Automated Osint Tool For Corporate Domain Profiling — Complete Documentation & Simulation

Overview & System Context

Automated Osint Tool For Corporate Domain Profiling: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~9504 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Cyber threat intelligence (CTI) is a part of cybersecurity that focuses on collecting, analyzing, and sharing information about potential or existing cyber threats. It gives organizations the information needed to predict, prevent, and respond to cyberattacks, enabling them to understand attackers’ behavior, tactics, and the vulnerabilities they exploit. Sources of cyber threat intelligence include open-source data, social media, operational and technical intelligence, device log files, forensic analysis, internet traffic, as well as data from the dark web and deep web. Modern CTI programs stand out from just using raw security data because they combine technical monitoring, outside intelligence sources, and analysis methods to prepare specific and useful assessments about cyber threats aimed at particular organizations or business sectors. Analytical interpretation gives context to attackers’ actions, capabilities, and intentions, helping organizations set priorities and allocate security resources effectively. When companies base decisions on intelligence and analysis, they can act proactively instead of just reacting to security incidents, stopping breaches before they happen. This approach has become increasingly important in recent years, as IBM estimates that exploiting vulnerabilities is the most common way companies are breached, making up 47% of all attacks. The COVID-19 pandemic and the rise in remote work have also contributed to increased vulnerability to threats, making corporate data more exposed. Due to growing threats on the one hand, and increasing analytical demands on the other, many companies have decided in recent years to outsource their threat analytics tasks to a managed security service provider (MSSP). Cyber threat analytics has also become an important component of modern Security Operations Centers (SOCs), where threat intelligence data is used to enrich alerts, identify malicious infrastructure, and support incident response and threat hunting activities.

Tactical: The most technical level, focused on immediate detection and response. Tactical intelligence consists of specific indicators of compromise (IOCs): IP addresses, domain names, file hashes, malware signatures, and similar artifacts. Security operations teams use these indicators to identify and block threats in real time through SIEM rules, firewall policies, and endpoint detection systems. Operational: Focused on understanding adversary behavior and campaigns. Operational intelligence analyzes who the threat actors are, their tactics, techniques, and procedures (TTPs), infrastructure patterns, motivations, and ongoing campaigns. This level helps security teams anticipate how attacks unfold, recognize adversary tradecraft, and understand the broader context behind specific incidents. Sources include incident response findings, malware analysis, threat actor profiling, security vendor reporting, and intelligence from industry sharing groups and government advisories. Strategic: Tailored for non-technical audiences, particularly executives and board members. Strategic intelligence addresses high-level business risk: which threat actors target the organization's sector, geopolitical factors affecting the threat landscape, long-term trends, and the potential business impact of cyber threats. Delivered through reports, briefings, and risk assessments, it helps leadership prioritize security investments and understand how cyber risk aligns with organizational objectives. Technical threat analysis focuses on machine-readable indicators of compromise (IoCs): malicious IP addresses, domain names, file hashes, and command-and-control (C2) servers or infrastructure. This enables automated detection and response. While the conventional distinction is between strategic, tactical, and operational analytics, some large organizations often define technical threat analytics as a separate (fourth) category essential for Security Operations Centers (SOCs). Some threat analytics platforms also distinguish between indicator-based analytics and behavior-based analytics. Indicator-based analytics focuses on specific technical artifacts: malicious IP addresses, file hashes, etc. Behavior-based analytics analyzes attackers’ tactics and techniques to detect threats that may change their infrastructure or indicators over time.

Evidence-based: To be useful, threat intelligence must be gathered through proper evidence-gathering methods. For example, analyzing malware can help generate threat intelligence. Utility: Threat intelligence should positively impact a security incident by providing useful information. It must offer clear context and data about specific behaviors and methods. Actionable: For information to be considered threat intelligence, it must lead to action. This is what distinguishes intelligence from mere data. Cybersecurity researchers also highlight other factors for good threat intelligence, such as accuracy, completeness, timeliness, compatibility, and relevance to the environment where it will be used.

Gives organizations, agencies or other entities, the ability to develop a proactive and robust cybersecurity posture and to bolster overall risk management and cybersecurity policies and responses. Drives momentum toward a proactive cybersecurity posture that is predictive, not simply reactive after a cyber attack. It provides context and insights about active attacks and potential threats to aid decision making. It prevents data breaches from exposing sensitive information, thus preventing data loss. Reduces costs. Since data breaches are costly, reducing the risk of data breaches helps save money. It provides organizations with guidance on implementing security measures to prevent future attacks. Enables sharing of knowledge, skills and experiences among the cybersecurity community and system stakeholders. It helps to more easily and better identify risks and threats, as well as delivery mechanisms, indicators of compromise across the infrastructure, and potential specific actors and motivators. Helps in the detection of attacks during and before these stages. Provides indicators of actions taken during each stage of the attack. Communicates threat surfaces, attack vectors and malicious activities directed to both information technology and operational technology platforms. Serves as a fact-based repository of data on successful and failed cyberattacks. Provides indicators for computer emergency response teams and incident response groups. Threat analytics helps improve threat detection mechanisms by identifying attackers’ methods and behavioral patterns that are not yet detected by automated security monitoring systems.

Figure 1: 13 Best OSINT (Open Source Intelligence) Tools for 2025 [UPDATED] Attribution is the process of identifying who conducted a cyber attack: the individual actors, organized groups, or nation-state sponsors behind an intrusion. In threat intelligence, attribution helps organizations understand adversary intent, prioritize defenses, anticipate future targeting, and inform strategic decisions. It also supports law enforcement investigations and policy responses. Attribution relies on multiple evidence types: technical indicators (infrastructure, malware code), behavioral analysis (tactics, techniques, and operational tradecraft), linguistic artifacts, targeting patterns (victim selection and geopolitical alignment), and intelligence from human sources or signals intelligence. However, attribution is inherently difficult and often remains probabilistic rather than definitive. Attackers routinely employ obfuscation techniques: using proxy infrastructure, VPNs, compromised intermediary systems, and stolen or leased tools. Advanced threat actors deliberately plant false flags by mimicking the TTPs, language, or infrastructure patterns of other groups to misdirect attribution efforts. As a result, different threat intelligence vendors take varying approaches to attribution. Some explicitly attribute threat groups to specific nation-states or sponsoring organizations based on their analysis and confidence thresholds. Others intentionally avoid geopolitical attribution, instead documenting only observable, undisputable facts, such as language artifacts in malware, shared infrastructure, or technical capabilities, and tracking adversary clusters by neutral designators. Attribution assessments are typically expressed with varying levels of confidence (low, medium, high) rather than certainty, and erroneous conclusions can have diplomatic, legal, or strategic consequences.

Sharing of "classified and declassified cyber threat indicators in possession of the federal government with private entities, nonfederal government agencies, or state, tribal, or local governments"; Sharing of "unclassified indicators with the public"; Sharing of "information with entities under cybersecurity threats to prevent or mitigate adverse effects"; Sharing of "cybersecurity best practices with attention to the challenges faced by small businesses." In 2016, the U.S. government agency National Institute of Standards and Technology (NIST) issued a publication (NIST SP 800–150) which further outlined the necessity for Cyber Threat Information Sharing as well as a framework for implementation. In addition to the United States, the exchange of real-time information on cyber threats is coordinated through international and industry organizations, such as Information Sharing and Analysis Centers (ISACs), which facilitate cooperation among companies in critical infrastructure sectors, including finance, energy, and transport.

Semantic Visions is a Prague-based Czech open-source intelligence (OSINT) and data-analytics company that analyzes online media to surface early-warning signals about risk and emerging trends for corporate and public-sector clients. The company's system applies automated language technologies alongside multilingual analysis to structure news and other open data into entities, events and relationships, with typical uses including supply-chain risk monitoring, ESG and compliance-oriented media monitoring, and the tracking of online disinformation narratives. The platform converts unstructured, multilingual reporting into structured indicators for real-time monitoring and historical context, supporting applications such as operational resilience, third-party due diligence and the study of information operations.

Supply-chain and logistics risk monitoring. Used for tracking incidents that can disrupt maritime and overland flows, with outputs framed around alerts and dashboards used by operators and shippers. Reported capabilities include mapping from local incidents to affected facilities/companies for operational awareness. Multi-tier supplier visibility (forwarding & logistics). Applied to identify risks beyond the first tier—e.g., events affecting upstream suppliers or critical nodes that matter to freight forwarders and their customers—supporting earlier detection and mitigation. ESG/sustainability event tracking for corporates and forwarders. Used to surface ESG-relevant developments at the company level (e.g., incidents, controversies) pulled from global media, informing sustainability assessment and benchmarking in transport and logistics. Monitoring online disinformation and propaganda. Involves detecting and analyzing narratives tied to geopolitical events and malign influence campaigns, including recognition via the US–UK Tech Challenge to Combat Disinformation.

Figure 2: OSINT Tools for Professionals: Mastering Intelligence Telegram (also known as Telegram Messenger) is a Russian-Emirati cloud-based, cross-platform social media and instant messaging (IM) service. It launched for iOS on 14 August 2013 and Android on 20 October 2013. It allows users to exchange messages, share media and files, and hold private and group voice or video calls as well as public livestreams. It is available for Android, iOS, Windows, macOS, Linux, Wear OS, watchOS and web browsers. Telegram offers end-to-end encryption in voice and video calls, and optionally in private chats if both participants use a mobile device. Telegram also has social networking features, allowing users to post stories, create public groups with up to 200,000 members, and share one-way updates to unlimited audiences in so-called channels. Telegram was founded in 2013 by Pavel and Nikolai Durov. Its servers are distributed worldwide with several data centers, and its headquarters are in Dubai, United Arab Emirates. It was the most downloaded app worldwide in January 2021, with a billion downloads globally as of late August 2021. As of 2024, registration to Telegram requires either a phone number and a smartphone or one of a limited number of non-fungible tokens (NFTs) issued in 2022. As of March 2025, Telegram has more than 1 billion monthly active users, with India as the country with the most users.

On 3 August 2026, Telegram became unavailable for download from the iPhone and iPad App Store. The removal lasted several hours, during which people who had already installed Telegram could continue using it. Telegram subsequently announced that the application had returned to the store. An Apple spokesperson said that the company's review had found content violating its strict guidelines against child sexual abuse material (CSAM). Apple said that Telegram was restored on the same day after its developer removed the content and banned the user who had posted it. Apple did not publicly give further details about the original report, the location of the material on Telegram, or why the entire application was removed before Telegram was contacted. Telegram criticized Apple's decision to remove the entire application because of material posted by one user. Telegram spokesperson Remi Vaughn said Apple had been wrong to disrupt legitimate communication by the service's users over the actions of a single person. Responding to Apple's explanation on X, Telegram questioned whether Apple would apply the same standard equally to all other applications in the App Store. Telegram also linked to its safety overview, which states that the service removes many groups, channels, and pieces of content that violate its terms of service. Telegram said it had blocked more than 337,900 groups and channels associated with CSAM during 2026 by the time of the incident. That figure has not been independently audited. Epic Games chief executive Tim Sweeney questioned how large-scale communication services could operate if a single user's illegal post was sufficient for an entire application to be removed. He also questioned whether Apple would apply the same standard to its own iMessage service. On 4 August, Telegram founder Pavel Durov alleged that the prohibited material had been deliberately placed in a public group by a person engaged in what he called "takedown extortion". According to Durov, such attackers demand payment from the administrators of online communities and threaten to plant illegal material and report it to application-store operators if payment is refused.

Durov said the person responsible for the incident had inserted AI-modified illegal material by editing an older message in an active group. He said this made the material difficult for ordinary group members to notice and report. Durov also criticized Apple, saying it removed Telegram before contacting the company. He argued that the decision created a systemic risk for any application hosting user-generated content, because coordinated attackers could attempt to cause the removal of legitimate applications or online communities by planting prohibited material. Apple did not confirm Durov's account of the incident.

To use Telegram, a user must sign up with their phone number or an anonymous +888 number purchased from the Fragment blockchain platform. Changing the phone number in the app will automatically reassign the user's account to that number without exporting data or notifying their contacts. Phone numbers are hidden by default, with only a user's contacts able to see them. Sign-ups can be done only on an Android or iOS device. Messages users send and receive are tied to their numbers and custom usernames, not the device. Telegram content is synced between users' logged-in devices automatically through cloud storage, except for device-specific secret chats. By default, any account that is inactive for 6 months is deleted, but the period can be shortened or extended up to 18 months. Telegram allows groups, bots and channels with a verified social media or Wikipedia page to be verified, but not individual user accounts. Messages can contain formatted text, media, files up to 2 GB (4 GB with Premium), locations, and audio or video messages recorded in-app. Telegram messages in private chats can be edited for up to 48 hours; an "edited" icon indicates changes. Messages may also be deleted for both sides without a trace. Users may delete messages and whole chats for both themselves and other participants. Chats can be exported to preserve them via Telegram's Desktop client, but the saved data cannot be imported back into the user's account. Users can import chat history, including both messages and media, from WhatsApp, Line, and KakaoTalk due to data portability, making a new chat to hold the messages or adding them to an existing one. As users can be logged into many devices at once, starting to type a message on one of them will create a "cloud draft" that syncs with others, so that typing can be started on a phone and finished on a laptop, for example. Any message can be translated by opening the context menu. Premium users can translate a whole chat with one click. Users can hide the translate button for messages written in specific languages.

Reactions can be used to respond to a message with emoji. Premium users have access to more reaction choices and can leave more reactions per message. Reactions are always on in private chats and can be enabled by admins in groups and channels. Specific reactions can be allowed or excluded. Reaction emoji play an animation with special effects. Users can also send stickers, which can be static, animated or video. Sticker packs are made by Telegram designers as well as regular users and can be shared via links. They use the WebP or WebM format and do not require special software to create or upload. Some stickers feature full-screen effects that play out when first sent or when tapped. Users can schedule messages to send at a particular time or when their conversation partner comes online, as well as choose to send a message "without sound" without a notification. Messages from private chats can be forwarded, with an option to hide the original sender's identity or to hide captions from media messages. Forwarded messages also maintain reply formatting, able to show which messages in a thread are replying to others. Any user can also send a message to a special "Saved Messages" chat as a form of bookmarking them. The contents of the chat are only visible to the user.

Chats can be sorted into folders to organize them with preset options like "Unread" and "Muted" or custom separations such as "Work" and "Family". Premium users have the ability to set any chat folder as the default screen in the app while regular users will always see the full chat list when first opening the app. Users have the option to start a one-on-one, end-to-end-encrypted "Secret Chat", which remains accessible only on the device on which it started and self-destructs upon logging out. Secret Chats restrict screenshotting by Android devices and warn when one is taken on an iOS device, while also hiding the chat contents from the final image. Secret Chats support perfect forward secrecy and switch encryption keys after a key has been used 100 times or a week has passed. Secret Chats are available only on Android, iOS, and macOS clients.

Both in Secret and regular chats, messages can self-destruct after they are read, disappearing for all parties after a period set by the user, ranging from one day to one year. Figure 3: Application & Usability of OSINT and AI Integration for Automating AML ... In April 2021, the Payments 2.0 upgrade enabled bot payments within any chat, using third-party services such as Sberbank, Tranzoo, Payme, CLICK, LiqPay and ECOMMPAY to process the credit card information. Bots are also commonly used for businesses to communicate with customers as the bot APIs integrate with communication platforms so that Telegram messages can be sent and received in an omnichannelinbox. These platforms also enable businesses to add Telegram chat widget to their websites and gives them the option to automate conversations or let human agents reply. Examples of platforms providing Telegram bot integration include respond.io, Manychat and Trengo. In February 2018, Telegram launched its social login feature, Telegram Login. It features a website widget that can be embedded into websites, allowing users to sign into a third party website with their Telegram account. The gateway sends the user's Telegram name, username, and profile picture to the website owner, while the user's phone number remains hidden. The gateway is integrated with a bot, which is linked with the developer's specific website domain. In June 2021, an update introduced a new bot menu where users can browse and send commands while in a chat with a bot. In April 2022, bots gained support for customized interfaces and inline page loading. Interfaces can be adjusted to match the app's theme even if it changes while interacting with the bot. In October 2024, Telegram added increased messaging limits for bots, allowing bots to send up to 1000 messages per second to their users. Messages beyond the free limit of 30 per second are paid for using Telegram Stars. Telegram introduced affiliate programs in December 2024 that allow developers to create an affiliate program for their bot or mini app. Any Telegram user can join the affiliate program and be rewarded for referring others to the bot or mini app by receiving a commission from purchases made by the people they referred.

People can use their Telegram accounts to author articles on Telegraph – a minimalistic text editor and publisher. While articles on Telegraph can be published anonymously, tying them to one's account allows one to check their view count and edit them later. Telegraph natively supports Instant View, a feature which lets users read full articles in the chat with no load time and without opening an external browser. When an article is first published, the URL is generated automatically from its title. Non-Latin characters are transliterated, spaces are replaced with hyphens, and the date of publication is added to the address. For example, an article titled "Telegraph (blog platform)" published on 17 November would receive the URL /Telegraph-blog-platform-11-17. Text formatting options are also minimal: two levels of headings, single-level lists, bold, italics, quotes, and hyperlinks are supported. Authors could upload images and videos to the page, with a limit of 5 MB, however, it has been disabled since September 2024. When an author adds links to YouTube, Vimeo, or Twitter, the service allows you to embed their content directly in the article. In February 2018, Telegram launched their social login feature to its users, named Telegram Login. It features a website widget that could be embedded into websites, allowing users to sign into a third party website with their Telegram account. The gateway sends users' Telegram name, username, and profile picture to the website owner, while users' phone number remains hidden. The gateway is integrated with a bot, which is linked with the developer's specific website domain. In July 2018, Telegram introduced their online authorization and identity-management system, Telegram Passport, for platforms that require real-life identification. It asks users to upload their own official documents such as passport, identity card, driver license, etc. When an online service requires such identification documents and verification, it forwards the information to the platform with the user's permission. Telegram stated that it does not have access to the data, while the platform will share the information only with the authorized recipient. However, the service was criticised for being vulnerable to online brute-force attacks. In December 2020, Telegram launched a Bugs and Suggestions platform, where users can submit bug reports and suggestion cards for new features. Others can then vote and comment on the cards. In October 2024, Telegram launched a verification platform, called Telegram Gateway, allowing third-party services to authenticate their users by sending verification codes via Telegram.

For encrypted chats (branded as Secret Chats), Telegram uses a custom-built symmetric encryption scheme called MTProto. The protocol was developed by Nikolai Durov and other developers at Telegram and, as of version 2.0, is based on 256-bit symmetric AES encryption, 2048-bit RSA encryption and Diffie–Hellman key exchange. MTProto 1.0 was deprecated in favor of MTProto 2.0 in December 2017, which was deployed in Telegram clients as of v4.6. Version 2.0 was proven formally correct in December 2020 by a team from the University of Udine, Italy. The team reviewed the protocol after realizing that they could only find in-depth verifications done of version 1.0, where most criticisms were levied. They used ProVerif, a verifier based on the symbolic Dolev-Yao model. In the published paper, they "provide a fully automated proof of the soundness of MTProto 2.0’s protocols for authentication, normal chat, end-to-end encrypted chat, and re-keying mechanisms with respect to several security properties, including authentication, integrity, confidentiality and perfect forward secrecy...MTProto 2.0 is assumed to be a perfect authenticated encryption scheme (IND-CCA and INT-CTXT)." However, the team also stated that because all communication, including plaintext and ciphertext, passes through Telegram servers, and because the server is responsible for choosing Diffie–Hellman parameters, the "server should not be considered as trusted." They also concluded that a man-in-the-middle attack is possible if users fail to check the fingerprints of their shared keys. Finally, they qualified their conclusion with the caveat that "properties need to be formally proved in order to deem MTProto 2.0 definitely secure. This proof cannot be done in a symbolic model like ProVerif's, but it can be achieved in a computational model, using tools like CryptoVerif or EasyCrypt." In 2017, in an attempt to monetize Telegram without advertising, the company began the development of a blockchain platform dubbed either "The Open Network" or "Telegram Open Network" (TON) and its native cryptocurrency "Gram". The project was announced in mid-December 2017 and its 132-page technical paper became available in January 2018. The codebase behind TON was developed by Pavel Durov's brother Nikolai Durov, the core developer of Telegram's MTProto protocol. In January 2018, a 23-page white paper and a detailed 132-page technical paper for TON blockchain became available. Durov planned to power TON with the existing Telegram user base, and turn it into the largest blockchain and a platform for apps and services akin to a decentralized WeChat, Google Play, and App Store. Besides, the TON had the potential to become a decentralized alternative to Visa and MasterCard due to its ability to scale and support millions of transactions per second. In January and February 2018, the company ran a private sale of futures contracts for Grams, raising around $1.7 billion. No public offering took place. The development of TON took place in a completely isolated manner, and the release was postponed several times. The test network was launched in January 2019. The launch of the TON main network was scheduled for 31 October. On 30 October, the U.S. Securities and Exchange Commission obtained a temporary restrictive order to prevent the distribution of Grams to initial purchasers; the regulator considered the legal scheme employed by Telegram as an unregistered securities offering with initial buyers acting as underwriters. The judge hearing the Telegram v. SEC case, P. Kevin Castel, ultimately agreed with the SEC's argument and kept the restrictions on Gram distribution in force. The ban applied to non-U.S.-based purchasers as well, because Telegram could not prevent the re-sale of Grams to U.S. citizens on a secondary market, as the anonymity of users was one of the key features of TON. Following that, Durov announced the end of Telegram's active involvement with TON. On 26 June, the judge approved the settlement between Telegram and SEC. The company agreed to pay an $18.5 million penalty and return $1.22 billion to Gram purchasers. In March 2021, Telegram launched a bonds offering to cover the debt and fund further growth of the app.

In 2016, cryptography experts criticized how, unless modified, Telegram's default general security model stores all contacts, messages and media together with their decryption keys on its servers continuously and does not enable end-to-end encryption for messages. Durov has argued that this is because it helps to avoid third-party unsecured backups, and to allow users to access messages and files from any device. Criticisms were also aimed at Telegram's use of a custom-designed encryption protocol. In December 2020, a study titled "Automated Symbolic Verification of Telegram's MTProto 2.0" was published, confirming the security of the updated MTProto 2.0 and reviewing it while pointing out several theoretical vulnerabilities. The paper provides "fully automated proof of the soundness of MTProto 2.0's authentication, normal chat, end-to-end encrypted chat, and re-keying mechanisms with respect to several security properties, including authentication, integrity, confidentiality and perfect forward secrecy" and "proves the formal correctness of MTProto 2.0". This partially addresses the concern about the lack of scrutiny while confirming the formal security of the protocol's latest version. As of 2014, the desktop clients, excluding the macOS client, do not feature options for end-to-end encrypted messages. When the user assigns a local password in the desktop application, data is also locally encrypted. Telegram has defended the lack of ubiquitous end-to-end encryption by saying that online-backups that do not use client-side encryption are "the most secure solution currently possible". Security researcher Moxie Marlinspike, founder of the competing Signal messenger, and commenters on Hacker News criticized a 2013 contest to break its cryptography for being rigged or framed in Telegram's favor and said that Telegram's statements on the value of these contests as proof of the cryptography's quality are misleading.

This was because the cryptography contest could not be won even with completely broken algorithms such as MD2 (hash function) used as key stream extractor, and primitives such as the Dual EC DRBG that is known to be backdoored. Telegram has been blocked temporarily or permanently by some governments including Iran, China, Brazil, and Pakistan. The Russian government blocked Telegram for several years before lifting the ban in 2020. The company's founder has said he wants the app to have an anti-censorship tool for Iran and China similar to the app's role in fighting censorship in Russia. On 19 April 2024, Apple removed Telegram from the App Store in China. In September 2024, Ukraine banned the usage of Telegram by government officials, military personnel, and key workers on official devices, citing fears of Russian espionage.

The National Security and Defense Council of Ukraine enforced the restrictions following evidence reported to them by Kyrylo Budanov, showing Russia's ability to access messages and user data on the platform. Andriy Kovalenko, head of the security council's centre on countering disinformation, clarified that the ban was limited to official devices and did not extend to personal phones. In February 2026, Russia restricted Telegram, as officials said the platform failed to protect personal data and curb criminal content. Durov responded that Telegram remained committed to protecting freedom of speech and user privacy, and accused Russian authorities of directing users toward a state-backed platform, presumably Max. Over the summer of 2026, the share of active Russian-language channels posting links to Max doubled, reaching about one in fifty by August.

Telegram was the main subject surrounding the 2019 Puerto Rico riots that ended up in the resignation of then-Governor Ricardo Rosselló. Hundreds of pages of a group chat between Rosselló and members of his staff were leaked. The messages were considered vulgar, racist, and homophobic, with members of the chat discussing how they would use the media to target potential political opponents.

On 24 August 2024, Pavel Durov, who is both a French and UAE citizen, was arrested in France by French authorities. On 28 August he was charged with a wide array of crimes, including complicity in managing an online platform to enable illegal transactions; complicity in crimes such as enabling the distribution of child sexual abuse material; drug trafficking and fraud; and refusal to cooperate with law enforcement authorities. Durov posted bail of five million Euros, was barred from leaving France, and was released on condition he report to a French police station twice weekly. The case would be handled by a special magistrate with investigative and prosecutorial powers.

In June 2026, the Government of India temporarily blocked access to Telegram ahead of a re-conducted National Eligibility-cum-Entrance Test (NEET) examination, citing concerns that the platform had been used to distribute leaked examination papers. Telegram challenged the restriction before the Delhi High Court, arguing that the ban would affect millions of legitimate users while doing little to prevent examination fraud. Telegram CEO Pavel Durov criticized the decision, saying that the company had removed hundreds of channels associated with leaked examination materials and scams in India. At the time of the restriction, Telegram reported having more than 150 million active users in India. In October 2026, 404 Media reported that a letter included in US federal court records showed Telegram had provided US authorities with a user's account ID, phone number and IP address, along with the time of the account's last login. The letter, dated 4 September 2026, described the disclosure as voluntary and stated that Telegram was not conceding that it was subject to US jurisdiction or that the request had been properly served. The filing containing the letter was submitted to the court on 15 October 2026.

Type a domain name into a browser and you get a website. Run the right checks against that same domain and you get something else entirely: who owns it, where it's hosted, what email infrastructure sits behind it, which subdomains were never supposed to be public, and sometimes what it looked like before someone quietly tried to clean it up. I'm not going to walk you through fifty tools and call it a day. What actually matters is the order you check things in, because each result tells you what to look at next. That sequence is the difference between a useful domain investigation and an afternoon of randomly poking at WHOIS records.

This is the same recon methodology I'd run for bug bounty reconnaissance, SOC triage, or a threat-intel workup, laid out step by step, with a worked example and the OPSEC and legal boundaries most guides conveniently skip. Domain OSINT is building a profile of a domain using only publicly available data. No exploitation, no unauthorized access, just careful reading of what's already exposed.

It matters because attack surfaces are rarely found through a single scan. They show up when you chain small, unremarkable facts together: a WHOIS record that matches another domain, a subdomain nobody decommissioned, a cached page still showing an internal tool. Security teams lean on this for attack surface management and to understand their own exposure. Bug bounty hunters use it to find the one asset nobody else is testing. Journalists and fraud investigators use it to tie a scam site back to whoever's actually running it.

WHOIS is the registration record attached to a domain: who registered it, through which registrar, and when. Creation date. A domain registered three days ago and already running a "bank login" page is about as close to a guaranteed phishing tell as you'll find. Age is one of the cheapest, most reliable signals in domain triage, and it costs nothing to check first. 2. System Architecture & Core Working Principles Registrar and nameservers. These tend to repeat across domains run by the same operator. Worth remembering, because it becomes useful later when you're trying to connect properties that don't look related on the surface.

Status codes. Flags like clientHold or pendingDelete tell you whether a domain is active, suspended, or quietly on its way out. Privacy redaction (mostly GDPR-driven at this point) means you'll rarely see a registrant's name or email anymore. That's where historical WHOIS earns its keep, pre-redaction snapshots sometimes still have an old email address or organization name that current lookups won't show you.

Since the implementation of GDPR in 2018, public WHOIS records have been systematically redacted. In most domain investigations, queries for registrant contact details will return blank fields or generic privacy proxy addresses. As Chris Morris explains in the DomainIntel guide on WHOIS redaction , while this often stalls novice researchers, it is a routine baseline for experienced investigators rather than the end of the line.

For scenarios where disclosure of non-public registrant data is legally justified, ICANN provides a formal channel: the Registration Data Request Service (RDRS) . This platform aggregates disclosure requests and routes them to participating registrars through a single interface. Originally established as a pilot program in November 2023, the RDRS transitioned to a permanent, ongoing service following the conclusion of its pilot phase in November 2025.

Filing a request through the service is a formal administrative process, not a quick lookup. According to the ICANN Registration Data Policy , registrars must acknowledge receipt of a standard request within two business days and provide a substantive response within 30 calendar days of that acknowledgement. Although a policy update in May 2026 introduced an urgent 24-hour response pathway for cases involving child exploitation, threats to life, or critical infrastructure protection, it requires a certified Authenticated Requestor. ICANN is currently developing the supporting authentication framework through its Law Enforcement Authentication Input Group (LEAIG), convened in June 2026 with participation from organizations including Interpol and the FBI. Until that work is complete, the urgent pathway is not yet available for general use.

Even when RDRS is available, investigators must manage expectations. The official ICANN RDRS Two-Year Pilot Summary Report shows that of the more than 3,700 requests submitted, only 26% were approved, while 55% were denied (the remaining 19% were partially approved or involved data already public). Registrars reject requests that fail to demonstrate a clear legal basis, such as trademark infringement or an active law enforcement subpoena. For general threat modeling, RDRS is rarely a viable option.

Because waiting up to 30 days for a disclosure request that has a high probability of denial is inefficient, investigators do not pause their work. As detailed in the core DomainIntel methodology , they continue with passive, correlation-based techniques. Analyzing active DNS configurations, tracking historical WHOIS archives, parsing Certificate Transparency logs, querying passive DNS databases, and correlating shared infrastructure elements regularly produce attribution far faster than waiting on administrative disclosure processes.

Do not treat RDRS as your default step. The high denial rate means filing a disclosure request without a concrete legal claim is almost always a waste of time. While you wait for a response, focus on infrastructure correlations. Mapping certificate reuse, historical WHOIS records, and passive DNS history is not only faster but often yields the owner's true footprint without alerting them to your investigation.

If RDRS is not viable or your request is denied, you must pivot to passive, correlation-based techniques. The workflow continues by looking at DNS records, historical WHOIS archives, Certificate Transparency logs, passive DNS datasets, archived web pages, and infrastructure footprints to link the domain to other assets. If WHOIS tells you who owns the domain, DNS tells you what it's actually doing day to day.

This step gets skipped constantly, but it's a quick read on how seriously an organization actually takes its own infrastructure. SPF lists which servers are allowed to send mail for the domain. DKIM signs outgoing mail cryptographically so the receiver can tell if it was altered in transit. DMARC decides what happens when SPF or DKIM fails, none just monitors, quarantine sends it to spam, reject blocks it outright.

A domain with no DMARC record, or one that's been sitting on p=none for years, is meaningfully easier to spoof. That matters whether you're auditing your own organization or trying to gauge how convincing a phishing campaign against a target domain could be. Every publicly trusted SSL certificate gets logged permanently in a Certificate Transparency (CT) log , and that log is searchable. Since most subdomains eventually pick up an SSL cert at some point, CT logs are one of the highest-yield ways to find them.

This is usually where the forgotten infrastructure shows up, staging., dev-api., oldvpn., internal-test., subdomains nobody remembered to retire, often running software that's years behind whatever hardening got applied to production. I've seen a single staging subdomain undo an otherwise solid security posture more than once. The practical move: pull every certificate ever issued for the root domain, extract the Subject Alternative Names, and you've got a subdomain list built entirely from public records. No active scanning, no brute-forcing required.

Websites change constantly. What they used to say doesn't disappear, though, it just moves to an archive. The Internet Archive's Wayback Machine stores snapshots going back decades. For an investigation, that opens up access to pages that have since been deleted (old staff directories, old pricing, old admin panels), documents that were briefly public before someone pulled them, and earlier versions of a site that reveal a rebrand, an ownership change, or a pivot nobody talks about anymore.

For threat intel work specifically, comparing a current site against its own archived history is often how a compromised or defaced page gets caught in the first place. The diff tells the story before anyone has to. Misconfigured cloud storage, an open S3 bucket, an exposed blob container, is one of the most common and most damaging exposure types out there, simply because the contents are usually internal by intent and public only by accident.

What turns up tends to be backup files, internal documents, source code dumps, configuration files with credentials sitting in plain text. The investigation step here is fairly narrow: search bucket-naming conventions tied to the organization (company name, product name, common suffixes like -backup or -prod ) against public bucket indexes, then check permissions on anything that resolves.

Organizations rarely run just one property, and they rarely bother spinning up a brand-new analytics or ad account for every site they launch. Shared identifiers like a Google Analytics ID ( G-XXXXXXXXXX ), an old Universal Analytics ID ( UA-XXXXXX-X ), or an AdSense publisher ID ( ca-pub-XXXXXXXXXX ) sitting in page source can link domains that otherwise look completely unrelated. This is often exactly how fraud investigators tie a network of scam sites back to one operator, or how a security team discovers an unsanctioned "shadow" property their own marketing team quietly stood up.

Search engines index a lot more than the polished, intended-for-public pages. Targeted search operators surface what got indexed but was never meant to be found: This regularly turns up exposed backups, internal logs, misconfigured directory listings, and documents that got uploaded without anyone realizing a crawler would find them. It costs nothing and needs no tooling beyond a search bar, which is exactly why it still works in 2026.

Beyond just finding subdomains, certificate metadata is its own research lead. Issuer, validity window, and certificate reuse across IPs can connect infrastructure with no obvious DNS relationship, particularly useful when an organization is running services on IPs or domains that aren't formally linked anywhere public. A DNS zone transfer (AXFR) exists to sync records between an organization's own authoritative nameservers. When a nameserver is misconfigured to allow transfers from anyone, the entire internal DNS zone, every subdomain, mail server, internal hostname on record, becomes visible in a single request.

3. Software Implementation, Frameworks & Protocols It's an old, well-documented misconfiguration. It still shows up often enough that checking for it stays on every serious recon checklist. The last step ties the domain back to actual people. Breach databases can surface email addresses, usernames, and exposed credentials tied to accounts registered under the domain, which is useful for understanding how exposed an organization's staff already are, separate from anything wrong with the domain itself.

Have I Been Pwned is the standard, broadly trusted starting point, though it only confirms whether an account was exposed rather than handing over raw breach contents. Take a hypothetical domain, shadowcorp-portal.io , that surfaced during a bug bounty scope review (similar to the Operation VIPER-GHOST case file ).

WHOIS shows it was registered eleven days ago through a budget registrar, already worth flagging. DNS resolves to a shared hosting IP also serving four unrelated domains, which could be shared infrastructure or just coincidence. CT logs reveal staging.shadowcorp-portal.io and api-v1.shadowcorp-portal.io , neither linked anywhere from the main site. The Wayback Machine shows the staging subdomain had a snapshot six months back displaying an internal login page with a default Apache error visible in the background, which is a pretty strong sign it was never properly locked down. And tracking ID correlation matches the same Google Analytics ID to two other domains registered by the same operator in the same week.

None of that proves anything by itself. Stack it together, though, and it builds a defensible profile, and it tells a bug bounty hunter exactly which subdomain to start testing first. Running these checks isn't entirely risk-free for the person doing the investigating, either. As detailed in our upcoming Operation Iron-Atlas case file, maintaining attribution security is key.

Use a dedicated lookup environment. WHOIS and DNS queries can expose your own IP to the target's infrastructure or upstream resolver logs, so route through a VPN or a sandboxed environment when the investigation is sensitive. Don't authenticate with personal accounts, use a separate, non-attributable email for anything requiring sign-up, especially breach lookup services or paid OSINT platforms. Mind rate limits and terms of service; aggressive automated queries against WHOIS servers or search engines can get an IP blocked, and in some jurisdictions can cross into territory that matters for a formal investigation. And log your methodology, not just your findings, if this work ever needs to hold up in an incident report or legal context, how each fact was obtained matters almost as much as the fact itself.

Everything covered here relies on publicly available information. No credential guessing, no exploitation, no accessing systems without authorization. That distinction is the entire line between OSINT and an offense, and it's worth taking seriously. A few boundaries worth stating plainly: finding an exposed cloud bucket is legal to observe, but downloading or exfiltrating its contents without authorization is not. A successful zone transfer or an open directory listing is a misconfiguration worth reporting, not an invitation to keep exploring. If you're working under a bug bounty program, stay inside its defined scope even when recon turns up something interesting just outside it. And if you're investigating on behalf of a client or employer, get written authorization before any step that goes beyond passive lookups.

OSINT's value comes precisely from staying on the public side of that line. Cross it, even with good intentions, and it changes both your legal exposure and the credibility of anything you find. Building a profile of a domain, ownership, infrastructure, history, exposure, using only publicly available data. WHOIS, almost always. It's the fastest way to get a read on domain age and registrar, which frames how suspicious or routine everything else turns out to be.

Certificate Transparency logs. Every issued SSL cert gets publicly logged, and most subdomains pick one up eventually. Yes, as long as it stays within publicly available data and passive observation. It crosses into illegal territory the moment it involves unauthorized access, credential use, or exfiltrating non-public data. They show how exposed a domain is to email spoofing, whether you're assessing your own organization's defenses or sizing up how convincing an attack against a target domain could be.

A mix of free, purpose-built lookups rather than one all-in-one platform: WHOIS through ICANN Lookup or DomainTools, DNS through SecurityTrails or DNSdumpster, subdomains through crt.sh or Censys, history through archive.today. The same set of tools linked throughout this guide, basically. Domain OSINT is a manual investigation technique. ASM is the broader, often continuous practice of discovering and monitoring everything an organization exposes externally. Domain OSINT is one of the core methods ASM platforms automate at scale.

This workflow reflects a sequence built and refined through hands-on OSINT casework, meant to be run by hand rather than just understood in theory. Welcome to the VisualNotes community! We've sent a welcome email to your inbox with exclusive resources and tips. Check your email for your welcome message and start exploring our visual study guides! This repository contains a collection of Open Source Intelligence (OSINT) frameworks designed for various investigative purposes. These frameworks serve as step-by-step guides to help analysts efficiently gather, analyze, and synthesize open-source data to derive actionable intelligence.

Frameworks Included: General OSINT Framework: A comprehensive approach for gathering intelligence across multiple domains, from corporate investigations to threat analysis. It utilizes a wide range of tools and techniques to help researchers uncover critical information. Cyber Intelligence Framework: Specifically tailored for cybersecurity analysts, this framework focuses on identifying and mitigating digital threats. It covers methodologies for examining digital footprints, identifying vulnerabilities, and tracking threat actors.

Fortune 500 Company Framework: A specialized framework for gathering intelligence about Fortune 500 companies. It includes tools and techniques for evaluating company financials, leadership, market presence, cyber security, and public perception. Social Media & Public Perception Framework: This framework is aimed at analyzing social media content and online mentions to gain insights into public sentiment and reputational risks associated with individuals, companies, or products.

Geopolitical Analysis Framework: A focused framework for gathering open-source intelligence on geopolitical events, players, and trends. It integrates a variety of tools to track international relations, conflicts, and emerging threats. Financial & Corporate Health Framework: Designed for analysts focused on assessing the financial stability and health of corporations, with an emphasis on SEC filings, stock market data, and economic indicators.

4. Practical Deployment, Analysis & Case Studies Each framework in this repository is structured into clear, actionable steps, starting from data collection to analysis, and includes links to specific OSINT tools that can be used for each task. Why Use These Frameworks? Efficiency: These frameworks streamline the OSINT process by guiding you through a structured investigative approach. Comprehensiveness: Each framework covers multiple intelligence sources and tools to ensure you capture relevant data from every angle. Customization: These frameworks can be tailored to fit specific investigative needs, whether you're conducting a corporate investigation, monitoring cybersecurity threats, or analyzing public sentiment. By utilizing these frameworks, you'll gain a deeper understanding of various targets, uncover hidden connections, and produce actionable intelligence that can drive decision-making, improve security measures, and inform strategic planning.

Contributing Contributions are welcome! Feel free to fork the repository and submit pull requests for enhancements, additional frameworks, or new tools and techniques. This repository contains OSINT frameworks for various investigative purposes, including cybersecurity, corporate analysis, and geopolitical research. Each framework provides step-by-step guidance and links to essential tools, helping analysts efficiently gather and analyze open-source intelligence for actionable insights.

The most important change brought by AI to OSINT may not be better search. It may be the ability to turn a sequence of investigative tasks into a continuous, automated pipeline. A researcher can already search public profiles, identify organisations, retrieve professional roles, compare accounts, map relationships and summarise findings. What changes when those operations are chained together and executed automatically across hundreds of people? The distinction matters because the underlying information may remain public while the nature of the operation changes substantially. The material examined by ProjectOSINT describes an Iranian-nexus actor that, according to Anthropic, used Claude as part of an automated system to profile hundreds of people in Israel, the United States and the Jewish diaspora from an existing target list. The system collected, correlated and synthesised publicly available information. Anthropic also reports broader cases in which AI systems were used to orchestrate reconnaissance, exploitation and data exfiltration, while humans retained decisions such as target selection and use of the resulting intelligence.

For an OSINT practitioner, the useful question is therefore not simply whether AI can automate research. It is how to recognise what an automated workflow is actually doing. A common mistake is to focus on the model: which LLM was used, how capable it was, whether it operated autonomously. These stages should not be treated as rigid technical categories. They are an analytical framework for understanding how an operation changes as information moves through it.

The crucial point is that automation can connect stages that, when performed manually, would normally involve separate searches, decisions and checks. Collection is the familiar starting point of OSINT: retrieving information from publicly accessible sources. For a person, this might include professional profiles, institutional biographies, public social accounts, company records, conference appearances or other openly available material.

A name, username, organisation, email address, domain or another entity may initiate the search. Do not treat “the web” as one source. Record the platforms, registries, websites, archives or datasets involved. Searching for information about one entity is operationally different from feeding hundreds of predetermined names into a system.

A researcher performing individual searches is different from a workflow that accepts a list and processes every entry automatically. This last distinction is increasingly important. Automation changes the economics of collection even when it does not change the underlying accessibility of the information.

A name alone may reveal little. An enrichment process attempts to attach additional attributes to it. It may subsequently identify a professional position, employer, public accounts, organisational affiliations, conference appearances and other associated entities. The methodological question is no longer simply “Did the system find information?” It becomes: Two people can have the same name. An old professional biography may no longer be current. A social account may belong to someone else. A company record may concern another legal entity with a similar name.

If an automated system finds an apparently relevant account, document or organisation, the association should remain provisional until corroborating evidence supports it. Correlation is where public information begins to acquire substantially greater analytical value. Imagine that separate sources establish that a person has a particular professional role, works for an organisation, has participated in a public event and appears in material associated with other individuals.

This is why the distinction between public and private information is insufficient for evaluating an OSINT workflow. The relevant capability may lie not in discovering a hidden fact but in connecting numerous visible ones. In a relationship graph, two nodes connected by a line can look authoritative. But the visual connection is only as strong as the evidence behind it.

Those relationships have different evidentiary meanings. A system that converts all of them into identical graph edges hides precisely the distinction an analyst needs to preserve. 5. Performance Evaluation & Extended Technical Observations A structured profile can combine identity, role, affiliations, relationships and activity into a single analytical object.

Producing one profile manually imposes costs: researcher time, searches, comparison, note-taking and synthesis. A pipeline capable of processing hundreds of predetermined individuals changes that constraint. The source material describes exactly this concern: AI-assisted workflows can reduce the human effort required to collect, correlate and synthesise information about large numbers of people.

Is the subject already predetermined? There is a meaningful difference between investigating an event and receiving a list of people to profile. Is the output structured around individuals? A collection of search results is not the same thing as a dossier. Does the system infer relationships or characteristics? Inference introduces another layer of uncertainty beyond retrieved facts.

Can the process operate at scale without equivalent growth in human review? If 500 profiles can be generated with roughly the same human oversight previously required for a handful, automation has altered the nature of the capability. A profile created for historical research, journalistic verification or defensive threat analysis may use some of the same public sources as a profile created to support surveillance or an operation against a person.

This means an OSINT assessment should document not only inputs and processing but, where evidence permits, the intended use of outputs. If evidence for that final stage is absent, say so. Do not infer targeting merely because profiling exists. When encountering an AI-based investigative system, do not begin by asking whether it is “autonomous”. That label compresses too many different behaviours into one word.

This produces a much more useful picture than a percentage claiming that an operation is “90% autonomous” or “mostly AI-driven”. The meaningful issue is where human judgement remains in the pipeline and where it has been delegated . Every significant assertion should remain traceable to its source. If a generated dossier states that a person works for an organisation, the analyst should be able to identify the evidence supporting that statement.

Automated systems must not silently collapse similar names, accounts or organisations into a single identity. High-confidence matching requires corroborating attributes rather than superficial similarity. “Person A is listed as an employee of Organisation B” and “Person A is influential within Organisation B” are different types of statements. One may be directly evidenced; the other may be an analytical judgement.

An effective pipeline should preserve that distinction instead of presenting both as equivalent facts. Traditional OSINT discussions often concentrate on access: can this information legally and technically be obtained from an open source? An operation that would require a researcher to spend hours on each subject may become capable of processing hundreds of subjects through the same sequence of searches and correlations.

The source material frames this as an increase in scale available to each human operator rather than simply an increase in machine “intelligence”. If the first three grow dramatically while the fourth remains almost unchanged, the system may generate more intelligence products while simultaneously increasing the opportunity for attribution errors, false correlations and unsupported inference.

The public availability of an individual piece of information tells us something about access. It does not, by itself, resolve questions about aggregation, profiling, purpose or risk. A professional biography may have been published so that someone can understand a person’s role. A conference programme exists to identify speakers. A corporate registry serves a transparency function.

An automated system can extract those separate fragments from their original contexts and combine them into something none of the individual sources contained: a structured representation of a person and their relationships. What does it collect, how does it connect the evidence, what does it infer, how many people can it process, where does human verification occur, and what is the resulting profile used for? AI does not need to discover secret information to change intelligence work. Automating the path from public data to structured profiles can be consequential enough.

The challenge for OSINT is therefore not simply learning how to automate more research. It is learning how to preserve provenance, identity resolution, evidentiary distinctions and human judgement when automation makes research possible at a scale that manual workflows rarely allowed. Maria Cattini is an Italian journalist with a background in research, source verification and information analysis. She trained in Open Source Intelligence at ASRIE in Rome and applies OSINT methods to fact-checking and digital investigations. She is the editor-in-chief of Vintage Italian Fashion, a magazine registered with the Court of L'Aquila, and the founder of Coondivido.it, the Italian-language project dedicated to OSINT, AI and cybersecurity. Her work also covers institutional communication, transparency and anti-corruption. On Project Osint she explains OSINT, artificial intelligence and digital security to non-technical readers.

The Stalkerware Market Hides in Plain Sight. OSINT Can Map It — but Detection Is Only Half the Problem Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Cyber%20threat%20intelligence • https://en.wikipedia.org/wiki/Semantic%20Visions • https://en.wikipedia.org/wiki/Telegram%20%28software%29 • https://www.visualnotes.tech/blog/how-to-investigate-a-domain-osint-workflow • https://github.com/jwbizz08/OSINT-Frameworks • https://projectosint.com/automated-osint-intelligence-pipeline-guide/ • https://osint-ui.com/en/blog/domain-osint