OSINT Investigation Techniques: A Step-by-Step Guide
In short: An OSINT (open-source intelligence) investigation uses information anyone can lawfully access, such as websites, social media, archives and public records, to answer a specific question. The core techniques are: plan the question, search precisely, preserve what you find, verify it, trace who is behind it, and map how it spreads. Debunk.org uses these steps to investigate disinformation and scam networks.
Want structured training? Start FIMI 101 → debunkacademy.org Get new investigations by email → debunk.org/subscribe
Also known as: open-source investigation; OSINT methodology; digital open source investigation.
Key facts
Open source information is "publicly available information that any member of the public can observe, purchase or request without requiring special legal status or unauthorized access", according to the Berkeley Protocol (UN OHCHR and UC Berkeley).
The Berkeley Protocol divides a digital open source investigation into six phases: online inquiries, preliminary assessment, collection, preservation, verification and investigative analysis.
Preserving evidence (screenshots and archived copies with the date and address) comes before analysis, because influence and scam content is often deleted within hours.
Analysts separate strong links between accounts or websites, such as a shared tracking code, from weak ones, such as a shared hosting company.
Debunk.org analysis of a Facebook ad network, September 2023 – September 2024: open-source techniques linked nearly 3,000 dubious ads to 70 domains and 246 Facebook pages.
Debunk.org checks of delfi[.]life, a clone of the Latvian news site Delfi listed by France's VIGINUM, 23 October 2026: certificate logs show it was set up in June–August 2022, and registration data shows the domain is no longer registered.
Debunk.org analysis of Operation Overload emails received, September 2023 – July 2026: 1,166 emails, 97.9% of them sent Monday to Friday, a working-week pattern visible only after systematic collection.
Updated October 2026 · By Debunk.org, an independent non-profit that researches disinformation
Contents: What is an OSINT investigation? · Free tools for each step · 1 Define the question · 2 Search precisely · 3 Preserve the evidence · 4 Verify · 5 Trace who is behind it · 6 Map the network · 7 Analyse and report · Real cases · Ethics and safety · FAQ · Sources
What is an OSINT investigation?
An OSINT investigation answers a specific question using only information that anyone can lawfully access.
The Berkeley Protocol, the UN-backed standard for digital open source investigations, defines open source information as "publicly available information that any member of the public can observe, purchase or request without requiring special legal status or unauthorized access". [1] Open source intelligence is the part of it that is collected and analysed to answer a particular question. [1]
The protocol sets out an investigation cycle of six phases: online inquiries, preliminary assessment, collection, preservation, verification and investigative analysis. [1] The steps below follow the same logic, applied to disinformation.
Free tools for each step
Every step below can be done with free tools; we tested 19 of them and list them by category on a separate page.
See Free OSINT tools: 19 we tested for archives, reverse image search, domain and website checks, ad libraries and sanctions databases, each with what it does and the date we tested it.
Get new investigations by email. debunk.org/subscribe
Next: the most-asked OSINT question is "who is behind this website?": see how to find out who owns a website.
How to do an OSINT investigation: 7 steps
An OSINT investigation moves through seven steps, from a clear question to a sourced report; each step below says what to do and which free tools help.
Step 1: Define the question
A good OSINT investigation starts with one clear question, such as "Who runs this website?" or "Are these accounts coordinated?".
Write the question down, with what would answer it and what would not. "Is this campaign Russian?" is too broad to answer from open sources; "Do these 40 accounts share creation dates, images and posting times?" can be checked. A clear question also tells you when to stop.
Step 2: Search precisely
Precise search operators find what general searches miss.
Google's own help pages list operators such as: [2]
"exact phrase" in quotation marks, for a slogan or a sentence copied between sites;
site: to search one website or platform (site:example.com "keyword");
minus (-) to exclude a word;
filetype: to find documents such as PDFs;
before: / after: to limit results by date.
Search in the languages of the target audience, not only in English: an operation aimed at Lithuania will use Lithuanian keywords. Platform search, ad libraries and reverse image search (step 4) add what web search can't see.
Step 3: Preserve the evidence
Save every piece of evidence with its address and date before you analyse it, because influence and scam content disappears fast.
Take a full-page screenshot that shows the address and the date.
Save the page in the Wayback Machine ("Save Page Now") or another archive.
Record the link, the date and time you saw it, and how you found it in a simple log.
In Debunk.org's analysis of a Facebook scam-ad network, most ads stayed online for only a day or a few days; by the time of publication, none of the 70 domains could still be reached. [3] Without preserved copies, there would have been nothing left to analyse.
Step 4: Verify
Verification checks whether content is what it claims to be: who made it, when, where and whether it was altered.
Reverse image search (Google Lens, Bing Visual Search, Yandex Images) shows where an image appeared before. An old photo reused for a new event is one of the most common fakes.
Check the source: is it the outlet it claims to be? Cloned news sites copy a real outlet's design on a lookalike address.
Check the date and place: shadows, weather, signs and landmarks should match the claimed time and location.
Check for AI generation: see our guide how to tell if an image is AI-generated.
Step 5: Trace who is behind it
Tracing ownership means following a website's or account's technical and behavioural traces back to whoever controls it.
For websites: registration data (WHOIS/RDAP), archived versions, tracking codes, security certificates and hosting. Our step-by-step guide how to find out who owns a website covers each one.
For social media accounts and pages: creation date, name changes, the countries of page administrators (shown in Meta's page transparency section and the Meta Ad Library), profile photos (reverse-searched), and which other accounts they interact with.
Step 6: Map the network
Network mapping shows whether accounts and websites act together, which separates a coordinated operation from people who happen to agree.
Look for:
many accounts created within a short period;
the same text, images or links posted within minutes;
activity that follows one working day or one time zone;
websites that share a tracking code, a security certificate or a registration batch;
the same content moved from platform to platform to look independent.
Weigh each link: a shared tracking code is strong, a shared hosting company is weak. One strong link, or several independent medium ones, is needed before you call accounts or sites connected. Our guide to bot farms and troll farms lists the signs of coordinated fake accounts.
Step 7: Analyse and report
The final step turns evidence into findings: what happened, who is likely behind it, how far it spread and how sure you are.
Analysts structure findings with shared frameworks:
the ABCDE framework: actor, behaviour, content, degree, effect;
the DISARM framework: a code for each technique;
the Breakout Scale: how far an operation spread.
Say what you could not find out, and how confident you are. Quote false claims as claims, and never reshare fakes without a clear label.
Practise these techniques on real cases. FIMI 101 teaches OSINT checks, the ABCDE and DISARM frameworks and how to document an influence operation. → Start FIMI 101
Worked case: tracing a clone of a Baltic news site
Three free checks show the life of a fake news domain without any special access.
Doppelganger, a Russian influence operation, cloned European news websites on lookalike addresses. [6] France's VIGINUM published the addresses it found, including delfi[.]life, which imitated the Latvian edition of the news site Delfi. [7] On 23 October 2026, Debunk.org ran three of the checks above:
Certificates (crt.sh): the certificate log lists 59 certificates for the domain. Certificates issued in June and August 2022 match the period when Doppelganger launched its clone sites; one names the subdomain "www-delfi-lv", mirroring the real Latvian address. Earlier certificates (2020–2021) and later ones (2025–2026) show the domain had other uses before and after.
Registration (RDAP): the registry returns "not found": the domain is no longer registered. Dead domains are common in this work, which is why certificates and archives matter.
Archives (Wayback Machine): only four captures exist, all from April 2025, long after the operation was exposed. Clone sites are often blocked or geo-fenced, so archives can miss them.
What this shows: you can date a clone site's active period and see it change hands with free tools, even when the registration record is gone. What it doesn't show: who ran it. That attribution comes from official investigations (the EU, the US and others name Russia's Social Design Agency). [6]
Defanged address: [.] stops the link from working. Data saved with checksums in our files.
Real cases from Debunk.org's investigations
Debunk.org applies these techniques to scam networks and foreign influence operations.
Case | Techniques used | What they showed |
Bust-AD: fake ads on Facebook (December 2024) | Ad library collection, domain checks, page transparency | Nearly 3,000 dubious ads, 70 domains and 246 Facebook pages, reaching nearly 6 million users across Europe; of the 114 pages that showed administrator locations, 105 had administrators in Lithuania, 88 in the USA and 42 in Ukraine (pages can have several) [3] |
Fake "Interpol compensation" site (2025) | Registration lookup, hosting check, ad library | A one-year domain created on 7 January 2025; 278 ads in five weeks; hosting shared with over 700 sites linked to phishing [4] |
Operation Overload (2023–2026) | Systematic collection and preservation of emails, timing analysis | 1,166 emails to Debunk.org; 97.9% sent Monday to Friday [5] |
Ethics and safety
Ethical OSINT means using only lawfully accessible information, protecting the people you research and protecting yourself.
Don't hack, guess passwords or use leaked databases.
Don't pose as someone else to get into closed groups.
Don't publish private people's personal data; name organisations, or people only when an official body has named them.
Protect yourself: keep your research accounts and devices separate from your personal ones, and be careful with links and attachments from the operations you study.
The Berkeley Protocol also covers investigators' "digital, physical and psychosocial" security. [1]
FAQ
What are OSINT techniques? Methods for finding, preserving, verifying and analysing publicly available information: precise searching, archiving, reverse image search, domain and account checks, and network mapping.
How do I start an OSINT investigation? Write down one specific question, then search, preserve everything you find with its address and date, and verify before you analyse.
Is OSINT legal? Collecting publicly available information is generally legal, but how you obtain and use it matters: no unauthorised access, no deception, and care with personal data. This is general information, not legal advice.
What is the difference between OSINT and fact-checking? Fact-checking asks whether a claim is true. An OSINT investigation can also ask who is spreading it, how, and with what infrastructure.
Do I need paid tools for OSINT? No. Most of the techniques above use free tools; paid services add scale and history.
Written by Debunk.org. Updated October 2026. Debunk.org is an independent non-profit that researches disinformation and FIMI and an EU Digital Services Act trusted flagger.
Sources
UN OHCHR and Human Rights Center, UC Berkeley School of Law, Berkeley Protocol on Digital Open Source Investigations, United Nations, 2022 (HR/PUB/20/2), §I paras 14–15 and Part VI (investigation cycle). https://www.ohchr.org/sites/default/files/2024-01/OHCHR_BerkeleyProtocol.pdf (accessed 23 Oct 2026)
Google, Refine Google searches (Google Search Help). https://support.google.com/websearch/answer/2466433 (accessed 23 Oct 2026)
Debunk.org, Bust-AD: Fake ads infestation on Facebook, 9 December 2024. https://www.debunk.org/bust-ad-fake-ads-infestation-on-facebook
Debunk.org, Bust-AD: Russian-backed deepfake of a Lithuanian 3 Plus news reporter appears on Facebook…, 2 June 2025. https://www.debunk.org/bust-ad-russian-backed-deepfake-of-a-lithuanian-3-plus-news-reporter-appears-on-facebook-urging-s
Debunk.org, Operation Overload: Debunk.org's case (Parts I–III, 2024–2026). https://www.debunk.org/operation-overload-debunk-org-s-case
Debunk.org, Doppelganger profile, with its sources.
VIGINUM, RRN: A complex and persistent information manipulation campaign, technical report and STIX data, 2023. https://github.com/VIGINUM-FR/Rapports-Techniques (accessed 23 Oct 2026)
Comments