aliases shows how that works. Unique passwords make old breaches worthless. And with passkeys or a second factor, a stolen password on its own no longer opens the door.

An email from a boss who never sent it

The method behind business email compromise shows what the chain looks like inside a company. The FBI’s Internet Crime Complaint Center, IC3, is the bureau’s central reporting point for online crime. In a public service announcement from September 2024 it counted 305,033 reported incidents worldwide between October 2013 and December 2023, with exposed losses of about $55.5 billion. Exposed losses include attempted as well as actual theft. IC3 says the scam runs through social engineering or computer intrusion, so not every one of those cases began with research in public sources. The figure shows how big the scam is, not how much of it is OSINT.

A German case shows the preparation in unusual detail. The business paper Handelsblatt described it in 2017. On July 5, 2016, at 9:43 a.m., a company bookkeeper received an email from her supposed boss about a confidential acquisition in Asia. Two hours later came the request to wire 998,231 euros to Hong Kong. According to the paper, the attackers had studied the company for months. The forged payment order carried the signatures of two managing directors, probably copied from the public commercial register. The money never left, because the company required two people to sign off and someone called the real boss.

The head of the BSI at the time told the paper that the attackers were well prepared. They knew who in the company could authorize payments and even small details, such as whether colleagues were on first-name terms. German police guidance on this scam lists the usual sources. They include annual reports, the commercial register, brochures and the company website, plus social networks where employees describe their job and share personal details.

The sources a profile is built from

Our OSINT series covers most of these sources one at a time. Here is the map, each with the question of what it can reveal about you.

Google dorks turn an ordinary search into a precise one. Operators like site: and filetype:pdf surface minutes, lists and documents that were never meant for the public but sat open on a server.

Searching yourself online shows what search engines, directories and people-search sites put together about a name. In the US those sites are a business of their own, and the piece explains how to opt out of them.

A reverse image search finds where else a photo appears. Face search engines go further and look for the same face in entirely different pictures.

Metadata hides in photos and documents, often with location, device and author name, and is never shown unless you go looking for it.

With a phone number, a search engine, a messaging app and some old listings are sometimes enough to attach a name. With an IP address it is less than most people fear, usually a provider and a rough region.

Satellite imagery and the position data of planes and ships show how far open data reaches today, all the way to the private jets of famous people. And among public webcams are private cameras whose owners never meant to stream anything.

What you deleted long ago may live on in the Wayback Machine. The web archive keeps old versions of websites, including former contact details and staff lists.

A username you use everywhere ties together accounts you think are separate. One hit with a photo or a real name is enough, and the rest come along with it.

Finally, a data breach check shows which known breaches include your email address. Those same breaches are often where an attacker’s chain begins.

Look at yourself the way a stranger would

The reassuring part of OSINT is that anything a stranger can find about you, you can find too. And you have an advantage, because you know what to look for. An hour is enough for a first pass.

Start with your name in quotation marks, logged out or in a private window. Then run the same search with your city, employer or club. Our guide to searching yourself online has more variations and the main people-search sites.

Next come the pictures. Put the profile photo from your professional network or messaging app into a reverse image search. It often turns up on pages you had forgotten about, linking profiles you would rather keep apart.

Then your email addresses, all of them, including the old ones. A breach check shows where they were exposed. While you are at it, write down which services you use with which address. That is exactly the knowledge attackers piece together, slowly, through login forms.

After that, usernames. Many people have used the same handle for years, on a forum, in a game, on a marketplace. Searching for it often leads to posts you would never have written under your real name.

Finally, look at your own public photos the way the man in Tokyo looked at hers. What is visible in the background, in a window, on a sign, in a reflection? Where needed, strip the metadata before a picture goes online.

The takeaway

What is OSINT, in the end? It sounds like spy work and is mostly patient reading. The intelligence agencies say it themselves: open sources come first. The same holds for attackers. The email that fits a little too well, the call from someone who knows a little too much, both usually start with research you never notice.

Nobody disappears from the internet completely, and that does not have to be the goal. It is enough to know which pieces are lying around and to pick up the most dangerous ones. One address per service, a photo without the house number in the background, an old username deleted: each of these makes the chain shorter. And once you have seen what a stranger would find about you, the next email from your “boss” asking for a quiet wire transfer will surprise you a lot less. How to go about that systematically is the subject of our piece on what OPSEC is.

Frequently asked questions

What is OSINT?

OSINT stands for open source intelligence: information gathered from sources anyone can access without breaking in or holding special rights. That covers websites, news archives, books, public records, social media, photos and videos. The term comes from the intelligence world. The US intelligence community defines it as intelligence derived exclusively from publicly or commercially available information. Today journalists, security researchers and companies use the same method, and so do scammers and stalkers.

What does OSINT mean?

The OSINT meaning has nothing to do with open source software. "Open source" here simply means a source that is openly available, and "intelligence" is used in the spy-agency sense of collected and analyzed information. So OSINT is intelligence work done with material that is already public.

Is OSINT legal?

Reading public information is legal. What you do with it is a different question. Using what you find to follow, harass or defraud a specific person can fall under stalking, harassment or fraud laws, no matter how public each piece was. Companies that collect and sell profiles of people are also increasingly covered by state privacy laws. Public does not mean free for any use.

How do I find out what is online about me?

Take the same steps an attacker would. Search your name in quotation marks while logged out, then add your city or employer. Run your profile photo through a reverse image search. Check every email address you use in a reputable breach checker. Search your old usernames. And look at your public photos the way a stranger would, paying attention to what shows in the background. For most people a first pass takes about an hour.

Can attackers tell which websites my email address is registered on?

Sometimes, yes. Some sites reveal during login, sign-up or password reset whether an account exists for an email address. The security project OWASP calls this account enumeration and tells developers to answer every request the same way. Old data breaches add more, because they often show which service an address was used for. You cannot switch that off, but you can make it much less useful: separate addresses or aliases, unique passwords, passkeys and two-factor sign-in.