Use cases
Tracking an individual from a username
A handle found on a forum, a Telegram username, a Reddit account. This is often where investigations start.1
Run a pseudonym search
Go to Search, select Pseudonym, and enter the handle. Results stream in from social platforms, forums, and leak databases.
2
Identify linked emails or phone numbers
Check the module cards for associated contact data. If you find an email, run a new Email search to expand the profile. In an active organization, keep both searches in the same investigation.
3
Pivot between identifiers
Layer supported searches from username to email, then inspect any discovered IP in IP Intelligence. Treat each association as a lead to verify, not proof of identity.
4
Review breach exposure
The Leaked Results and Breached Accounts panels show what data appeared in known breaches: password hashes, previous IPs, service names.
5
Generate a timeline with AI Analyst
Open the AI Analyst chat and ask it to build a chronological timeline from the results. Useful for establishing account creation dates and activity patterns.
AI Analyst is available on Pro and Ultimate plans.
Investigating a suspicious email address
You received a phishing email, a threat, or a contact request you cannot verify. The email address is your starting point.1
Run an email search
Select Email and paste the address. The search checks breach databases, registered accounts, and social profiles at the same time.
2
Check Registered Accounts
The Registered Accounts panel lists services where this email has an active account. It tells you a lot about the person behind it.
3
Review breach history
Breached Accounts shows which data breaches included this address and what fields were exposed: password hash, username, IP, and more.
4
Pivot to the domain
If the email uses a custom domain rather than Gmail or Outlook, inspect it with Domain Intelligence.
Mapping suspicious infrastructure
You have a domain or IP from a malware sample, a C2 server, or a suspicious redirect. You need to understand what is behind it.1
Start with the domain
Open Domain Intelligence and enter the root domain. Review DNS records, subdomains, registration data, and linked IPs.
2
Pivot to each IP
Inspect relevant IPs in IP Intelligence. Check ASN, hosting provider, approximate geolocation, and public threat signals.
3
Use the map view
Geographic clustering of IPs can reveal whether infrastructure is centralized or deliberately spread across jurisdictions.
4
Preserve a repeatable follow-up
Save the search in the correct workspace and repeat focused domain or IP checks when you need fresh DNS, subdomain, or IP data.
Eligible workspaces can schedule checks with Monitoring & Alerts.
Tracing a cryptocurrency wallet
A wallet address appears in a fraud report, a ransom payment, or a transaction you need to understand.1
Run a cryptocurrency search
Select Cryptocurrency and paste the full wallet address. Osintly returns transaction history, linked addresses, and risk signals.
2
Identify linked wallets
Follow the transaction graph to find wallets that sent or received funds from this address.
3
Cross-reference with other modules
If exchange addresses or usernames surface in the results, run parallel searches on those identifiers.
Corporate due diligence
You are evaluating a potential partner, supplier, or acquisition target and need a broad picture quickly.1
Start with the company domain
A Domain search surfaces WHOIS registration history, hosting details, subdomains, and any breach exposure linked to the company’s infrastructure.
2
Search key personnel emails
If you have emails for founders or executives, run Email searches to check for breach exposure or linked accounts.
3
Monitor for changes
If you have an active organization, save the domain search in an organization investigation. In Personal, find saved full searches in History. Repeat focused checks for fresh data, or create a monitor for scheduled checks when your workspace supports it.
4
Export a report
Use Export to PDF or another currently offered format (JSON, CSV, or Markdown) to produce a deliverable for internal review or legal counsel.
Export formats depend on your plan. See Credits & subscriptions.
Verifying an anonymous source
A source contacts you via a pseudonymous account. You need to assess credibility without revealing your investigation.1
Mask your query first
Enable Mask query from result page title in Search Settings. This keeps the search term out of browser history and tab titles.
2
Search the pseudonym
Run a Pseudonym search on the handle, username, or account name provided.
3
Check account age and activity patterns
Module cards surface account creation dates, post history, and activity across platforms. A freshly created account with no activity history is a clear signal.
4
Use AI Analyst to summarize
Ask the AI to summarize all signals into a credibility assessment. You can ask follow-up questions directly in the chat.
Need help?
Quickstart
Step-by-step guide to your first search.
Community
Ask questions and share techniques with other investigators.