📚 OSINT Guides & Research

44 long-form guides for OSINT investigators — technique, edge cases, the current tooling landscape and the pitfalls. Every guide links straight to the tools that run it. Prefer to search? Press ⌘K (or Ctrl+K) anywhere on the site — guides are indexed alongside the tools.

Where can I find free OSINT guides? This hub indexes 44 free OSINT guides across 8 categories — the largest being Method & Reference (9 guides) and Surveillance & ALPR (8). Coverage runs from the Google Dorking Reference and Certificate Transparency log mining to Wayback Machine archive forensics, Maltego alternatives, dark-web OpSec and AI-agent/MCP investigation workflows. A keyword filter on this page narrows all 44 by topic.

🔍 Method & Reference 9 guides

How to actually run an investigation — operators, platforms, and what still works.

Google Dorking Reference (2026)
Operators, syntax and modern bypass techniques.
Username OSINT & Identity
Cross-platform attribution and pivoting.
Wayback Machine OSINT (2026)
Archive forensics, deep crawl tricks, edge cases.
Dark Web OSINT (2026)
Investigate the dark web safely: clearnet gateways, ransomware leak tracking, and OpSec.
AI-Agent OSINT & MCP (2026)
How autonomous AI agents and MCP servers now run investigations.
OSINT vs Professional Intelligence (2026)
How open tools democratized the classic intelligence disciplines — and where OSINT still can’t reach.
OSINT Tool Graveyard (2026)
Dead tools, their replacements, and why they died.
Search Engine Landscape (2026)
Where to actually look beyond Google in 2026.
Maltego Alternatives (2026)
SpiderFoot, Lampyre, Gephi and the free stack — split by which half of Maltego you actually use.

🌐 Domain, DNS & Network 6 guides

Infrastructure investigation — from a hostname to the machines and people behind it.

DNS Reconnaissance & Subdomain Discovery
Active and passive subdomain enumeration.
Certificate Transparency for OSINT
Mining CT logs for subdomain discovery.
WHOIS & RDAP Guide (2026)
Modern domain ownership lookup after privacy laws.
MAC & Network Forensics
Hardware identifiers and how to interpret them.
Geolocation OSINT
From IP to GPS — every breadcrumb a target leaves.
How to Find Backlinks (2026)
Every link: operator is dead. What still works, which paid index to buy, and a free tool that queries the Common Crawl webgraph.

🖼️ Media & Forensics 4 guides

Working out what an image, a file, or a piece of writing can tell you.

Image Forensics Guide
Detect manipulation: ELA, metadata, geolocation.
Steganography Guide
Hidden data in images, audio, and unusual carriers.
Stylometry & the Pseudpocalypse
Your writing is a fingerprint — and AI reads it effortlessly. How authorship attribution works and how to defend your anonymity.
Cellebrite & Phone Forensics
What Cellebrite's own leaked matrices say it can extract — and why BFU vs AFU decides everything.

💬 Platform OSINT 3 guides

Platform-specific technique for the messaging and social apps people actually use.

Telegram OSINT
The platform with no index. t.me dorks, TGStat, Telemetr.io, Telepathy, and recovering deleted posts.
TikTok OSINT
Closed API, ephemeral content. The numeric ID, yt-dlp capture, and why the follow list beats the videos.
Discord OSINT
Snowflake IDs encode an unspoofable creation timestamp. How to decode them and what you genuinely can't get.

🛡️ Privacy & OpSec 7 guides

Protecting yourself — as an investigator, and as a person in other people’s databases.

OSINT OpSec & Managed Attribution
Investigate without leaking back to your subject — sock puppets, isolation, query hygiene, and a checklist.
How to Remove Yourself From People-Search Sites (2026)
AI & Your Privacy
What ChatGPT collects, how to opt out, and how AI supercharges surveillance.
🛡️ Ring & Sidewalk OPSEC Guide
Password Security & Entropy
Hash strength, cracking economics, modern KDFs.
Why Password Lists Disagree (2026)
NordPass vs HIBP vs Specops vs Cybernews — why the same password gets 100x different counts.
Best Encrypted Email 2026
Proton vs Tuta vs StartMail — and the metadata truth encryption can't hide.

📡 Surveillance & ALPR 8 guides

Original research on plate readers, device tracking and the vendors selling them.

Flock Safety 2026 — Fight Back
ALPR abuses, current lawsuits, and the legal ways communities cancel contracts.
Flock Off, Axon On (2026)
Cities drop Flock ALPR — then keep the same surveillance under Axon. What the record shows.
ALPR Cameras by US State
Free dataset: 116,655 plate readers mapped, ranked per capita. CSV + JSON + the query.
Every Documented ALPR Misuse
The accountability file: 24 officers who stalked, 26 gunpoint stops, 83,345 cameras for one woman. Sourced.
SignalTrace + ALPR (2026)
Plate readers upgraded to capture your phone, wearables & Bluetooth — and tie them to your car.
Investigation: Mapping ALPR Surveillance
A reproducible open-source investigation — map the cameras in your town and check if police searched your plate.
FOIA the Surveillance State (2026)
Records-request playbook + free generator for ALPR, SignalTrace, Fusus, drones & facial recognition.
IMSI Catchers & Stingrays
Fake cell towers explained, and how EFF's $20 Rayhunter detects them.

⚖️ Law, Policy & Ethics 4 guides

Where the legal lines sit, and how the policy landscape is moving.

Is OSINT Legal?
The three tests that decide it, why hiQ won the CFAA and still lost, and the FCRA trap that catches more investigators than hacking law.
Age Verification Laws & Privacy
26 states now require ID-grade age checks. Why privacy advocates call it surveillance, and what the UK already showed.
California DROP & the Delete Act
Delete yourself from 600+ data brokers with one free request. The Aug 1 2026 deadline, and what non-Californians can do.
Predictive Policing Explained
Crime-forecasting algorithms — sold as objective, documented as <0.5% accurate, and banned from Santa Cruz to the EU.

⭐ Comparisons & Best-of 3 guides

Ranked picks when you just want the best option without reading everything.

Best Password Manager 2026
Bitwarden vs 1Password vs Proton Pass — honest comparison, real prices, free-tier truth.
Optery vs DeleteMe (2026)
Verified pricing, the US-only catch, and when neither is right. We earn from both — which is the point.
AI SEO Guide (2026)
Ranking in AI-Overview / GenAI search results.

These guides go beyond tool lists to explain the techniques behind effective open-source intelligence — how the methods actually work, when to use them, and where they break down. Each is sourced and updated for 2026 to reflect current platform behavior, legal constraints, and tooling.

Start with the fundamentals — Google dorking, DNS reconnaissance, and WHOIS after GDPR — then move to specialist areas like geolocation, image forensics, and web-archive investigation.