Skip to main content
Osintly works for complete beginners running a one-off search and for experienced analysts managing multi-target investigations. The workflows below cover the most common scenarios. Each one gives you a concrete sequence you can follow right now, whatever your background.
Always ensure your use of OSINT tools complies with local laws and your jurisdiction’s regulations on data collection and privacy.

Use cases

Tracking an individual from a username

A handle found on a forum, a Telegram username, a Reddit account. This is often where investigations start.
1

Run a pseudonym search

Go to Search, select Pseudonym, and enter the handle. Results stream in from social platforms, forums, and leak databases.
2

Identify linked emails or phone numbers

Check the module cards for associated contact data. If you find an email, run a new Email search in the same project to expand the profile.
3

Stack searches across modules

Layer results: username to email to phone to IP. Each layer adds context and confirms or rules out connections between accounts.
4

Review breach exposure

The Leaked Results and Breached Accounts panels show what data appeared in known breaches: password hashes, previous IPs, service names.
5

Generate a timeline with AI Analyst

Open the AI Analyst chat and ask it to build a chronological timeline from the results. Useful for establishing account creation dates and activity patterns.
AI Analyst is available on Pro and Advanced plans.

Investigating a suspicious email address

You received a phishing email, a threat, or a contact request you cannot verify. The email address is your starting point.
1

Run an email search

Select Email and paste the address. The search checks breach databases, registered accounts, and social profiles at the same time.
2

Check Registered Accounts

The Registered Accounts panel lists services where this email has an active account. It tells you a lot about the person behind it.
3

Review breach history

Breached Accounts shows which data breaches included this address and what fields were exposed: password hash, username, IP, and more.
4

Pivot to the domain

If the email uses a custom domain rather than Gmail or Outlook, run a Domain search to understand the infrastructure behind it.
If the email appears in multiple breaches with different associated usernames, search each username separately for a broader profile.

Mapping suspicious infrastructure

You have a domain or IP from a malware sample, a C2 server, or a suspicious redirect. You need to understand what is behind it.
1

Start with the domain

Select Domain and enter the root domain. Review DNS records, subdomains, WHOIS registration data, and linked IPs.
2

Pivot to each IP

For every IP discovered, run a new IP address search. Check ASN, hosting provider, geolocation, and threat intelligence signals.
3

Use the map view

Geographic clustering of IPs can reveal whether infrastructure is centralized or deliberately spread across jurisdictions.
4

Set up a monitor

If the domain is active, create a monitor to get alerted when new DNS records, subdomains, or IP changes appear.
Monitoring is available on Pro and Advanced plans.

Tracing a cryptocurrency wallet

A wallet address appears in a fraud report, a ransom payment, or a transaction you need to understand.
1

Run a cryptocurrency search

Select Cryptocurrency and paste the full wallet address. Osintly returns transaction history, linked addresses, and risk signals.
2

Identify linked wallets

Follow the transaction graph to find wallets that sent or received funds from this address.
3

Cross-reference with other modules

If exchange addresses or usernames surface in the results, run parallel searches on those identifiers.

Corporate due diligence

You are evaluating a potential partner, supplier, or acquisition target and need a broad picture quickly.
1

Start with the company domain

A Domain search surfaces WHOIS registration history, hosting details, subdomains, and any breach exposure linked to the company’s infrastructure.
2

Search key personnel emails

If you have emails for founders or executives, run Email searches to check for breach exposure or linked accounts.
3

Monitor for changes

Set a domain monitor to track infrastructure changes, new subdomains, or data leak appearances going forward.
4

Export a report

Use Export to PDF or DOCX to produce a structured deliverable for internal review or legal counsel.
Export formats depend on your plan. See Billing & Plans.

Verifying an anonymous source

A source contacts you via a pseudonymous account. You need to assess credibility without revealing your investigation.
1

Mask your query first

Enable Mask query from result page title in Search Settings. This keeps the search term out of browser history and tab titles.
2

Search the pseudonym

Run a Pseudonym search on the handle, username, or account name provided.
3

Check account age and activity patterns

Module cards surface account creation dates, post history, and activity across platforms. A freshly created account with no activity history is a clear signal.
4

Use AI Analyst to summarize

Ask the AI to summarize all signals into a credibility assessment. You can ask follow-up questions directly in the chat.

Need help?