Resource library + OSINT field manual

A target type such as username, email, domain, image, IP, company, or location

Start with a domain name, choose the Domain Name branch, then move through WHOIS, certificate, archive, and technology lookups while logging each source separately.

1. 01

   Write the research question before opening OSINT Framework. Start with: A target type such as username, email, domain, image, IP, company, or location.

2. 02

   Choose the branch or category that matches the identifier you actually possess; do not browse randomly for a person.

3. 03

   Shortlist two or three relevant tools and note whether each is an original data source, an index, or another directory.

4. 04

   Open the underlying source directly and test the same fact with an independent source before treating it as corroborated.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. OSINT Framework is a lead source unless the underlying record itself is authoritative.

A research category or missing capability

If a case needs vessel tracking, search the repository for maritime or transportation resources, compare the listed tools, then open the primary source rather than treating the directory itself as evidence.

1. 01

   Write the research question before opening Awesome OSINT. Start with: A research category or missing capability.

2. 02

   Choose the branch or category that matches the identifier you actually possess; do not browse randomly for a person.

3. 03

   Shortlist two or three relevant tools and note whether each is an original data source, an index, or another directory.

4. 04

   Open the underlying source directly and test the same fact with an independent source before treating it as corroborated.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Awesome OSINT is a lead source unless the underlying record itself is authoritative.

A Linux workstation and an investigation category

Use the category index to identify username tools, review each project's repository before installation, then test only against identifiers you are authorized to research.

1. 01

   Write the research question before opening Awesome OSINT Arsenal. Start with: A Linux workstation and an investigation category.

2. 02

   Choose the branch or category that matches the identifier you actually possess; do not browse randomly for a person.

3. 03

   Shortlist two or three relevant tools and note whether each is an original data source, an index, or another directory.

4. 04

   Open the underlying source directly and test the same fact with an independent source before treating it as corroborated.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Awesome OSINT Arsenal is a lead source unless the underlying record itself is authoritative.

An investigation question involving images, maps, people, companies, transport, archives, or conflict

For a geolocation problem, open the Maps & Satellites section, select street-view and satellite sources, then document which visual landmarks support or contradict the proposed location.

1. 01

   Write the research question before opening Bellingcat Online Investigation Toolkit. Start with: An investigation question involving images, maps, people, companies, transport, archives, or conflict.

2. 02

   Choose the branch or category that matches the identifier you actually possess; do not browse randomly for a person.

3. 03

   Shortlist two or three relevant tools and note whether each is an original data source, an index, or another directory.

4. 04

   Open the underlying source directly and test the same fact with an independent source before treating it as corroborated.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Bellingcat Online Investigation Toolkit is a lead source unless the underlying record itself is authoritative.

A domain, IP, email, username, organization, or other authorized seed

Create a passive scan for an organization domain, disable modules that would make active requests if the target is not yours, then review the relationship graph and validate every high-value finding at the original source.

1. 01

   Create a case/workspace for one defined question and seed it with A domain, IP, email, username, organization, or other authorized seed.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in SpiderFoot; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. SpiderFoot is a lead source unless the underlying record itself is authoritative.

A seed entity such as a domain, organization, person, email, or crypto address

Place a company domain on a graph, run passive transforms for DNS and public company data, separate generated leads from verified nodes, and attach source URLs to the facts you keep.

1. 01

   Create a case/workspace for one defined question and seed it with A seed entity such as a domain, organization, person, email, or crypto address.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in Maltego; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Maltego is a lead source unless the underlying record itself is authoritative.

Authorized domains, organizations, contacts, or locations

Create a workspace for your own organization, add the corporate domain, choose passive discovery modules, store results in the workspace database, and export only findings you manually validate.

1. 01

   Create a case/workspace for one defined question and seed it with Authorized domains, organizations, contacts, or locations.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in Recon-ng; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Recon-ng is a lead source unless the underlying record itself is authoritative.

A domain you are authorized to research

Run a passive search against your organization's domain using supported public data sources, review discovered emails and subdomains, then verify them directly before treating them as current.

1. 01

   Create a case/workspace for one defined question and seed it with A domain you are authorized to research.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in theHarvester; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. theHarvester is a lead source unless the underlying record itself is authoritative.

A defined identifier or investigative problem

Use the search-tools pages to pivot from a known username into search engines and public profiles, then preserve direct source links rather than citing the aggregator.

1. 01

   Write the research question before opening IntelTechniques. Start with: A defined identifier or investigative problem.

2. 02

   Choose the branch or category that matches the identifier you actually possess; do not browse randomly for a person.

3. 03

   Shortlist two or three relevant tools and note whether each is an original data source, an index, or another directory.

4. 04

   Open the underlying source directly and test the same fact with an independent source before treating it as corroborated.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. IntelTechniques is a lead source unless the underlying record itself is authoritative.

A research question and public identifiers

Create a case with a public identifier, let the service suggest pivots, and manually inspect source provenance before incorporating any correlation into a report.

Status note: Availability and feature set may change.

1. 01

   Create a case/workspace for one defined question and seed it with A research question and public identifiers.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in Cylect.io; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Cylect.io is a lead source unless the underlying record itself is authoritative.

A self-hosted OSINT workflow or agentic research need

Confirm which OpenOSINT project or implementation you intend to use, inspect its repository and data handling, then test on non-sensitive public identifiers before production use.

Status note: No single canonical project is assumed by CTI.

1. 01

   Create a case/workspace for one defined question and seed it with A self-hosted OSINT workflow or agentic research need.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in OpenOSINT; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. OpenOSINT is a lead source unless the underlying record itself is authoritative.

A collection of entities and public-source relationships

Import a CSV of organizations and domains, add publicly documented relationships, run supported collectors, and keep analyst-added facts visually separate from automated suggestions.

1. 01

   Create a case/workspace for one defined question and seed it with A collection of entities and public-source relationships.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in LinkScope; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. LinkScope is a lead source unless the underlying record itself is authoritative.

A licensed corpus, investigation, or intelligence project

Define the case scope, ingest only authorized datasets, use entity extraction to surface connections, and require analysts to open the underlying documents before reaching conclusions.

1. 01

   Create a governed case with a defined purpose, authorized users, retention period, and permitted datasets. Starting input: A licensed corpus, investigation, or intelligence project.

2. 02

   Ingest or query only sources allowed by the organization's license, law, policy, and investigation mandate.

3. 03

   Use Sintelix's correlation, graph, search, or model features to generate leads, while preserving lineage back to the original record.

4. 04

   Require human review for consequential identity, risk, or relationship findings and document why an analyst accepted or rejected automated suggestions.

5. 05

   Export an audit-ready result containing source references, analytical limits, access controls, and correction/retention decisions.

A licensed investigation with lawful public-data targets

Create a case, begin with a verified public identifier, run only permitted data-source connectors, and document each source and retention decision before exporting findings.

1. 01

   Create a governed case with a defined purpose, authorized users, retention period, and permitted datasets. Starting input: A licensed investigation with lawful public-data targets.

2. 02

   Ingest or query only sources allowed by the organization's license, law, policy, and investigation mandate.

3. 03

   Use Social Links's correlation, graph, search, or model features to generate leads, while preserving lineage back to the original record.

4. 04

   Require human review for consequential identity, risk, or relationship findings and document why an analyst accepted or rejected automated suggestions.

5. 05

   Export an audit-ready result containing source references, analytical limits, access controls, and correction/retention decisions.

A licensed public-source monitoring or investigative use case

Define approved keywords and geographies, collect public-source results, review false positives manually, and preserve the original publication context for consequential claims.

1. 01

   Create a governed case with a defined purpose, authorized users, retention period, and permitted datasets. Starting input: A licensed public-source monitoring or investigative use case.

2. 02

   Ingest or query only sources allowed by the organization's license, law, policy, and investigation mandate.

3. 03

   Use Babel Street's correlation, graph, search, or model features to generate leads, while preserving lineage back to the original record.

4. 04

   Require human review for consequential identity, risk, or relationship findings and document why an analyst accepted or rejected automated suggestions.

5. 05

   Export an audit-ready result containing source references, analytical limits, access controls, and correction/retention decisions.

A licensed risk, security, or public-source intelligence case

Set a narrowly defined research objective, configure approved open-source collections, review model-generated indicators as leads, and escalate only after human verification.

1. 01

   Create a governed case with a defined purpose, authorized users, retention period, and permitted datasets. Starting input: A licensed risk, security, or public-source intelligence case.

2. 02

   Ingest or query only sources allowed by the organization's license, law, policy, and investigation mandate.

3. 03

   Use Fivecast's correlation, graph, search, or model features to generate leads, while preserving lineage back to the original record.

4. 04

   Require human review for consequential identity, risk, or relationship findings and document why an analyst accepted or rejected automated suggestions.

5. 05

   Export an audit-ready result containing source references, analytical limits, access controls, and correction/retention decisions.

Authorized institutional datasets and a governed investigative question

Model the permitted data sources and entities, restrict access by role, trace any analytical claim back to the originating record, and record analyst decisions for auditability.

1. 01

   Create a governed case with a defined purpose, authorized users, retention period, and permitted datasets. Starting input: Authorized institutional datasets and a governed investigative question.

2. 02

   Ingest or query only sources allowed by the organization's license, law, policy, and investigation mandate.

3. 03

   Use Palantir's correlation, graph, search, or model features to generate leads, while preserving lineage back to the original record.

4. 04

   Require human review for consequential identity, risk, or relationship findings and document why an analyst accepted or rejected automated suggestions.

5. 05

   Export an audit-ready result containing source references, analytical limits, access controls, and correction/retention decisions.

Authorized case data and public-source entities

Create a chart from documented entities, encode relationships with source references, use analysis features to identify patterns, and verify every material relationship against primary evidence.

1. 01

   Create a governed case with a defined purpose, authorized users, retention period, and permitted datasets. Starting input: Authorized case data and public-source entities.

2. 02

   Ingest or query only sources allowed by the organization's license, law, policy, and investigation mandate.

3. 03

   Use IBM i2's correlation, graph, search, or model features to generate leads, while preserving lineage back to the original record.

4. 04

   Require human review for consequential identity, risk, or relationship findings and document why an analyst accepted or rejected automated suggestions.

5. 05

   Export an audit-ready result containing source references, analytical limits, access controls, and correction/retention decisions.

A username or handle

Search a public handle such as `oaklandresearcher`, review returned profile URLs, then compare avatar, bio, location, and posting history before deciding two accounts belong to the same person.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username or handle.

2. 02

   Submit the handle to Sherlock and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Sherlock is a lead source unless the underlying record itself is authoritative.

A username, alias, or handle

Run a handle across supported sites, export a report, then manually verify high-value matches because shared usernames frequently produce false attribution.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username, alias, or handle.

2. 02

   Submit the handle to Maigret and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Maigret is a lead source unless the underlying record itself is authoritative.

A username

Enter a username, open candidate account links, compare dates and profile markers, and record only matches supported by more than the handle itself.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username.

2. 02

   Submit the handle to WhatsMyName and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. WhatsMyName is a lead source unless the underlying record itself is authoritative.

A username or brand name

Enter a proposed handle, inspect which major services show availability or use, then open the service directly before concluding an account exists.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username or brand name.

2. 02

   Submit the handle to Namechk and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Namechk is a lead source unless the underlying record itself is authoritative.

A username or brand term

Search the handle, use results as a lead list, then verify candidate profiles at the originating platform.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username or brand term.

2. 02

   Submit the handle to Namecheckup and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Namecheckup is a lead source unless the underlying record itself is authoritative.

A username, brand, or trademark term

Search a brand handle, note platforms indicating use, then visit each platform and distinguish active accounts from stale or unrelated registrations.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username, brand, or trademark term.

2. 02

   Submit the handle to KnowEm and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. KnowEm is a lead source unless the underlying record itself is authoritative.

A username

Enter a handle, scan candidate services, and manually validate any result you intend to cite.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username.

2. 02

   Submit the handle to Instant Username Search and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Instant Username Search is a lead source unless the underlying record itself is authoritative.

A username

Check a handle across listed services, then open positive results and compare corroborating profile details.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username.

2. 02

   Submit the handle to CheckUserNames and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. CheckUserNames is a lead source unless the underlying record itself is authoritative.

A username or email where supported

Run a username search, save the result list, and manually review matches for identity consistency before pivoting further.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username or email where supported.

2. 02

   Submit the handle to Blackbird and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Blackbird is a lead source unless the underlying record itself is authoritative.

A username

Run the handle against supported sites, inspect positive URLs, and reject matches lacking independent identity signals.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username.

2. 02

   Submit the handle to NExfil and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. NExfil is a lead source unless the underlying record itself is authoritative.

A username, name, or profile indicator

Search a public handle, inspect candidate profiles and metadata, then verify each profile on-platform before adding it to an entity map.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username, name, or profile indicator.

2. 02

   Submit the handle to Social Analyzer and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Social Analyzer is a lead source unless the underlying record itself is authoritative.

A username

Query a handle, review site hits, and keep a confidence column distinguishing exact handle matches from verified identity matches.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username.

2. 02

   Submit the handle to Snoop and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Snoop is a lead source unless the underlying record itself is authoritative.

A username

Run a handle, inspect returned public URLs, and verify the current project status before relying on coverage.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username.

2. 02

   Submit the handle to UserRecon and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. UserRecon is a lead source unless the underlying record itself is authoritative.

A username or public identity seed

Identify the exact Investigo implementation, inspect its documentation, test with a known public account, then use results only as leads until verified.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username or public identity seed.

2. 02

   Submit the handle to Investigo and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Investigo is a lead source unless the underlying record itself is authoritative.

Usernames, domains, emails, or names

Select the module matching your identifier, run it against a public or authorized seed, then validate returned entities and URLs independently.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: Usernames, domains, emails, or names.

2. 02

   Submit the handle to OSRFramework and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. OSRFramework is a lead source unless the underlying record itself is authoritative.

A username or email address you are authorized to check

Check a username across supported services, note where registration appears present, and treat registration status as a lead rather than proof of account ownership.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username or email address you are authorized to check.

2. 02

   Submit the handle to socialscan and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. socialscan is a lead source unless the underlying record itself is authoritative.

An email address you own, have consent to audit, or have a legitimate public-interest reason to examine

Test your own email to see which services disclose registration status, record only service-presence signals, and do not attempt password recovery or account access.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with An email address you own, have consent to audit, or have a legitimate public-interest reason to examine.

2. 02

   Use Holehe only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Holehe is a lead source unless the underlying record itself is authoritative.

A username or public profile seed

Search a known public handle, review candidate accounts and risk flags, then confirm identity using direct platform evidence before citing results.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username or public profile seed.

2. 02

   Submit the handle to FootprintIQ and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. FootprintIQ is a lead source unless the underlying record itself is authoritative.

A specific public identifier

Confirm which Trace OSINT product you are using, review its data sources and privacy terms, then validate every identity match outside the tool.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A specific public identifier.

2. 02

   Submit the handle to Trace and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Trace is a lead source unless the underlying record itself is authoritative.

A name, username, or email fragment

Search a public identity term, use results as leads to public profiles, and verify identity manually before retaining any personal information.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A name, username, or email fragment.

2. 02

   Submit the handle to Lullar and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Lullar is a lead source unless the underlying record itself is authoritative.

A username, email, or phone number you may lawfully research

Search the identifier, review public-profile leads, and corroborate matches with direct platform records before attribution.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A username, email, or phone number you may lawfully research.

2. 02

   Submit the handle to Usersearch.org and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Usersearch.org is a lead source unless the underlying record itself is authoritative.

A name or username

Search a public-facing professional or public-interest subject, open candidate profiles, and avoid publishing private contact or home-address data unless necessary and justified.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A name or username.

2. 02

   Search IDCrawl and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. IDCrawl is a lead source unless the underlying record itself is authoritative.

A self-audit identifier such as your own email or username

Use the service for your own footprint audit, note where information appears exposed, then remove or correct information through the original site rather than relying on the aggregator alone.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A self-audit identifier such as your own email or username.

2. 02

   Search Digital Footprint Check and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Digital Footprint Check is a lead source unless the underlying record itself is authoritative.

A Google-linked identifier you are authorized to research

Use only on your own account, a consenting subject, or a justified public-interest target; run supported passive queries, then verify any profile association through public primary sources.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A Google-linked identifier you are authorized to research.

2. 02

   Use GHunt only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. GHunt is a lead source unless the underlying record itself is authoritative.

A GitHub username

Run the public username, review repositories and public metadata identified by the tool, then inspect the original GitHub pages before recording a finding.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: A GitHub username.

2. 02

   Submit the handle to Gitrecon and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Gitrecon is a lead source unless the underlying record itself is authoritative.

An authorized organization and lawfully obtained public LinkedIn employee data

Use only where collection complies with law and platform rules; generate possible corporate username formats, then validate against authorized internal or public evidence rather than probing accounts.

1. 01

   Normalize the handle exactly as observed, including punctuation and capitalization where relevant. Starting input: An authorized organization and lawfully obtained public LinkedIn employee data.

2. 02

   Submit the handle to linkedin2username and save the candidate account URLs rather than assuming every positive result belongs to one person.

3. 03

   Open each candidate profile and compare independent identity markers such as avatar history, biography, location, links, posting topics, and account dates.

4. 04

   Assign a confidence level: handle-only match, probable match, or corroborated match. A shared username by itself is not identity proof.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. linkedin2username is a lead source unless the underlying record itself is authoritative.

Your own email address or a domain you control

Search your email, note which named breaches include it, change exposed passwords through the real services, and preserve only breach metadata rather than leaked credential contents.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with Your own email address or a domain you control.

2. 02

   Use Have I Been Pwned only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Have I Been Pwned is a lead source unless the underlying record itself is authoritative.

Emails you own or are authorized to audit

Run authorized email addresses against configured lawful sources, record exposure indicators, and never use results to attempt account access.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with Emails you own or are authorized to audit.

2. 02

   Use h8mail only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. h8mail is a lead source unless the underlying record itself is authoritative.

An identifier you are legally authorized to examine

Search your own email or company domain, record which incidents and data types appear, avoid downloading or reusing passwords, and remediate through legitimate account-security channels.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with An identifier you are legally authorized to examine.

2. 02

   Use DeHashed only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. DeHashed is a lead source unless the underlying record itself is authoritative.

Your own email, username, or organization domain

Check an owned identifier, record exposure dates and source labels, and use the result to prioritize password resets and monitoring rather than accessing compromised accounts.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with Your own email, username, or organization domain.

2. 02

   Use LeakCheck only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. LeakCheck is a lead source unless the underlying record itself is authoritative.

An authorized identifier

Use for self-audit or authorized incident response, capture only the minimum exposure metadata needed, and do not repurpose leaked credentials or private content.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with An authorized identifier.

2. 02

   Use Snusbase only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Snusbase is a lead source unless the underlying record itself is authoritative.

A public identifier, domain, URL, document, or authorized breach-research term

Search an owned domain or public document hash, review indexed sources, and avoid retrieving sensitive leaked material that is unnecessary to the public-interest question.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A public identifier, domain, URL, document, or authorized breach-research term.

2. 02

   Use Intelligence X only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Intelligence X is a lead source unless the underlying record itself is authoritative.

A company domain or email you are authorized to assess

Use the public exposure tools on an owned domain, note infostealer exposure indicators, then move remediation into formal security and credential-reset processes.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A company domain or email you are authorized to assess.

2. 02

   Use Hudson Rock only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Hudson Rock is a lead source unless the underlying record itself is authoritative.

A company domain or known professional name

Search an organization's domain, review publicly sourced email patterns, then verify a contact through the organization's own website before outreach or publication.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A company domain or known professional name.

2. 02

   Use Hunter.io only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Hunter.io is a lead source unless the underlying record itself is authoritative.

An email or phone number you have a lawful reason to research

Search a consenting or public-interest identifier, review public account signals, and corroborate any identity connection using independent public records.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with An email or phone number you have a lawful reason to research.

2. 02

   Use Epieos only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Epieos is a lead source unless the underlying record itself is authoritative.

An email address used in an authorized trust or fraud review

Query the address, interpret reputation flags as indicators rather than proof, and compare the result with transaction or account evidence you are authorized to hold.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with An email address used in an authorized trust or fraud review.

2. 02

   Use EmailRep only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. EmailRep is a lead source unless the underlying record itself is authoritative.

A domain, email fragment, or organization

Search a company domain for publicly indexed addresses and subdomains, then verify contacts on official sites before using them.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A domain, email fragment, or organization.

2. 02

   Use Phonebook.cz only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Phonebook.cz is a lead source unless the underlying record itself is authoritative.

A company or professional identity

Use domain or prospect search for legitimate contact research, verify results against official professional pages, and do not infer private affiliation from an unverified match.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A company or professional identity.

2. 02

   Use Snov.io only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Snov.io is a lead source unless the underlying record itself is authoritative.

A professional name plus company/domain

Enter a known professional name and employer, review the suggested business email, and verify through independent professional sources before relying on it.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A professional name plus company/domain.

2. 02

   Use Voila Norbert only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Voila Norbert is a lead source unless the underlying record itself is authoritative.

A business email or company domain in an authorized enrichment workflow

Enrich a business-domain record, inspect returned company fields, and validate important claims against the company or regulatory record.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A business email or company domain in an authorized enrichment workflow.

2. 02

   Use Clearbit only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Clearbit is a lead source unless the underlying record itself is authoritative.

A professional name, company, or business domain

Search a public-facing professional, use returned contact details only for legitimate outreach, and verify role and employer on current primary sources.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A professional name, company, or business domain.

2. 02

   Use RocketReach only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. RocketReach is a lead source unless the underlying record itself is authoritative.

A company or professional prospect in a legitimate research or outreach context

Search an organization, filter employees by role, confirm current employment from public professional sources, and minimize unnecessary personal data retention.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A company or professional prospect in a legitimate research or outreach context.

2. 02

   Use Apollo.io only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Apollo.io is a lead source unless the underlying record itself is authoritative.

A mail domain, IP, or email header

Paste the mail domain or analyze an email header you lawfully possess, inspect DNS/MX/SPF/DKIM signals, and document the exact fields supporting your conclusion.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A mail domain, IP, or email header.

2. 02

   Use MXToolbox for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. MXToolbox is a lead source unless the underlying record itself is authoritative.

A domain or organization you are authorized to research

Use the domain as a seed, collect publicly indexed email patterns, and validate current addresses through primary organizational sources.

1. 01

   Confirm you have a legitimate basis to examine the address. Start with A domain or organization you are authorized to research.

2. 02

   Use Infoga only for the service's intended public signal—registration, breach exposure, reputation, professional contact, or domain metadata.

3. 03

   Collect only the minimum metadata needed for the investigation. Do not retrieve, test, reuse, or publish passwords, recovery codes, or private account content.

4. 04

   Corroborate identity or exposure with a second lawful source and distinguish a historical breach from current account compromise.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Infoga is a lead source unless the underlying record itself is authoritative.

A phone number you own, have consent to investigate, or have a strong public-interest basis to research

Normalize the number, review country/carrier and public-web search pivots, and never use results to harass, locate, or impersonate a private person.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A phone number you own, have consent to investigate, or have a strong public-interest basis to research.

2. 02

   Use PhoneInfoga to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. PhoneInfoga is a lead source unless the underlying record itself is authoritative.

A phone number you are authorized to audit

Check whether your own number appears associated with supported services, record only registration indicators, and do not initiate account recovery or access attempts.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A phone number you are authorized to audit.

2. 02

   Use Ignorant to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Ignorant is a lead source unless the underlying record itself is authoritative.

A phone number involved in a legitimate contact, fraud, or self-audit question

Search the number, treat the displayed name as user-contributed and potentially wrong, and corroborate identity independently before attribution.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A phone number involved in a legitimate contact, fraud, or self-audit question.

2. 02

   Use Truecaller to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Truecaller is a lead source unless the underlying record itself is authoritative.

A number you are lawfully permitted to review

Check public/community labels, record them only as unverified leads, and avoid using crowd-sourced tags as proof of identity or misconduct.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A number you are lawfully permitted to review.

2. 02

   Use Getcontact to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Getcontact is a lead source unless the underlying record itself is authoritative.

A phone number

Submit the number, retrieve country, line-type, and carrier metadata where available, and document the lookup date because carrier assignments can change.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A phone number.

2. 02

   Use NumVerify to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. NumVerify is a lead source unless the underlying record itself is authoritative.

A U.S. number you have a lawful reason to research

Use only for legitimate self-audit or public-interest work, record the minimum directory information needed, and independently verify identity before publication.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A U.S. number you have a lawful reason to research.

2. 02

   Use SpyDialer to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. SpyDialer is a lead source unless the underlying record itself is authoritative.

A phone number

Search the number, treat names and carrier details as leads, and cross-check against direct or official sources.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A phone number.

2. 02

   Use NumLookup to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. NumLookup is a lead source unless the underlying record itself is authoritative.

A phone number involved in a legitimate identity-verification question

Review caller/profile information, assume crowd-sourced data may be stale, and require independent corroboration before attribution.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A phone number involved in a legitimate identity-verification question.

2. 02

   Use Sync.me to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Sync.me is a lead source unless the underlying record itself is authoritative.

A phone number

Run a lawful lookup, note carrier or caller-ID signals, and confirm identity elsewhere before using the result in a case file.

1. 01

   Normalize the number to international format where possible and document why the lookup is justified. Starting input: A phone number.

2. 02

   Use CallerIDTest to obtain only the available public metadata, directory association, carrier, or registration signal.

3. 03

   Treat crowd-sourced names, tags, and approximate locations as unverified leads; numbers are recycled and databases become stale.

4. 04

   Corroborate any identity match with independent public records or direct evidence and minimize collection of home-address or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. CallerIDTest is a lead source unless the underlying record itself is authoritative.

A self-audit or legitimate public-interest identifier

Search your own name, address, email, or phone to learn what an aggregator exposes; for third parties, minimize collection and never publish precise home-location data without strong justification.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A self-audit or legitimate public-interest identifier.

2. 02

   Search ThatsThem and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. ThatsThem is a lead source unless the underlying record itself is authoritative.

A self-audit or legitimate public-interest name, email, phone, or username

Search a known public-facing person, separate directory hints from verified records, and confirm identity through primary public documents before publication.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A self-audit or legitimate public-interest name, email, phone, or username.

2. 02

   Search Spokeo and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Spokeo is a lead source unless the underlying record itself is authoritative.

A self-audit or legitimate public-interest identity

Search a person, inspect possible age/location associations, and corroborate each material fact with official records rather than citing the aggregator alone.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A self-audit or legitimate public-interest identity.

2. 02

   Search BeenVerified and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. BeenVerified is a lead source unless the underlying record itself is authoritative.

A self-audit or public-interest identity question

Use the report to generate possible jurisdictions and aliases, then verify those details against court, property, corporate, or government records.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A self-audit or public-interest identity question.

2. 02

   Search Intelius and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Intelius is a lead source unless the underlying record itself is authoritative.

A lawful self-audit or public-interest identity

Treat results as a lead set, verify criminal/court claims directly with courts, and do not use the service for regulated eligibility decisions unless legally permitted.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A lawful self-audit or public-interest identity.

2. 02

   Search TruthFinder and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. TruthFinder is a lead source unless the underlying record itself is authoritative.

A lawful public-record research question

Search a person, record possible jurisdictions and aliases, then open official court or government sources before relying on any consequential information.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A lawful public-record research question.

2. 02

   Search Instant Checkmate and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Instant Checkmate is a lead source unless the underlying record itself is authoritative.

A name and approximate location

Use the result to identify possible age or city matches, then corroborate with official records and avoid publishing home addresses unnecessarily.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A name and approximate location.

2. 02

   Search ZabaSearch and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. ZabaSearch is a lead source unless the underlying record itself is authoritative.

A name, phone number, or address

Run a self-audit or legitimate lookup, distinguish household associations from identity proof, and verify important facts elsewhere.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A name, phone number, or address.

2. 02

   Search Whitepages and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Whitepages is a lead source unless the underlying record itself is authoritative.

A licensed identity-resolution case

Search a known identifier, review possible entity resolution, and require independent evidence before treating matched records as one person.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A licensed identity-resolution case.

2. 02

   Search Pipl and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Pipl is a lead source unless the underlying record itself is authoritative.

A name or username

Use results to find candidate public profiles, then confirm identity directly on the originating sites.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A name or username.

2. 02

   Search PeekYou and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. PeekYou is a lead source unless the underlying record itself is authoritative.

Your own public-data footprint or legitimate genealogy research

Search yourself to understand exposed family/address associations, verify records at original sources, and use opt-out procedures if appropriate.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with Your own public-data footprint or legitimate genealogy research.

2. 02

   Search FamilyTreeNow and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. FamilyTreeNow is a lead source unless the underlying record itself is authoritative.

A public-interest voter-registration question where disclosure is lawful

Search by name and jurisdiction, treat registration data as jurisdiction-specific and potentially stale, and avoid republishing residential addresses without necessity.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A public-interest voter-registration question where disclosure is lawful.

2. 02

   Search VoterRecords and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. VoterRecords is a lead source unless the underlying record itself is authoritative.

A name, business, case term, or jurisdiction

Search a party name, inspect docket snippets, then verify the case and current disposition with the originating court before citation.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A name, business, case term, or jurisdiction.

2. 02

   Search Judyrecords and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Judyrecords is a lead source unless the underlying record itself is authoritative.

A party, attorney, company, or case number

Search the name, narrow by jurisdiction and date, then confirm filings and disposition through the official court system where possible.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A party, attorney, company, or case number.

2. 02

   Search UniCourt and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. UniCourt is a lead source unless the underlying record itself is authoritative.

A full name or federal inmate number

Search the exact name or register number, record custody/release information with the lookup date, and distinguish federal BOP custody from state or local systems.

1. 01

   Define the person precisely before searching: full name, approximate age, jurisdiction, profession, or another non-sensitive discriminator. Start with A full name or federal inmate number.

2. 02

   Search Federal Bureau of Prisons inmate locator and separate possible matches from the specific individual in your case file.

3. 03

   Use aggregator data to identify jurisdictions, aliases, cases, companies, or other leads—not as the final authority for consequential facts.

4. 04

   Verify court, corporate, property, custody, or regulatory information at the originating official source and redact unnecessary residential or family data.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Federal Bureau of Prisons inmate locator is a lead source unless the underlying record itself is authoritative.

A company name, officer, or jurisdiction

Search an entity name, identify the legal jurisdiction and company number, then confirm current filings with the official corporate registry.

1. 01

   Resolve the entity's exact legal name, jurisdiction, and unique identifier before pivoting. Starting input: A company name, officer, or jurisdiction.

2. 02

   Search OpenCorporates for filings, officers, ownership, sanctions, funding, trade, counterparties, or corporate relationships relevant to the question.

3. 03

   Separate registry facts from vendor-enriched estimates and distinguish current officers/owners from historical ones.

4. 04

   Confirm material facts in the authoritative company registry, securities filing, sanctions instrument, contract, or other primary record whenever available.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. OpenCorporates is a lead source unless the underlying record itself is authoritative.

A person or entity in a sanctions or politically exposed-person research context

Search the exact legal name, compare identifiers and dates of birth, and confirm any match against the originating sanctions authority before publication.

1. 01

   Resolve the entity's exact legal name, jurisdiction, and unique identifier before pivoting. Starting input: A person or entity in a sanctions or politically exposed-person research context.

2. 02

   Search OpenSanctions for filings, officers, ownership, sanctions, funding, trade, counterparties, or corporate relationships relevant to the question.

3. 03

   Separate registry facts from vendor-enriched estimates and distinguish current officers/owners from historical ones.

4. 04

   Confirm material facts in the authoritative company registry, securities filing, sanctions instrument, contract, or other primary record whenever available.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. OpenSanctions is a lead source unless the underlying record itself is authoritative.

A UK company name, number, or officer

Search the company, open filing history and officer records, download the relevant filing, and record the company number so similarly named entities are not confused.

1. 01

   Resolve the entity's exact legal name, jurisdiction, and unique identifier before pivoting. Starting input: A UK company name, number, or officer.

2. 02

   Search Companies House for filings, officers, ownership, sanctions, funding, trade, counterparties, or corporate relationships relevant to the question.

3. 03

   Separate registry facts from vendor-enriched estimates and distinguish current officers/owners from historical ones.

4. 04

   Confirm material facts in the authoritative company registry, securities filing, sanctions instrument, contract, or other primary record whenever available.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Companies House is a lead source unless the underlying record itself is authoritative.

A public company, ticker, CIK, executive, or filing type

Search the company, open its latest 10-K or 8-K, use exhibits for contracts, and cite the filing accession number and date.

1. 01

   Resolve the entity's exact legal name, jurisdiction, and unique identifier before pivoting. Starting input: A public company, ticker, CIK, executive, or filing type.

2. 02

   Search SEC EDGAR for filings, officers, ownership, sanctions, funding, trade, counterparties, or corporate relationships relevant to the question.

3. 03

   Separate registry facts from vendor-enriched estimates and distinguish current officers/owners from historical ones.

4. 04

   Confirm material facts in the authoritative company registry, securities filing, sanctions instrument, contract, or other primary record whenever available.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. SEC EDGAR is a lead source unless the underlying record itself is authoritative.

A European company or executive

Search an entity, inspect corporate relationships and filing-derived history, then verify important records with the relevant national registry.

1. 01

   Resolve the entity's exact legal name, jurisdiction, and unique identifier before pivoting. Starting input: A European company or executive.

2. 02

   Search North Data for filings, officers, ownership, sanctions, funding, trade, counterparties, or corporate relationships relevant to the question.

3. 03

   Separate registry facts from vendor-enriched estimates and distinguish current officers/owners from historical ones.

4. 04

   Confirm material facts in the authoritative company registry, securities filing, sanctions instrument, contract, or other primary record whenever available.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. North Data is a lead source unless the underlying record itself is authoritative.

A company, founder, investor, or funding question

Search the company, note funding rounds and key people, then corroborate major figures with filings, investor announcements, or the company itself.

1. 01

   Resolve the entity's exact legal name, jurisdiction, and unique identifier before pivoting. Starting input: A company, founder, investor, or funding question.

2. 02

   Search Crunchbase for filings, officers, ownership, sanctions, funding, trade, counterparties, or corporate relationships relevant to the question.

3. 03

   Separate registry facts from vendor-enriched estimates and distinguish current officers/owners from historical ones.

4. 04

   Confirm material facts in the authoritative company registry, securities filing, sanctions instrument, contract, or other primary record whenever available.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Crunchbase is a lead source unless the underlying record itself is authoritative.

A company or beneficial-ownership research question

Search available ownership data, capture entity identifiers and source jurisdiction, then confirm the latest ownership position with the authoritative registry where possible.

1. 01

   Resolve the entity's exact legal name, jurisdiction, and unique identifier before pivoting. Starting input: A company or beneficial-ownership research question.

2. 02

   Search OpenOwnership for filings, officers, ownership, sanctions, funding, trade, counterparties, or corporate relationships relevant to the question.

3. 03

   Separate registry facts from vendor-enriched estimates and distinguish current officers/owners from historical ones.

4. 04

   Confirm material facts in the authoritative company registry, securities filing, sanctions instrument, contract, or other primary record whenever available.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. OpenOwnership is a lead source unless the underlying record itself is authoritative.

A face image you may lawfully use for identification research

Upload a public or consented image, review candidate matches, and never treat visual similarity alone as identity proof; corroborate with independent biographical evidence.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: A face image you may lawfully use for identification research.

2. 02

   Use FaceCheck.ID on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. FaceCheck.ID is a lead source unless the underlying record itself is authoritative.

Your own face or an image used for a justified public-interest verification

Upload the image, inspect returned pages, and verify identity from page context and independent records rather than relying on similarity score alone.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: Your own face or an image used for a justified public-interest verification.

2. 02

   Use PimEyes on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. PimEyes is a lead source unless the underlying record itself is authoritative.

A lawful face-search question

Upload an authorized image, review possible profile matches, and require independent corroboration before naming a person.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: A lawful face-search question.

2. 02

   Use Search4Faces on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Search4Faces is a lead source unless the underlying record itself is authoritative.

Keywords, accounts, dates, language, or engagement terms

Search an exact phrase from a public statement, constrain it to the account and date window, open the original post, and archive the URL and timestamp before analysis.

1. 01

   Turn the research question into a bounded query using Keywords, accounts, dates, language, or engagement terms.

2. 02

   Use X advanced search to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. X advanced search is a lead source unless the underlying record itself is authoritative.

A public X/Twitter username

Enter a public account, review profile and activity summaries as leads, then confirm any material pattern by opening the original posts.

1. 01

   Turn the research question into a bounded query using A public X/Twitter username.

2. 02

   Use Foller.me to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Foller.me is a lead source unless the underlying record itself is authoritative.

A public Reddit username

Analyze a public account, treat inferred interests as probabilistic, and cite specific public posts rather than the profile summary when making a claim.

1. 01

   Turn the research question into a bounded query using A public Reddit username.

2. 02

   Use RedditMetis to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. RedditMetis is a lead source unless the underlying record itself is authoritative.

A Reddit post, comment, user, subreddit, or time range

Query a public post or account time range, retrieve historical Reddit material, and compare it with live Reddit and archived copies before treating deleted content as authentic context.

1. 01

   Turn the research question into a bounded query using A Reddit post, comment, user, subreddit, or time range.

2. 02

   Use Arctic Shift to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Arctic Shift is a lead source unless the underlying record itself is authoritative.

A public Telegram channel, keyword, or topic

Search a public channel, review post history and forward relationships, then open the original Telegram content and record publication dates and channel identity.

1. 01

   Turn the research question into a bounded query using A public Telegram channel, keyword, or topic.

2. 02

   Use TGStat to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. TGStat is a lead source unless the underlying record itself is authoritative.

A public Telegram keyword, channel, or message topic

Search a distinctive phrase, open candidate channel results, and confirm message context and date in the original public channel.

1. 01

   Turn the research question into a bounded query using A public Telegram keyword, channel, or message topic.

2. 02

   Use Telegago to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Telegago is a lead source unless the underlying record itself is authoritative.

A public Telegram channel or topic

Search the channel, inspect analytics and mentions, and verify significant posts directly in Telegram before citation.

1. 01

   Turn the research question into a bounded query using A public Telegram channel or topic.

2. 02

   Use Telemetr to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Telemetr is a lead source unless the underlying record itself is authoritative.

A public Telegram research question

Confirm the exact Telerecon project, review collection methods and current maintenance, then use it only on lawfully accessible public channels and validate outputs at source.

1. 01

   Turn the research question into a bounded query using A public Telegram research question.

2. 02

   Use Telerecon to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Telerecon is a lead source unless the underlying record itself is authoritative.

A public Bluesky handle, DID, post URI, or feed

Resolve a handle to its public profile, capture the post URI or DID, use public AT Protocol endpoints where appropriate, and preserve the original post context before drawing conclusions.

1. 01

   Turn the research question into a bounded query using A public Bluesky handle, DID, post URI, or feed.

2. 02

   Use Bluesky / AT Protocol tools to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Bluesky / AT Protocol tools is a lead source unless the underlying record itself is authoritative.

A keyword, brand, phrase, or public account

Search a distinctive phrase, filter by source and time where available, open original posts, and separate duplicate syndication from independent mentions.

1. 01

   Turn the research question into a bounded query using A keyword, brand, phrase, or public account.

2. 02

   Use Social Searcher to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Social Searcher is a lead source unless the underlying record itself is authoritative.

Authorized social accounts, keywords, or listening queries

Create a listening stream for a campaign term, review spikes and representative posts, and preserve original links rather than treating dashboard counts as self-explanatory.

1. 01

   Turn the research question into a bounded query using Authorized social accounts, keywords, or listening queries.

2. 02

   Use Hootsuite to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Hootsuite is a lead source unless the underlying record itself is authoritative.

Lawfully available geotagged public posts

Use only for ethical, public-interest geolocation work, restrict collection to necessary public posts, and never use it to track a private person in real time.

1. 01

   Turn the research question into a bounded query using Lawfully available geotagged public posts.

2. 02

   Use GeoCreepy to locate the smallest relevant set of public posts, channels, accounts, or mentions; narrow by date and exact phrase whenever possible.

3. 03

   Open the original post or channel rather than relying only on an analytics dashboard, search snippet, or repost.

4. 04

   Capture chronology, author/account identity, edits or deletions where observable, and whether multiple sources are independent or merely copying one another.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. GeoCreepy is a lead source unless the underlying record itself is authoritative.

A domain you own or are authorized to assess

Run passive enumeration first, collect discovered subdomains and certificate relationships, and validate hosts before any active probing.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain you own or are authorized to assess.

2. 02

   Use OWASP Amass for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. OWASP Amass is a lead source unless the underlying record itself is authoritative.

An authorized domain

Enumerate passive subdomain sources for your domain, deduplicate results, resolve them, and retain source provenance for assets you investigate further.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: An authorized domain.

2. 02

   Use Subfinder for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Subfinder is a lead source unless the underlying record itself is authoritative.

An authorized domain

Run passive subdomain enumeration, compare results with certificate-transparency data, and verify which hosts still resolve.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: An authorized domain.

2. 02

   Use Sublist3r for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Sublist3r is a lead source unless the underlying record itself is authoritative.

An authorized domain

Enumerate passive subdomains, save the output, resolve candidates, and compare with your known asset inventory.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: An authorized domain.

2. 02

   Use Findomain for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Findomain is a lead source unless the underlying record itself is authoritative.

An authorized domain

Run the domain through passive sources, sort and deduplicate the output, and validate current DNS resolution before classification.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: An authorized domain.

2. 02

   Use assetfinder for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. assetfinder is a lead source unless the underlying record itself is authoritative.

A domain you own or have explicit permission to enumerate

Begin with passive discovery where possible, use DNS enumeration only within scope, record the authorization and time window, and stop if the target falls outside the agreed domain space.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain you own or have explicit permission to enumerate.

2. 02

   Use Knockpy for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Knockpy is a lead source unless the underlying record itself is authoritative.

A domain or organization name

Search `%25.example.com`, review certificate names and issue dates, and confirm whether discovered subdomains still resolve before treating them as current assets.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain or organization name.

2. 02

   Use crt.sh for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. crt.sh is a lead source unless the underlying record itself is authoritative.

A domain

Enter the domain, review discovered DNS records and host map, then confirm important records with direct DNS lookups and current certificate data.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain.

2. 02

   Use DNSDumpster for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. DNSDumpster is a lead source unless the underlying record itself is authoritative.

A domain, IP, ASN, or related infrastructure identifier

Use reverse-IP, DNS history, or WHOIS tools as appropriate, record the lookup date, and corroborate historical ownership with archived or registry records.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain, IP, ASN, or related infrastructure identifier.

2. 02

   Use ViewDNS.info for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. ViewDNS.info is a lead source unless the underlying record itself is authoritative.

A domain, IP, DNS record, or organization

Search an authorized domain, review current and historical DNS, pivot to related hosts, and separate historical association from current control.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain, IP, DNS record, or organization.

2. 02

   Use SecurityTrails for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. SecurityTrails is a lead source unless the underlying record itself is authoritative.

A domain or registrant string

Search a domain, inspect historical WHOIS relationships, and corroborate any registrant association because privacy proxies and stale records can mislead.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain or registrant string.

2. 02

   Use Whoisology for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Whoisology is a lead source unless the underlying record itself is authoritative.

A domain, registrant, or company

Search the domain, review current/historical WHOIS where available, and verify corporate identity independently before attribution.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain, registrant, or company.

2. 02

   Use Whoxy for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Whoxy is a lead source unless the underlying record itself is authoritative.

A domain, IP, ASN, or hostname

Enter the identifier, inspect DNS/BGP relationships and neighboring infrastructure, and validate any ownership inference with authoritative records.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain, IP, ASN, or hostname.

2. 02

   Use Robtex for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Robtex is a lead source unless the underlying record itself is authoritative.

An ASN, IP prefix, organization, or domain-related network question

Search an ASN, inspect announced prefixes and peers, then confirm organization ownership and routing context using RIR or operator information.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: An ASN, IP prefix, organization, or domain-related network question.

2. 02

   Use Hurricane Electric BGP Toolkit for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Hurricane Electric BGP Toolkit is a lead source unless the underlying record itself is authoritative.

An explicitly authorized domain or asset scope

Define the scope file, disable intrusive modules you do not need, run passive stages first, and execute active modules only under written authorization while logging commands and targets.

1. 01

   Create a case/workspace for one defined question and seed it with An explicitly authorized domain or asset scope.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in reconFTW; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. reconFTW is a lead source unless the underlying record itself is authoritative.

A controlled fleet and explicit authorized target list

Provision workers only in an approved account, load the exact scope, run authorized parallel enumeration or scanning, and destroy workers after exporting logs and results.

1. 01

   Create a case/workspace for one defined question and seed it with A controlled fleet and explicit authorized target list.

2. 02

   Configure passive/public-source modules first. Disable intrusive, authenticated, or active modules unless the target is explicitly authorized.

3. 03

   Run the smallest useful collection in Axiom; review which source produced each returned entity or relationship.

4. 04

   Manually open high-value results and remove false positives, stale data, shared-name collisions, and unsupported automated correlations.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Axiom is a lead source unless the underlying record itself is authoritative.

A URL or domain

Search existing scans before submitting anything sensitive, inspect requests, hosts, certificates, and screenshots, and avoid submitting private or credential-bearing URLs to a public scan.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: A URL or domain.

2. 02

   Search urlscan.io's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. urlscan.io is a lead source unless the underlying record itself is authoritative.

A public website or domain

Enter a public domain, review DNS, headers, technologies, certificates, and other exposed metadata, and verify important findings with the originating source.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A public website or domain.

2. 02

   Use Web-Check for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Web-Check is a lead source unless the underlying record itself is authoritative.

A website domain

Search the domain, review detected technologies and historical changes, and confirm current technology from live headers or source where consequential.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A website domain.

2. 02

   Use BuiltWith for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. BuiltWith is a lead source unless the underlying record itself is authoritative.

A domain, IP, registrant, or infrastructure question

Search the domain, inspect registration and DNS history, pivot to related infrastructure, and distinguish historical correlation from present ownership.

1. 01

   Canonicalize the domain and confirm it is the entity you intend to research. Starting input: A domain, IP, registrant, or infrastructure question.

2. 02

   Use DomainTools for passive DNS, certificates, WHOIS, subdomains, technologies, routing, or historical infrastructure as appropriate.

3. 03

   Record timestamps because DNS, certificates, hosting, and ownership change; a historical association is not necessarily current control.

4. 04

   Cross-check important relationships with a second infrastructure source and, for ownership claims, an authoritative registry or organization record.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. DomainTools is a lead source unless the underlying record itself is authoritative.

An IP, ASN, hostname, organization, product banner, or authorized exposure question

Search your own public IP or organization filter, review previously indexed service banners, and use results to identify exposure without sending exploit traffic to third-party systems.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP, ASN, hostname, organization, product banner, or authorized exposure question.

2. 02

   Search Shodan's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Shodan is a lead source unless the underlying record itself is authoritative.

An IP, domain, certificate, service, or organization

Search an owned domain or certificate fingerprint, review observed hosts and services, and compare timestamps because internet-wide scan data is a snapshot, not real-time truth.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP, domain, certificate, service, or organization.

2. 02

   Search Censys's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Censys is a lead source unless the underlying record itself is authoritative.

An IP, service, device fingerprint, or authorized organization

Search an owned service fingerprint, review indexed hosts, and validate findings through your authorized asset inventory rather than probing unrelated systems.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP, service, device fingerprint, or authorized organization.

2. 02

   Search ZoomEye's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. ZoomEye is a lead source unless the underlying record itself is authoritative.

An IP, domain, certificate, service, or technology fingerprint

Search only to identify publicly indexed exposure, narrow results to your assets, and do not use discoveries as authorization to access third-party systems.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP, domain, certificate, service, or technology fingerprint.

2. 02

   Search FOFA's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. FOFA is a lead source unless the underlying record itself is authoritative.

An IP, domain, asset, or exposure question

Check an owned domain or IP, review risk and service observations, and independently verify high-severity labels before remediation or reporting.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP, domain, asset, or exposure question.

2. 02

   Search Criminal IP's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Criminal IP is a lead source unless the underlying record itself is authoritative.

An IP address observed in logs or public infrastructure

Search the IP, review report dates and categories, compare with your own log evidence, and avoid treating community reports as definitive attribution.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP address observed in logs or public infrastructure.

2. 02

   Search AbuseIPDB's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. AbuseIPDB is a lead source unless the underlying record itself is authoritative.

An IP address

Look up the IP, capture ASN, organization, and approximate region, and do not infer a person's exact physical location from IP geolocation.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP address.

2. 02

   Search IPinfo's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. IPinfo is a lead source unless the underlying record itself is authoritative.

An IP address

Query the IP, record the database date and approximate location, and use it only as coarse network context, not proof of a user's address.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP address.

2. 02

   Search DB-IP's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. DB-IP is a lead source unless the underlying record itself is authoritative.

A public hash, domain, URL, or IP; files only when you are permitted to upload them

Search a known hash first, inspect vendor detections and relationships, and never upload confidential files to a public analysis service.

1. 01

   Start with a defensible indicator such as a hash, domain, URL, IP, family name, or event from your own logs. Starting input: A public hash, domain, URL, or IP; files only when you are permitted to upload them.

2. 02

   Search VirusTotal without executing a file or directly visiting a suspicious URL from a normal workstation.

3. 03

   Compare first/last-seen dates, detection names, confidence, and source provenance across at least one additional threat-intelligence source.

4. 04

   Separate indicator reputation from attribution; a malicious IP, shared host, or detection label does not by itself identify the responsible actor.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. VirusTotal is a lead source unless the underlying record itself is authoritative.

An IP or subnet you own or have explicit permission to scan

Record written scope, run a limited service/version scan against your own lab or authorized host, save the output, and compare discovered services with the approved asset inventory.

1. 01

   Obtain explicit authorization and write down the exact hosts, ports, dates, rate limits, and prohibited actions before using Nmap.

2. 02

   Load only the approved target set. Starting input: An IP or subnet you own or have explicit permission to scan.

3. 03

   Begin with the least intrusive scan that answers the question; use conservative rates and do not expand scope because a new host or service appears interesting.

4. 04

   Save the command, version, timestamps, and raw output; confirm positives using another authorized method rather than escalating automatically.

5. 05

   Stop immediately on scope ambiguity, instability, or evidence that the target is owned by a third party not covered by the authorization.

A specifically authorized IP range

Use a conservative rate against a lab or approved range, target only approved ports, log the command and scope, and validate positives with a less aggressive authorized tool.

1. 01

   Obtain explicit authorization and write down the exact hosts, ports, dates, rate limits, and prohibited actions before using Masscan.

2. 02

   Load only the approved target set. Starting input: A specifically authorized IP range.

3. 03

   Begin with the least intrusive scan that answers the question; use conservative rates and do not expand scope because a new host or service appears interesting.

4. 04

   Save the command, version, timestamps, and raw output; confirm positives using another authorized method rather than escalating automatically.

5. 05

   Stop immediately on scope ambiguity, instability, or evidence that the target is owned by a third party not covered by the authorization.

Authorized hosts or IP ranges

Provide the approved host list, scan only the ports required by the assessment, save results, and hand confirmed services to your authorized validation workflow.

1. 01

   Obtain explicit authorization and write down the exact hosts, ports, dates, rate limits, and prohibited actions before using Naabu.

2. 02

   Load only the approved target set. Starting input: Authorized hosts or IP ranges.

3. 03

   Begin with the least intrusive scan that answers the question; use conservative rates and do not expand scope because a new host or service appears interesting.

4. 04

   Save the command, version, timestamps, and raw output; confirm positives using another authorized method rather than escalating automatically.

5. 05

   Stop immediately on scope ambiguity, instability, or evidence that the target is owned by a third party not covered by the authorization.

An authorized host

Run it only against your own system or written assessment scope, limit concurrency as appropriate, and use discovered ports as inputs to an approved service-review process.

1. 01

   Obtain explicit authorization and write down the exact hosts, ports, dates, rate limits, and prohibited actions before using RustScan.

2. 02

   Load only the approved target set. Starting input: An authorized host.

3. 03

   Begin with the least intrusive scan that answers the question; use conservative rates and do not expand scope because a new host or service appears interesting.

4. 04

   Save the command, version, timestamps, and raw output; confirm positives using another authorized method rather than escalating automatically.

5. 05

   Stop immediately on scope ambiguity, instability, or evidence that the target is owned by a third party not covered by the authorization.

A list of authorized web hosts or URLs

Feed an approved asset list, collect HTTP status, title, technologies, and TLS metadata, then compare live results with your known inventory without sending exploit payloads.

1. 01

   Obtain explicit authorization and write down the exact hosts, ports, dates, rate limits, and prohibited actions before using httpx.

2. 02

   Load only the approved target set. Starting input: A list of authorized web hosts or URLs.

3. 03

   Begin with the least intrusive scan that answers the question; use conservative rates and do not expand scope because a new host or service appears interesting.

4. 04

   Save the command, version, timestamps, and raw output; confirm positives using another authorized method rather than escalating automatically.

5. 05

   Stop immediately on scope ambiguity, instability, or evidence that the target is owned by a third party not covered by the authorization.

An IP, service, or authorized organization

Search an owned IP or domain, review historical exposure, and confirm the service's current product availability and data freshness before relying on it.

1. 01

   Begin with a known IP, domain, ASN, certificate, or organization that you are permitted to investigate. Starting input: An IP, service, or authorized organization.

2. 02

   Search BinaryEdge's existing internet-wide index instead of sending traffic to unrelated systems.

3. 03

   Review service banners, scan timestamps, certificates, ports, and network ownership; treat the data as a dated observation rather than a live guarantee.

4. 04

   If validation requires direct probing, stop unless the system is yours or you have explicit authorization for active testing.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. BinaryEdge is a lead source unless the underlying record itself is authoritative.

An image or crop

Upload the full image, then crop distinctive objects or signage, compare earlier appearances and context, and save the URLs of the strongest original-source matches.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: An image or crop.

2. 02

   Use Google Lens on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Google Lens is a lead source unless the underlying record itself is authoritative.

An image or crop

Upload an image, review visually similar results, then compare landmarks, faces, clothing, and publication dates across candidate sources.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: An image or crop.

2. 02

   Use Yandex Images on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Yandex Images is a lead source unless the underlying record itself is authoritative.

An image

Upload the image, sort matches by oldest or most changed, inspect source dates, and use the publication history to test whether a claimed 'new' image predates the event.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: An image.

2. 02

   Use TinEye on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. TinEye is a lead source unless the underlying record itself is authoritative.

An image or crop

Upload a photo, focus the crop on a distinctive object or place, review similar images, and verify any proposed source independently.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: An image or crop.

2. 02

   Use Bing Visual Search on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Bing Visual Search is a lead source unless the underlying record itself is authoritative.

An original media file you lawfully possess

Work on a copy, inspect EXIF/XMP/IPTC metadata, record the exact tags that matter, and remember that missing metadata does not prove manipulation because platforms commonly strip it.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: An original media file you lawfully possess.

2. 02

   Use ExifTool on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. ExifTool is a lead source unless the underlying record itself is authoritative.

An image you may lawfully upload to the service

Load the image, compare clone detection, noise, and level-analysis views, and use anomalies only as prompts for further verification rather than declaring an edit from one filter.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: An image you may lawfully upload to the service.

2. 02

   Use Forensically on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Forensically is a lead source unless the underlying record itself is authoritative.

A non-confidential image

Upload the image, inspect error-level analysis and metadata, read the site's methodology, and avoid treating ELA patterns as conclusive evidence of manipulation.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: A non-confidential image.

2. 02

   Use FotoForensics on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. FotoForensics is a lead source unless the underlying record itself is authoritative.

Image files in a controlled forensic workspace

Import copies of the images, run automated metadata and consistency checks, review flagged features manually, and preserve originals outside the analysis workspace.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: Image files in a controlled forensic workspace.

2. 02

   Use Ghiro on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Ghiro is a lead source unless the underlying record itself is authoritative.

An image file

Open a copy of the image, inspect metadata and multiple forensic transforms, compare findings across methods, and document uncertainty rather than relying on one visual artifact.

1. 01

   Preserve the original file or original public URL first. Work from a copy. Starting input: An image file.

2. 02

   Use Sherloq on the full image and, where useful, on crops containing distinctive faces, signs, buildings, objects, or textures.

3. 03

   Compare publication dates, source pages, metadata, and visual details. Missing metadata is not evidence of manipulation because platforms often strip it.

4. 04

   Treat forensic filters and face-similarity results as indicators, not verdicts; seek independent confirmation from chronology, geography, or primary-source context.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Sherloq is a lead source unless the underlying record itself is authoritative.

A public video URL, image, or social-media post

Extract keyframes from the video, reverse-search several distinct frames, inspect metadata/context tools, and compare upload chronology across platforms.

1. 01

   Preserve the original public URL or authorized file and note the upload time, account, title, and stated location. Starting input: A public video URL, image, or social-media post.

2. 02

   Use InVID Verification Plugin to extract keyframes, transcript, scenes, or detector outputs relevant to the question.

3. 03

   Reverse-search several distinct keyframes and compare the earliest known appearances rather than relying on one frame.

4. 04

   Test chronology, audio/visual continuity, geolocation clues, and any synthetic-media score against independent evidence; model scores are probabilistic.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. InVID Verification Plugin is a lead source unless the underlying record itself is authoritative.

A video you are permitted to upload

Upload only non-confidential or authorized footage, review transcript/scene/entity outputs as machine-generated aids, and verify important identifications manually.

1. 01

   Preserve the original public URL or authorized file and note the upload time, account, title, and stated location. Starting input: A video you are permitted to upload.

2. 02

   Use Azure AI Video Indexer to extract keyframes, transcript, scenes, or detector outputs relevant to the question.

3. 03

   Reverse-search several distinct keyframes and compare the earliest known appearances rather than relying on one frame.

4. 04

   Test chronology, audio/visual continuity, geolocation clues, and any synthetic-media score against independent evidence; model scores are probabilistic.

5. 05

   Record the source URL or command, retrieval time, relevant identifiers, and your confidence level. Azure AI Video Indexer is a lead source unless the underlying record itself is authoritative.