OSINT link collection

Over time I’ve collected many useful links and small HOWTOs which I use during my OSINT investigations. They go
from very basic search techniques to more advanced social media data collection procedures. I will try to keep the
below list up to date but as always I do not take any responsibilities for any broken links. The (internet) world changes
just too fast.

Search Engines
Special Search Operators
Search only on a specific website:

site:cnn.com “Olympic Games”

Search only for certain file types:

“Digital Forensics” filetype:pdf

“OSINT” filetype:pptx
Refine your search by exluding search terms:

“Michael Jordan” -basketball

“Michael Jordan” -basketball -nba

FTP Searches
Only look on FTP sites:

inurl:ftp -inurl:(http|https) “Hacking Manual”

There are various services online which have indexed the content of public FTP sites. Some of them are:

 Global File Search (http://globalfilesearch.com)

 File Mare (http://filemare.com)
 Napalm FTP (http://searchftps.org)
 Mamont (http://mmnt.ru)

Google Custom Search Engines

Google lets you create your custom search engine. You can build a dedicated search interface to only search on
social network sites or specifically look only for certain file types. The following steps are needed to create your
custom search engine:

1. Go to http://www.google.com/cse
2. Log on or create your own Google account
3. Type in all websites you would like to include in your search.
4. Add your search terms
5. Save your settings => you will now get your personal search URL
 Search Monitoring Sites
Quite handy is a feature that allows you to actively monitor new search results. If you are interested in a certain topic
and you would like to see what’s new on the web you can use one of the following monitoring services:

 Google Alerts (http://google.com/alerts)

 Talk Walker Alerts (http://talkwalker.com/en/alerts)
You are going the receive an alert email as soon as the monitoring tracker indexed a new site/article about your topic.

Web Archive
If you need to go back in time and investigate how a website had looked in the past, check out web archives:

 Google Cache => Use the drop-down next to a search result (http://www.google.com)
 Bing Cache => Use the drop-down next to a search result (http://www.bing.com)
 Archive.is (http://archive.is)

Image Searching
If you are more interested in pictures rather than text, use one of the following image search engines:

 tineye (http://tineye.com)
 Google Images (http://images.google.com)
 Global File Search (http://globalfilesearch.com)
 Ice Rocket (http://icerocket.com)

TOR Search Engines

There are also a few search engines available that claim to cover darknet content. As hidden services are on- and
offline very dynamically in the tor network, search results are not always reliable.

 Ahmia (http://www.ahmia.fi)
 Onion Cab (http://www.onion.cab)
 Onion Link (http://www.onion.link)
 Tor2Web (http://www.tor2web.org)
 Not Evil (https://hss3uro2hsxfogfq.onion.to)
 TORCH (https://xmh57jrznw6insl.onion.to)

General Social Media Search Engines

Next to many other search engines on the web, there are two sites I use quite often for social media searches:

 Social Searcher (http://www.social-searcher.com)

 HashAtIt (http://www.hashatit.com)
 Useful Facebook Search Hacks
Facebook actually allows you by slightly modifing the URL to search for certain things. For most of the searches you
need to be logged in to Facebook with a valid user profile. Here are a few examples:

Search for a name

Look for a user called “Hans Muster”:

https://www.facebook.com/search/str/Hans%20Muster/users-named

Employment searches
People currently working for a company called “Apple”:

https://www.facebook.com/search/str/Apple/pages-named/employees/present
People who worked for “Apple”:

https://www.facebook.com/search/str/Apple/pages-named/employees/past
Employees with a certain name (in the example: “Hans Muster”) working for “Apple”:

https://www.facebook.com/search/str/Hans%20Muster/users-named/str/Apple/pages-
named/employees/past/intersect

Location Based Searches

All facebook users who live in “Berlin”:

https://www.facebook.com/search/str/berlin/pages-named/residents/present
All facebook users with a certain name (e.g.: “Carl”) who live in “Berlin”:

https://www.facebook.com/search/str/berlin/pages-named/residents/present/str/Carl/user-
named/intersect

Search For Likers

Search for people who like a particular brand, product, artist, etc:

https://www.facebook.com/search/str/apple/pages-named/likers
Show all people who checked-in at “Crossfit Mayhem”:

https://www.facebook.com/search/str/crossfitMayhem/pages-named/visitors

More Advanced Facebook Searches

For the following searches, you need the facebook profile ID of your suspect (http://seotoolstation.com/bulk-facebook-
id-finder).

 Photos liked: https://www.facebook.com/search/PROFILE-ID/photos-liked

 Photos by: https://www.facebook.com/search/PROFILEID/photos-by
 Photos of: https://www.facebook.com/search/PROFILEID/photos-of
 Photos commented: https://www.facebook.com/search/PROFILEID/photos-commented
 Places visited: https://www.facebook.com/search/PROFILEID/places-visited
 Places liked: https://www.facebook.com/search/PROFILEID/places-liked
 Places checked-in: https://www.facebook.com/search/PROFILEID/places-checked-in
 Friends: https://www.facebook.com/search/PROFILEID/friends
 Events joined: https://www.facebook.com/search/PROFILEID/events-joined
 Stories by: https://www.facebook.com/search/PROFILEID/stories-by
 Stories commented: https://www.facebook.com/search/PROFILEID/stories-commented
 Stories tagged: https://www.facebook.com/search/PROFILEID/stories-tagged
This does also work with your suspect’s facebook friends, if certain settings of the facebook user profile is set to
public:

 Photos liked: https://www.facebook.com/search/PROFILEID/friends/photos-liked

 Photos by: https://www.facebook.com/search/PROFILEID/friends/photos-by
 Photos of: https://www.facebook.com/search/PROFILEID/friends/photos-of
 Photos commented: https://www.facebook.com/search/PROFILEID/friends/photos-commented
 Places visited: https://www.facebook.com/search/PROFILEID/friends/places-visited
 Places liked: https://www.facebook.com/search/PROFILEID/friends/places-liked
 Places checked-in: https://www.facebook.com/search/PROFILEID/friends/places-checked-in
 Friends: https://www.facebook.com/search/PROFILEID/friends/friends
 Events joined: https://www.facebook.com/search/PROFILEID/friends/events-joined
 Stories by: https://www.facebook.com/search/PROFILEID/friends/stories-by
 Stories commented: https://www.facebook.com/search/PROFILEID/friends/stories-commented
 stories tagged: https://www.facebook.com/search/PROFILEID/friends/stories-tagged

Search for email addresses

Facebook allows you to search for email addresses:

https://www.facebook.com/search/results.php?q=carl.meyer@company.com

Search with mobile phone number

Facebook recovery services is one of the biggest mobile phone books worldwide. If you have a number and you
would like to know who is behind this number, give it a try by using Facebooks recovery service:

https://www.facebook.com/login/identify?ctx=recover
 Useful Twitter searches
Twitter also gives you the opportunity to use advanced search techniques. First address is Twitters very own
advanced search feature:

http://www.twitter.com/search-advanced

Search by location
Search for tweets which are posted at a certain location:

https://twitter.com/search?q=geocode:59.3325800,18.064900,1km

Date Range Searches

Search for tweets of a twitter user within a specific date range:

https://twitter.com/search?q=gfrom=NICKNAME since:2010-01-01 until:2010-12-31

https://twitter.com/search?q=gfrom=NICKNAME since:2011-01-01 until:2011-12-31
https://twitter.com/search?q=gfrom=NICKNAME since:2012-01-01 until:2012-12-31

First use of a hashtag

Maybe not useful but still very interesting

http://ctrlq.org/first

Search for deleted twitter accounts

Twitter does not save any deleted user. But you can actually use web archives to look for any deleted accounts.
Search for:

site:twitter.com/NICKNAME

Image & Video Analysis

If you rather want to look for images / photos than text, there are a few very good image & video analysis services out
there.

Reverse Image Searches

Search for any particular picture. Just upload the picture or photo you are looking for and see where else the same
photo is hosted.

 Google Images (http://images.google.com)

 Bing Images (http://bing.com/images)
 Tin Eye (http://tineye.com)
 Yandex (http://images.yandex.com)
 Baidu (http://stu.baidu.com)
 FindFace (http://findface.me)
If you have multiple pictures, try this:

 Image Raider (http://imageraider.com)

Online EXIF Search

If you are interested into the metadata of a picture, try this online EXIF viewer from Jeffrey:

 Jeffrey’s EXIF Viewer (http://regex.info/exif.cgi)

Camera Trace Search Engine

There is also a search engine to look for pictures of any particular camera model.

 Camera Trace (http://cameratrace.com/trace)

Image Manipulation Check

If you would like to check whether a picture was manipulated / modified or not, try one of the following services.
(Attention: check first what pictures are you going to upload. Do not violate any data privacy rules)

 Foto Forensics (http://fotoforensics.com)

 Izitru (http://izitru.com)

YouTube Restrictions umgehen

If you need access to a YouTube video which is restricted in your area, try the following:

 Restricted video: http://www.youtube.com/

 Unlocked video: http://www.pnwyoutube.com/

Domain Name Investigation

Those links should actually go to the bookmark section of any OSINT investigator.

WHOIS Searches
 Domain Big Data (http://www.domainbigdata.com)
 IP Location Finder (http://www.iplocation.net)
 CentralOps WHOIS (http://centralops.net/co/)
 Hosterstats WHOIS (http://www.hosterstats.com)
 Who.is (http://www.who.is)
 reg.com WHOIS (http://www.reg.com/whois/)
 Domaintools WHOIS (http://whois.domaintools.com)
 Heise WHOIS (http://www.heise.de/netze/tools/whois)
If you need an explanation how to interpret the output of a WHOIS record, this site may help you:

 Gadget WHOIS Interpreter (http://gadget.stringcodes.com/quis/q-interpret.html)

 Online Port Scanner
ViewDNS does show you all open ports of a particular website:

 ViewDNS Reverse IP (http://viewdns.info/reverseip)

Domain History
Always useful if you need to know the history of domain holders:

 ViewDNS IP History (http://viewdns.info/iphistory)

Online Traceroute Tool

 ViewDNS TraceRoute (http://viewdns.info/traceroute)

TOR Relay Search

Check if a particular IP adress works as a TOR relay service:

 Exonera TOR (https://exonerator.torproject.org)