OSINT Techniques in Practice: How a Scoped Case Runs
Four steps, in a fixed order. The order is the product: the scope is recorded before anything is collected, and every finding is emitted with its evidence attached rather than assembled afterwards.
- Scope first, collection second.
- Passive collection only.
- Every finding carries its record.
- The report is the native output.
A case, from authorization to artifact
The four steps, in the order they have to happen.
-
Step 1
Declare the scope
Before any collection, and that ordering is the whole point.
Subject, purpose, the basis on which you are assessing it, and what is explicitly out of bounds. It takes about ten seconds and it is stamped on the report header. A scope written first constrains the work: it tells you plainly that a director's personal accounts are outside a vendor infrastructure review, and you feel the boundary when you approach it. A scope written afterwards is a justification and reads as one to anybody reviewing the file.
Recorded Vendor due diligence, authorized, public sources only -
Step 2
Select the collection modules
Four modules, all on by default, each independently switchable.
DNS and mail posture. Registration through RDAP. Certificate and hostname surface. Hosting and infrastructure fingerprint. Turning a module off is itself part of the record, because the report then states what was not collected rather than leaving a reader to assume coverage you did not have.
Modules 4 of 4 enabled -
Step 3
Collect passively from public records
Nothing reaches the subject. No packet, no probe, no login attempt.
Collection reads what registries, public resolvers and transparency logs already publish. That boundary is what makes the work usable on a vendor or an acquisition target you have no authorization to test, and it is absolute: there is no active mode to switch on. Each record is retained exactly as returned, alongside the endpoint that answered and the UTC moment it answered.
Retrieved GET dns.google/resolve?name=_dmarc.example.com&type=TXT -
Step 4
Read derived findings, export the report
Records are not findings. The derivation is the work.
An SPF string and a DMARC string are two observations. Read together they produce one finding: the domain publishes anti-spoofing rules and enforces none of them, graded high, with both records attached. Nothing is invented and nothing is model-generated. The report is the native output, in PDF or DOCX, with the scope header, the findings, the negative findings and a method appendix a second analyst can reproduce.
Emitted severity | claim | raw record | source endpoint | UTC time
The guarantee, stated plainly
Passive collection only, with no active mode to turn on.
This is not a scanner. It reads public records. The distinction decides which assets you may legitimately assess without a signed testing agreement, which is why it is a commercial feature and not just an engineering choice.
Set out in full on the security page.
What it does
- Queries public DNS resolvers
- Reads RDAP registration records
- Reads certificate transparency data
- Reads public registry and corporate filings
- Records the endpoint and the UTC time of every retrieval
What it never does
- Port scan or probe an application
- Attempt authentication of any kind
- Send traffic a target would see as an attack
- Circumvent a rate limit, a control or a platform term
- Accept a person as a subject
Step four, in detail
How records become findings you can act on.
The middle column is the part a report has to show. A dump gives a reviewer nothing to disagree with, which sounds safer and is much weaker.
SPF ends in ~all, DMARC p=none
- The derivation
- Rules published, enforcement off, so receiving servers accept and report rather than reject
- The finding
- Domain can be spoofed in practice despite having anti-spoofing records
RDAP registration event 78 days ago
- The derivation
- Claimed trading history is inconsistent with the age of the primary domain
- The finding
- Counterparty claim is not supported by the registration record
No clientTransferProhibited status
- The derivation
- The registrar-level lock that blocks an unauthorised transfer is not set
- The finding
- Hijacking exposure on a domain carrying production mail
CAA query returns an empty answer
- The derivation
- No issuer restriction is published for the name
- The finding
- Any publicly trusted certificate authority may issue for this domain
Two independent nameserver providers
- The derivation
- The zone can be modified from two separate vendor accounts
- The finding
- Resilience gain, and a second privileged account inside scope
Every derivation above is one the DNS module and the registration module perform automatically. The techniques post covers how to do it by hand.
All four steps, in about twenty seconds
Run a case yourself.
Declare a scope, tick the authorization box, run a domain you are authorized to assess. Hover any finding to reveal the source endpoint and the UTC retrieval time. That reveal is the entire value proposition, taught by interaction rather than by copy.
The demo is a real subset of the product: it genuinely queries public DNS and RDAP from your browser. It does not do the registry or breach-exposure work the platform describes, and it does not pretend to.
Domain footprint sweep
passive collection only
Every finding will carry four things
- 1 Severity. What the record means for the decision in front of you.
- 2 The raw record. Exactly as the source returned it, unedited.
- 3 The source endpoint. The request that produced it, so it can be re-run.
- 4 The UTC retrieval time. Records change. Without this it is an assertion.
Reads dns.google and rdap.org from your browser. Nothing is sent to the domain you enter.
Tick the authorization box, then run the sweep. Enter the domain you are authorized to assess, then run the sweep. Run the sweep. The report lands here.
[]
Scope:
Analyst summary
Run one scoped sweep and see what a sourced finding looks like.
The demo is free, it takes a domain and never a person, and it produces the same evidence chain the paid report does.
- Passive collection only, from public sources.
- A domain, never a person. There is no input for one.
- Your case data stays yours. No card required.