OSINT Tools in 2026: The Complete Guide to Open Source Intelligence Investigations

Ten years ago, 'investigating someone online' meant a Google search and maybe a LinkedIn lookup. In 2026, it means a structured Open Source Intelligence (OSINT) workflow that can resolve an anonymous Telegram handle to a real name, tie a fraudulent wire to a specific crypto wallet, geolocate a photo to a specific Miami street corner from the reflection in a window, and reconstruct a subject's decade-long digital footprint across breach corpora, code repositories, marketplaces, and archived pages — using only publicly available data.

OSINT is now the backbone of modern investigations. Law firms use it to find defendants, verify plaintiffs, and locate hidden assets. Corporate security teams use it to monitor executive threats and expose insider fraud. Journalists use it (Bellingcat is the household example) to attribute war crimes. Family offices use it to vet the counterparty on a nine-figure deal. Cybersecurity teams use it every day to attribute the person behind a phishing campaign, a business email compromise (BEC), or an extortion attempt.

This is Cybrvault's 2026 field guide to OSINT and open source intelligence investigations. It's the same framework our Miami OSINT team runs for law firms, executives, and enterprises — the tools, the methodology, the legal guardrails, and what to look for when hiring an investigator. If you'd rather have us run an investigation, jump to Cybrvault OSINT services at the bottom or book a confidential consult.

What is OSINT? (And what it is not.)

OSINT — Open Source Intelligence — is intelligence produced from publicly and lawfully available data. The 'open source' refers to the source of the data, not the software. If a member of the public with an internet connection and the right tradecraft could access it, it qualifies. The category was formalized by the U.S. Director of National Intelligence and is now used across law enforcement, defense, corporate investigations, cyber threat intelligence, journalism, due diligence, and litigation support.

OSINT is NOT hacking. It is not phishing, not credential theft, not password spraying, not exploiting a vulnerability, not accessing a protected system without authorization. The line between OSINT and unauthorized access is legally consequential — see the CFAA section below. A skilled OSINT analyst produces stunning results without ever touching a login page.

Common OSINT sub-disciplines you'll see referenced in 2026:

• SOCMINT — Social Media Intelligence (X/Twitter, LinkedIn, Instagram, TikTok, Facebook, Telegram, Discord, Reddit).
• GEOINT — Geospatial Intelligence (satellite imagery, aerial photography, geolocation of photos and videos).
• HUMINT-adjacent OSINT — conversational reconnaissance in public forums (still OSINT if no pretext is used).
• SIGINT-adjacent OSINT — passive DNS, certificate transparency logs, BGP looking glasses, Shodan/Censys internet scans.
• FININT — public financial records: SEC EDGAR, state corporate registries, court dockets, UCC filings, sanctions lists.
• DARKINT — dark web forum monitoring, marketplace scraping, breach corpus analysis.

The OSINT investigation lifecycle (the six-phase framework we use)

Phase 1 — Define the intelligence requirement

Every real investigation starts with a written question. 'Find everything about John Smith' is not a question — it is an unbounded fishing expedition that produces noise, no legal defensibility, and a bloated invoice. A real intelligence requirement looks like: 'Identify the real name, current address, and employer of the person operating Telegram handle @northborder24 who sent our client a $220k fraudulent wire on July 3.' That framing drives the tool selection, the scope of collection, and the deliverable.

Phase 2 — Collect from open sources

Systematic sweep across search engines, social media, breach corpora, public records, code repositories, image reverse-search engines, DNS/certificate data, dark web forums, and archived versions of the target's historical footprint. Every artifact is captured with source URL, timestamp, and hash.

Phase 3 — Verify and de-duplicate

OSINT lives and dies on verification. There are five John Smiths in Miami with the same birthday. Two of them share a phone number in a scraped dataset that is three years stale. One of them died in 2019. Verification means cross-referencing at least two independent primary sources before an identifier gets promoted from 'candidate' to 'confirmed.' De-duplication removes the same subject appearing across data sets under slightly different aliases.

Phase 4 — Pivot on identifiers

This is where OSINT becomes powerful. An email pivots to a Gravatar avatar, which pivots to a GitHub account, which pivots to a real name in a commit history, which pivots to a personal domain, which pivots to WHOIS data, which pivots to a phone number, which pivots to a Signal account, which pivots to a Telegram handle — closing the loop on the original identifier the client came in with. A single confirmed identifier is a thread that, pulled correctly, unravels the entire persona.

Phase 5 — Analyze in a link graph

Findings get plotted in a link-analysis tool (Maltego, Casefile, i2 Analyst's Notebook, or a custom graph in Neo4j). Nodes are identifiers (people, accounts, domains, wallets, phone numbers, addresses). Edges are relationships. The graph reveals clusters — the co-conspirator you didn't know about, the shell company owned by a relative, the burner phone used to register the fraudulent account.

Phase 6 — Deliver a court-defensible report

For legal, corporate, or law enforcement use, the report must include: the intelligence requirement, the methodology, every source URL, every capture timestamp (in UTC), a hash of every screenshot, the tool versions used, an analyst declaration, and — critically — an explicit statement of what could NOT be verified. If the investigation is going anywhere near a courtroom, a subpoena, or a regulatory filing, this is the phase that determines whether the work is admissible or a $40k paperweight.

The professional OSINT toolkit in 2026

There are thousands of OSINT tools cataloged in resources like the OSINT Framework (osintframework.com), Michael Bazzell's IntelTechniques, and the Bellingcat toolkit. Below is the core stack our Miami analysts actually run for the majority of engagements. Everything is used within the tool's terms of service and applicable law.

Link analysis and automation

• **Maltego** — the industry-standard link analysis platform. Community Edition is free; the CE plus a few Transform Hub subscriptions covers most private-investigator work. Enterprise for volume.
• **SpiderFoot** — open source automated OSINT collector. Point it at a domain, email, or IP and it runs hundreds of modules in parallel.
• **Recon-ng** — modular reconnaissance framework, Metasploit-style CLI, favored for scriptable pipelines.

Username, email, and account resolution

• **Sherlock / Maigret / WhatsMyName** — hunt a username across hundreds of platforms. Maigret is currently the most maintained.
• **Epieos** — reverse-lookup an email or phone number against Google, Skype, and dozens of other public account systems. Excellent for confirming account presence without alerting the target.
• **Hunter.io / Snov.io** — enumerate corporate email address patterns, useful for BEC investigation and pre-litigation locates.
• **OSINT Industries** — commercial account-resolution service, industry favorite for law enforcement and PI work; ties an email or phone to hundreds of consumer platforms.

Breach data and credential exposure

• **Have I Been Pwned (HIBP)** — the ethical baseline for breach exposure. Free, reputable, no personal data returned beyond breach names.
• **DeHashed / IntelX / Snusbase / LeakCheck** — commercial breach-corpus search. Extremely powerful and legally sensitive — use only in engagements where breach data is in scope of the intelligence requirement and permitted by the retainer.
• **Dark web monitoring platforms** — Recorded Future, Flashpoint, KELA, and Cybrvault's in-house monitoring for continuous exposure tracking for enterprise clients.

Search operators and archive tools

• **Google Dorks** — advanced search operators (site:, intitle:, filetype:, inurl:) still the highest-ROI OSINT skill. See our Google Dorking guide.
• **Wayback Machine (archive.org)** — historical page captures, essential for reconstructing what a site said before it was quietly edited.
• **Archive.today** — user-triggered captures that survive DMCA takedowns and rapid page changes.
• **Cachedview** — checks Google Cache, Wayback, and Bing simultaneously for the last cached copy of a page.

Image, video, and geolocation

• **Google Lens / Yandex Images / TinEye / PimEyes** — reverse image search. Yandex remains the strongest on Cyrillic and Eastern European content; PimEyes is the go-to for facial matches (regulated, use ethically).
• **EXIFTool** — extract camera metadata, GPS coordinates, and device fingerprints from image and video files.
• **Google Earth Pro / OpenStreetMap / SunCalc / Bellingcat's toolkit** — cross-reference shadows, sun angles, and terrain features to geolocate a photo without GPS data.
• **InVID / WeVerify** — video forensics for frame extraction, reverse search, and deepfake screening.

Domain, DNS, and infrastructure

• **Whoxy / DomainTools / SecurityTrails** — WHOIS history, passive DNS, and infrastructure pivots for domain-based investigations.
• **crt.sh / Censys / Shodan** — certificate transparency logs and internet-wide scan data. Essential for attributing infrastructure behind phishing kits and BEC operations.
• **urlscan.io / VirusTotal / Any.Run** — safely inspect suspicious URLs and files without executing them locally. See our how to check if a link is safe guide.

Public records and financial intelligence

• **Florida Sunbiz, SEC EDGAR, PACER, state court dockets, county recorder sites** — the primary sources for U.S. legal and financial OSINT. Free.
• **OpenCorporates** — global corporate registry aggregator for beneficial ownership tracing.
• **OFAC sanctions, OpenSanctions, ICIJ Offshore Leaks Database** — sanctions and Panama/Paradise/Pandora leaks for high-risk counterparty vetting.
• **Blockchain explorers (Etherscan, Blockchain.com, Chainalysis Reactor for enterprise)** — trace crypto wallets involved in fraud, extortion, or sanctions evasion.

The OSINT Framework and curated directories

For tools not listed above, three directories cover everything: OSINT Framework (osintframework.com), IntelTechniques Tools (inteltechniques.com/tools), and the Bellingcat Online Investigation Toolkit. Every serious OSINT analyst has all three bookmarked.

OSINT tradecraft: staying invisible while you investigate

The single biggest mistake amateur investigators make is investigating a subject from a device or account that ties back to them. LinkedIn shows profile views. Facebook logs friend-of-friend graph traversals. Twitter/X caches every login IP. Tip your hand once, and the subject deletes evidence, hardens accounts, or lawyers up before you have anything useful. Professional OSINT tradecraft:

• **Segregated infrastructure.** A dedicated OSINT workstation (or VM) with no personal accounts, no cookies, and a clean browser profile per investigation. Whonix, Tails, or a hardened Fedora/Windows Sandbox setup.
• **Non-attributable network.** Commercial VPN with rotating exits, or better, a residential-IP proxy service for platforms that block VPN ranges. Never OSINT from a client's public IP or your firm's office IP.
• **Sockpuppet accounts.** Long-lived, aged social media personas that predate the investigation. Building these correctly is its own tradecraft — a fresh account created the day of the search screams 'investigator.'
• **No interactions.** Read-only. No likes, no follows, no profile views logged (use logged-out or archive views wherever possible), no DMs, no comments. If the tool lets you view without triggering a notification, use that mode.
• **Capture, don't rely on memory.** Full-page screenshots, HAR files, and hash the capture at the moment of collection. Pages disappear.

The legal and ethical guardrails

OSINT is legal in the U.S. — with hard limits. Cross a line and the intelligence becomes inadmissible, and the analyst becomes the defendant. The four laws every OSINT practitioner needs to know cold:

• **Computer Fraud and Abuse Act (CFAA)** — federal criminal statute prohibiting 'access without authorization' or 'exceeding authorized access.' Bypassing a login, scraping past a paywall using stolen credentials, or exploiting an API in a way the provider prohibits can trigger CFAA liability. The Supreme Court's Van Buren decision (2021) narrowed 'exceeds authorized access,' but scraping and ToS violations remain legally contested.
• **Stored Communications Act (SCA)** — prohibits unauthorized access to stored electronic communications. Never touches OSINT if you stay on publicly available data; instantly triggered the moment you access a mailbox, DM inbox, or private channel.
• **Florida Chapter 934 / federal Wiretap Act** — Florida is a two-party consent state for audio recording. Do not record conversations, calls, or voice messages during an OSINT engagement without written legal advice.
• **GDPR / CCPA / FCRA** — if the subject is an EU resident (GDPR), a California resident (CCPA), or the report will be used to make a consumer credit, employment, insurance, or housing decision (FCRA), additional obligations attach. FCRA in particular converts an OSINT report into a 'consumer report' with strict rules; running unlicensed 'background checks' for hiring decisions is a fast path to a class-action lawsuit.

The ethical baseline Cybrvault operates under: legitimate purpose, minimum necessary data, documented client authorization, no pretexting or social engineering during collection, subject notification when legally required, and secure destruction of source data after the engagement's retention period.

How OSINT supports investigations (real-world use cases)

Business email compromise (BEC) attribution

After a BEC event, OSINT is used to trace the attacker's infrastructure — the lookalike domain, the burner phone, the crypto wallet the wire was cashed out to, the sockpuppet LinkedIn profile used to build rapport. See our BEC 2026 playbook for the prevention side; OSINT is the response side.

Pre-litigation and civil discovery support for law firms

Locating a defendant for service of process. Verifying that the opposing party's damages narrative matches their public social media. Finding hidden assets in a divorce or judgment enforcement. Vetting a witness. Documenting a plaintiff's undisclosed injuries or income. See our cybersecurity for lawyers guide for the firm-side security context.

Executive threat monitoring

For Miami family offices, high-net-worth principals, and public-facing executives — continuous monitoring for doxxing, address exposure, family-member impersonation, and pre-attack chatter on Telegram, Discord, and extremist forums. See our personal cybersecurity for Miami business owners guide.

Pre-transaction due diligence

Before signing a nine-figure deal, before hiring a C-suite executive, before onboarding a strategic vendor — a discreet OSINT sweep for undisclosed litigation, sanctions exposure, adverse media, prior identities, or beneficial owners the counterparty didn't mention.

Catfish, impersonation, and reputation attacks

A fake account is impersonating a Miami executive on Instagram to defraud their followers. A romance scammer with 30 identities is targeting a client's elderly parent. A defamatory review campaign is being coordinated across sockpuppet accounts. OSINT resolves the operators behind the accounts and produces the takedown package platforms actually action on.

Dark web exposure monitoring

Continuous monitoring of dark web forums, ransomware leak sites, and initial-access-broker marketplaces for mentions of the client's domain, executives, or data. Early warning is the difference between a controlled response and a Monday-morning ransomware post.

How to become an OSINT investigator

The path most working analysts we hire followed:

1. 1**Build the foundation.** Free courses from SANS (SEC487), IntelTechniques (Michael Bazzell's Open Source Intelligence Techniques book — currently on its 10th edition and the closest thing to a canonical text), Bellingcat's Online Investigations Guide, and TraceLabs CTF events.
2. 2**Get a lab.** Dedicated OSINT VM (Buscador is legacy — most analysts now roll their own Fedora or Windows VM with the Trace Labs OSVM as a starting point). Sockpuppet accounts aged three to twelve months before use.
3. 3**Compete.** TraceLabs runs quarterly Missing Persons CTFs — real, legal OSINT work under supervision. Points on the leaderboard translate directly into hireability.
4. 4**Certify (optional).** SANS GOSI (GIAC Open Source Intelligence) and OSINT Combine's certifications carry weight in corporate and government hiring pipelines. IALEIA and CFE for the fraud-investigator adjacency.
5. 5**Specialize.** OSINT has grown too big for generalists at the senior level. Pick a lane: cyber threat intelligence, financial-crime tracing, human trafficking / missing persons, disinformation, or corporate investigations.

Frequently asked questions

Answers to the questions Miami attorneys, executives, and security leads ask us most often on OSINT engagements.

Cybrvault OSINT services

Cybrvault runs a Miami-based OSINT practice supporting law firms, family offices, corporate security teams, and executives across South Florida and nationwide. Every engagement is scoped, retained, and delivered under NDA, with reports built to hold up in litigation, regulatory filings, and executive decision-making.

What we deliver

• **OSINT investigations** — subject locates, identity resolution, asset discovery, counter-party due diligence, and pre-litigation intelligence for law firms and their clients.
• **BEC and wire-fraud attribution** — post-incident tracing of the attacker's infrastructure, wallets, and identity to support bank recovery, insurance claims, and law-enforcement referral.
• **Executive protection intelligence** — continuous monitoring of doxxing exposure, physical-address leakage, family-member impersonation, and pre-attack chatter for high-net-worth principals.
• **Dark web exposure monitoring** — 24/7 coverage of ransomware leak sites, initial-access-broker marketplaces, and dark web forums for mentions of your organization, executives, or data.
• **Impersonation and takedown packages** — fake-account attribution, takedown packages platforms actually action on, and coordinated multi-platform response.
• **OSINT training for corporate security teams and law firms** — private, on-site or virtual training tailored to your team's caseload and jurisdiction.

How to engage us

OSINT engagements start with a 30-minute confidential consult to scope the intelligence requirement and confirm legal fit. Retainers are typically structured hourly for investigations under 40 hours, and as fixed-fee packages for monitoring engagements. All work is performed under attorney-client privilege where a law firm is the retaining party.

**Book a confidential OSINT consult:** Contact Cybrvault · **Miami cybersecurity services:** /miami/cybersecurity · **OSINT investigations landing page:** /miami/osint · **24/7 SOC and monitoring:** /miami/24-7-monitoring.

Cybrvault is a Miami-based cybersecurity and OSINT firm serving South Florida and clients nationwide. Our analysts hold industry OSINT and cyber-intelligence certifications and operate under strict legal, ethical, and evidentiary standards suitable for use in litigation, regulatory filings, and executive decision-making.