Open Source Intelligence Training: A Practical Path

Open source intelligence training tends to be sold as a tool tour. Here are forty websites, here are the queries, go. People who learn that way end up able to run lookups and unable to answer the question that pays: what does this record actually mean for the decision in front of me.

The path below is the order that works, drawn from how the work is actually done rather than from a syllabus. It costs nothing beyond time, and every exercise in it can be run against infrastructure you own or a large public company, which keeps you on the right side of the ethics line while you are still learning where that line is.

Stage one: learn to read a record before you learn to find one

Start with DNS, because it is the record set with the highest ratio of meaning to effort, and because you can query it all day without touching anyone's systems.

1. Take your own domain. Pull A, AAAA, MX, NS, TXT and CAA. Write down, in a sentence each, what every record does.
2. Find the SPF record. Work out what the qualifier at the end means, and which senders it authorizes. Then explain why SPF alone does not stop a display-name spoof.
3. Pull the TXT record at _dmarc.yourdomain.com. Read the policy. If it says p=none, understand that the domain publishes rules and enforces none of them, and that this is the most common posture on the internet.
4. Look at your MX hostnames and name the mail provider from them. Then say what a phishing crew learns from that same record.
5. Check whether a CAA record exists. If not, note that any publicly trusted certificate authority may issue for your domain.

That exercise takes an hour and teaches more than a week of link collecting, because at the end of it you can look at six records and describe an organization's mail security posture out loud. That is an actual analytic skill. You can watch the same derivation run on the DNS lookup page and check your reasoning against it.

Stage two: registration data and what redaction left behind

Move to RDAP. Look up a domain you know well, then one registered recently, and compare. Pay attention to four fields: registration date, registrar of record, status codes and nameservers.

The exercise that builds intuition: pick five domains you have received cold email from, look up the registration date of each, and note how many were registered in the last ninety days. The correlation between domain age and unwanted mail is not subtle, and once you have seen it you will check registration age instinctively for the rest of your career.

Then learn the status codes properly. clientTransferProhibited absent from a business-critical domain is a hijacking exposure. redemptionPeriod is frequently the first visible sign that a company stopped paying its bills. The full table is on the WHOIS lookup page.

Stage three: the estate, not the asset

Single-record work is the warm-up. The discipline proper starts when you assemble a picture of an entire organization from public records and ask what it implies.

1. Search your own domain on crt.sh. Certificate transparency will list hostnames you did not know existed. Write down every one you cannot immediately account for.
2. Resolve each of those hostnames. Which still answer? A name in a log with no current DNS answer is history. A name that resolves is surface.
3. Look at the TXT records again, this time only for vendor verification strings. Most estates publish their entire SaaS vendor list this way without noticing.
4. Now write two paragraphs for a colleague who is not technical, describing what your organization exposes and which two things you would fix first.

Stage four: sourcing discipline

From this point on, never write down a finding without three things beside it: the raw record exactly as returned, the endpoint it came from, and the UTC time you retrieved it. Do it in a text file if you have nothing else.

This feels pedantic for about a week and then it saves you. Public records change. A DNS answer from Tuesday is not evidence of anything on Friday unless you can say it was Tuesday. The first time somebody challenges a finding you made three weeks earlier, the timestamp is the entire difference between a defensible answer and an apology. It is also the reason our report template puts the source and the retrieval time on every single line.

Stage five: the legal and ethical frame, learned properly

You cannot do this work competently without a working model of what makes collection lawful. Not legal advice, and not a substitute for your own counsel, but a frame you can reason with:

• Source. Is the information genuinely public, or is it behind an authentication boundary or a terms-of-service restriction you accepted?
• Purpose. Why are you collecting? Written down before collection, not reconstructed after.
• Jurisdiction. Whose law applies to the subject, to you, and to the data?
• Lawful basis. If personal data is involved, what is your basis under GDPR or the equivalent regime where you operate?

Practise on organizations and infrastructure, not on people. There is a version of this discipline that is stalking with better vocabulary, and the way you stay out of it is to build the habit of writing your purpose down before you start. Our FAQ answers whether OSINT is legal at more length, and the acceptable use boundary sets out exactly what we refuse.

Where to practise, safely

• Your own estate. Unlimited, authorized, and the findings are immediately useful to your employer.
• Large public companies. Public records about a listed company's infrastructure are exactly what the records are for, and nobody is harmed by a passive DNS query.
• Capture the flag exercises. TraceLabs runs missing-person CTFs with a real ethical frame, and the Sans and Bellingcat published exercises are well constructed.
• Bellingcat's online investigation toolkit and case write-ups, which teach verification reasoning better than any tool documentation.

What not to practise on: individuals, ex-partners, colleagues, or anyone who has not consented and about whom you have no lawful basis. That is not a training exercise, and treating it as one is how people end up on the wrong side of both the law and their own employer's disciplinary process.

What good looks like after six months

You can take a domain you have never seen, spend twenty minutes on public records, and produce a page that tells a risk manager whether to worry, with every claim traceable to a record and a timestamp. Not a tool count. Not a bookmarks folder. A page somebody can act on and a reviewer can check.

If you want to see the shape of that output before you can produce it yourself, the domain footprint demo runs the collection live and shows the finished form: severity, the raw record, the endpoint, the UTC retrieval time.