OSINT and AI Tools: Understanding and Using Open Source Intelligence

What this article covers

• A thorough explanation of OSINT: sources, methodology, and use cases.
• The classic OSINT tools everyone should know.
• The new generation: AI tools for facial recognition, geolocation, and analysis.
• Your own digital footprint: using OSINT against yourself as a defensive measure.
• Legal boundaries, GDPR, and common mistakes.

What is OSINT? The detailed breakdown

OSINT stands for Open Source Intelligence. It describes the systematic collection and analysis of publicly available information. The key word is “public”: OSINT relies exclusively on sources accessible to anyone, without breaking into systems, bypassing access controls, or stealing data.

The discipline originated in intelligence work. During World War II, intelligence agencies analyzed newspapers, broadcasts, and public documents. Studies consistently estimated that 80 to 90 percent of actionable intelligence came from open sources. Most of what you need to know about a target is already public somewhere. The internet amplified this principle dramatically. Today, a single email address or username is enough to build a surprisingly complete picture of a person or organization within hours.

Typical OSINT sources:

• Search engines and advanced operators (Google Dorks)
• Social media, forums, comment sections, old posts
• Public registries: business records, WHOIS, company directories
• Metadata in files and images (EXIF, document properties)
• Data breach databases and public leaks
• Archives like the Wayback Machine that preserve deleted content
• Technical sources: DNS, certificate transparency, Shodan for internet-connected devices
• Geolocation data: satellite imagery, Street View, mapping services

Who uses OSINT: Journalists conducting investigations (Bellingcat popularized the discipline), security researchers assessing their own attack surface, pentesters during passive reconnaissance, companies performing due diligence, lawyers gathering evidence, and unfortunately stalkers and fraudsters. The same techniques, different motivations.

Classic OSINT tools

Before AI entered the picture, the toolkit looked like this:

• Maltego: The standard for visual link analysis. Entities (people, domains, emails, IPs) become nodes; relationships become edges. Automated transformations pull data from multiple sources. Essential for visual investigators.
• theHarvester: Collects emails, subdomains, hosts, and names associated with a domain from search engines and public sources. The default starting point for any passive reconnaissance.
• Shodan: A search engine for devices. Finds exposed servers, webcams, industrial controllers, and anything connected to the internet, including your own forgotten services.
• SpiderFoot: An automated OSINT framework. Enter a domain, IP, or name, and SpiderFoot queries hundreds of sources and correlates the results.
• Sherlock: Searches for a username across 400+ platforms and returns a list of all accounts using that handle.
• Holehe: Checks which services a given email address is registered with, using password reset functions to enumerate accounts.
• GHunt: Specializes in Google accounts. Shows what a Gmail profile exposes publicly, including reviews, photos, and Maps activity.
• Recon-ng: A modular reconnaissance framework with Metasploit-style command handling and a database for storing all findings.
• OSINT Framework: Not software, but a curated map of all OSINT sources and tools. The starting point for any investigation.
• Time-tested basics: Google Dorks, Wayback Machine, HaveIBeenPwned, ExifTool, WHOIS, and crt.sh for certificate logs.

The AI revolution in OSINT

AI has dramatically accelerated OSINT in three key areas:

1. Facial recognition and image search. PimEyes is the most well-known reverse face search tool. Upload a photo, and the system finds that face across indexed public web content. Additional tools handle deepfake detection and image forensics. Our article Detecting AI-Generated Media covers the reverse direction.

2. Geolocation powered by AI. Models like GeoSpy and open-source projects like Netryx Astra estimate a photo’s location from a single image: vegetation, architecture, road markings, sun position. Open-source pipelines use models like MegaLoc and MASt3R to match images against Street View databases, sometimes pinpointing location to within meters. What once required a GeoGuessr world champion, an AI model can now do.

3. LLM-driven analysis and orchestration. The real leap forward: AI agents now automate entire research workflows. Projects like OSINT-AI-Agent give an LLM access to tools like Holehe, Sherlock, and GHunt. You provide an email or username, and the agent orchestrates the tools, correlates findings, infers locations from review data, and writes the dossier. Larger frameworks like estorides parallelize 99+ sources, construct knowledge graphs, and have an LLM analyst write the bottom-line-up-front summary. Custom systems like J.A.R.V.I.S combine scraping from 15+ platforms with local LLMs, facial comparison, and automated dossier generation.

Alongside this, conventional AI use cases persist: LLMs translate foreign-language sources, extract entities from documents, summarize social media history, and write investigation reports.

OSINT against yourself: The most important use case

The most honest application of OSINT is self-testing. What can a stranger discover about you in 30 minutes? Concretely:

1. Run your own email and usernames through Holehe and Sherlock to uncover forgotten accounts.
2. Google your own name using Dorks: "your name" filetype:pdf, "your name" site:forum.de.
3. Check the Wayback Machine for old domains and deleted profiles.
4. Run HaveIBeenPwned on your addresses, and change any leaked passwords immediately.
5. Search Shodan for your IP and domain to find exposed services you forgot about.
6. Check metadata in photos you’ve shared publicly. EXIF data reveals location and device information.
7. Run your photo through PimEyes, if you want to know where your face appears across the web.

The results are almost always surprising: old forum accounts under your real name, a leak with a password you reused, an exposed test server. Each finding is a vulnerability you can close before someone else exploits it.

Legal boundaries and ethics

OSINT operates in a gray zone between legitimate research and stalking:

• Public doesn’t mean permitted. Data from breaches is publicly accessible, but processing it can still be illegal. The GDPR applies to public data in the EU.
• Against yourself and your own systems: always allowed. Self-testing is unproblematic.
• Against others: context matters. Journalistic investigation, commissioned security assessments, and due diligence are legitimate. Doxing, harassment, and profiling others without cause are not.
• Breach data requires care. Viewing is one thing; using it (attempting logins, sharing it) is another.
• Prompt injection applies here too. AI agents reading external web content can pick up malicious text. Tool output remains untrusted data.

Common OSINT Pitfalls

Treating AI output as fact. Models hallucinate, especially with personal data. Every AI conclusion is a hypothesis you must verify against primary sources.

Name collisions. “Thomas Müller” matches thousands of people. Without correlation across multiple attributes (location, employer, handles), any match is worthless or wrong.

Confirmation bias. If you know what you’re looking for, you’ll find it, true or not. Actively search for counter-hypotheses.

Leaving your own traces. Profile visits on platforms are visible to the target. Use separate accounts and avoid your personal browser identity.

Forgetting OSINT works both ways. What you find about others, they can find about you. Make self-checks a regular habit.

Further Reading on OSINT and Security

• IRC-Security.de - Cybersecurity, protecting your digital footprint, and server hardening.
• IRC-Coding.de - Building your own OSINT scripts and agents.
• IRC-Mania.de - Networking and technical fundamentals.
• IRC-FAQ.de - Quick answers.
• IRC-FAQ.com - International FAQs.
• OSINT Framework - The complete map of OSINT sources.
• Bellingcat - The gold standard for investigative OSINT research.

Related articles on BotServ.de: AI in Cybersecurity, Detecting AI-Generated Media, Hardening Linux Servers, and Kali MCP.

FAQ: OSINT - Common Questions

What is OSINT in simple terms?

Open Source Intelligence: the systematic collection of publicly available information from search engines, social networks, registries, metadata, and archives. No hacking involved, just analyzing what’s already out in the open.

Is OSINT legal?

On yourself and with authorization: yes. On others, it depends on the purpose. Journalism and security assessments are legitimate; doxing and stalking are illegal. Public access does not automatically mean you can use it; GDPR applies to open data too.

What are the most important OSINT tools?

Maltego for link analysis, theHarvester and SpiderFoot for automated collection, Shodan for exposed devices, Sherlock for usernames, Holehe for emails, the Wayback Machine for historical snapshots, and the OSINT Framework as your starting point.

What can AI tools do in OSINT?

Three things stand out: facial recognition (PimEyes), photo geolocation (GeoAI tools like GeoSpy or Netryx), and LLM agents that run complete investigations autonomously, orchestrate tools, and generate dossiers.

How do I find out what’s publicly known about me?

Self-OSINT: check your email with Holehe and HaveIBeenPwned, search usernames via Sherlock, Google your name with dorks, check the Wayback Machine for old profiles, run Shodan on your IP, and inspect EXIF data in shared photos.

Can AI OSINT tools make mistakes?

Constantly. Models hallucinate facts, confuse namesakes, and confirm biases. Every AI claim is a hypothesis that must be verified against primary sources before it informs any judgment.

How do attackers use OSINT?

For targeted attacks: email lists for phishing, exposed systems via Shodan, leaked passwords from breaches, organizational hierarchies for social engineering. Self-checks show you what they would find about you.

What’s the difference between OSINT and penetration testing?

OSINT is passive: you only analyze what’s public without touching target systems. Penetration testing is active: you test and exploit real systems. OSINT is often the first phase of a pentest.