This overview brings together all the questions and answers relating to OSINT forensics at LanCologne – from company and background checks, through image and video verification, to dark web investigations, disinformation and specialised research scenarios. Click on a category to view the relevant questions.
Corporate and Economic Research
- Conducting forensic searches of company registers – Forensically analysing public commercial and company registers
- Verifying extracts from the commercial register and shareholder structures using OSINT – forensically tracing corporate interconnections using open-source information
- Due diligence support through OSINT research – making forensic use of open-source information for corporate due diligence
- Forensically documenting competitive analysis using open sources – conducting competitively relevant research in a forensically traceable manner
- Assessing supply chain transparency through OSINT research – conducting a forensic analysis of publicly available supply chain information
- Uncovering trademark infringement on the internet using OSINT – Forensically documenting unauthorised use of trademarks
- Supporting domain disputes through OSINT research – forensically tracing domain owners and history
- Verifying managing directors’ and board members’ profiles using OSINT – conducting forensic checks on publicly available information about senior executives
- Documenting trademark infringement on the dark web using OSINT – Forensically uncovering the unauthorised trade in branded products on the dark web
Technical infrastructure and domain research
- Conducting a forensic WHOIS search – analysing domain owner information in a forensically verifiable manner
- Forensic analysis of DNS history – Forensic investigation of historical DNS records
- Analysing SSL/TLS certificates using OSINT – utilising certificate data forensically for infrastructure reconnaissance
- Conducting subdomain enumeration for forensic purposes – Forensically identifying associated subdomains within a target infrastructure
- Identifying phishing domains using OSINT – Forensically uncovering and documenting fraudulent domains
- Mapping IP addresses and network ranges using OSINT – Classifying technical infrastructure in a forensically traceable manner
- Forensic documentation of systems exposed via Shodan – Capturing publicly visible infrastructure in a forensically traceable manner
- Forensic analysis of website history using web archives – Forensic reconstruction of archived website versions
- Analysing email headers using OSINT – Conducting a forensic analysis of technical sender information
- Analysing document metadata using OSINT – utilising hidden document information for forensic purposes
- Searching public code repositories using OSINT – Forensically tracing accidentally published source code
- Identifying exposed databases using OSINT – forensically tracing publicly accessible databases
- Identifying IoT devices using OSINT – Forensically tracing publicly accessible connected devices
The Dark Web, financial investigations and cybercrime
- Identifying data breaches on the Dark Web using OSINT – Conducting forensic investigations into published data breaches
- Tracing stolen login credentials using OSINT – Investigating compromised login credentials in a forensically verifiable manner
- Analysing underground forums using OSINT – Using relevant forums for cybersecurity research in a forensic manner
- Forensic monitoring of darknet marketplaces – forensically documented monitoring of trading platforms on the darknet
- Identifying stolen corporate data on the dark web – conducting forensic investigations into published corporate data
- Tracing cryptocurrency transactions using OSINT – Forensic analysis of public blockchain data
- Carrying out sanctions list checks using OSINT – Forensically examining public sanctions and embargo lists
- Uncovering corporate shareholdings using OSINT – Forensically tracing hidden economic links
- Mapping crypto wallet addresses using OSINT – forensically linking wallet addresses to public sources
- Analysing open financial registers using OSINT – making forensic use of publicly available financial data
- Documenting money laundering indicators using OSINT – Investigating suspicious economic patterns in a manner that is forensically verifiable
- Analysing phishing campaigns using OSINT – Conducting a forensic analysis of publicly visible phishing infrastructure
- Identifying attackers’ infrastructure using OSINT – Forensically documenting attackers’ technical infrastructure
- Investigating suspicious payment transactions using OSINT – Conducting a forensic analysis of unusual payment routes
Social media and people searches
- Forensic verification of social media profiles – Forensically verifying the authenticity and consistency of social media profiles
- Identifying fake profiles on social media using OSINT – Forensically documenting fake social media profiles
- Reconstructing the timeline of social media activity – forensically tracing the chronology of public social media activity
- Preserving public posts as digital evidence – archiving social media content with forensic documentation
- Carrying out cross-referencing of multiple social media accounts – forensically tracing links between public profiles
- Documenting hate speech and threatening posts using OSINT – Forensically securing online statements relevant to criminal law
- Reconstructing deleted social media content using OSINT – Forensically tracing removed public content
- Conducting a forensic analysis of social media connections – Visualising public contact and interaction networks using forensic methods
- Verifying digital identity using OSINT – Forensically verifying stated identity characteristics
- Verify contact details using OSINT – Conduct a forensically verifiable check of the contact details provided
- Verifying professional profiles using OSINT – Conducting forensic checks on declared professional details
- Documenting digital footprints using OSINT – forensically analysing publicly visible online presence
- Mapping pseudonyms and usernames using OSINT – Forensically linking reused usernames
- Verifying email addresses using OSINT – Forensically tracing provided email addresses
- Verifying telephone numbers using OSINT – Conducting a forensic investigation into provided telephone numbers
- Documenting traces of identity theft using OSINT – Forensically tracing the misuse of other people’s identity data
Image and video verification
- Conducting a forensic reverse image search – forensically tracing the origin and first use of an image
- Determining the geolocation of images and videos using OSINT – forensically reconstructing the location where visual content was captured
- Forensic analysis of image metadata – using EXIF and other image metadata for forensic purposes
- Investigating suspected deepfakes using OSINT – Forensic analysis of artificially generated image and video content
- Carrying out video verification using open sources – conducting a forensic examination of the authenticity of video footage
- Dating image and video material using OSINT – forensically verifying the time at which visual content was recorded
- Identifying manipulated images using OSINT – Forensically detecting digital image manipulation
- Tracing watermarks and image provenance using OSINT – Forensically determining the original source and rights holders of images
- Hash value generation for archived online content
Cyber threats and security analysis
- Command-and-Control Server: OSINT-based detection – forensic documentation of publicly visible control servers
- Researching malware indicators using OSINT – utilising publicly documented malware characteristics in a forensic context
- Profiling threat actors using OSINT – forensically categorising publicly documented methods
- Detecting cyberattack early warnings using OSINT – Forensically documenting early public warning signs
- Using Google Dorking in a forensically traceable manner – utilising advanced search operators in a forensically documented way
Insurance and Fraud Investigation
- Investigating evidence of insurance fraud using OSINT – forensically documenting publicly available inconsistencies
- Verifying damage photographs using OSINT – conducting forensic analysis of images from damage claims
- Preserving social media content as evidence for insurance purposes – documenting public posts in a way that is forensically verifiable
- Identifying inconsistencies in accident reports using OSINT – cross-referencing publicly available information with accident details
- Check for duplicate insurance using OSINT – Investigate publicly available evidence of multiple insurance policies
- Investigating previous damage using OSINT – forensically analysing publicly documented previous damage
Disinformation and reputation management
- Documenting reputation monitoring using forensic methods – Recording public mentions in a structured manner
- Analysing disinformation campaigns using OSINT – Conducting a forensic investigation into coordinated disinformation
- Verifying fake news using OSINT – Forensically examining claims using publicly available sources
- Documenting damage to a brand’s reputation using OSINT – Conducting a forensic analysis of publicly visible damage to reputation
- Identifying botnets using OSINT – Forensically detecting coordinated, automated accounts
- Tracing viral misinformation using OSINT – conducting a forensic analysis of how public content spreads
Marketplace and Trademark Protection
- Identifying fake online shops using OSINT – Conducting a forensic investigation into fraudulent online shop listings
- Uncovering product piracy using OSINT – Forensic tracing of counterfeit products on the internet
- Identifying fake reviews using OSINT – Conducting a forensic analysis of suspicious review patterns
- Tracking down stolen goods on online marketplaces using OSINT – conducting a forensic analysis of suspicious listings
- Documenting grey market sales using OSINT – Forensically tracing suspicious distribution channels
Specific research scenarios
- OSINT investigation in cases of strong suspicion of an insider
- OSINT research in cases with an international dimension
- OSINT research in an urgent case with a tight deadline
- OSINT research involving anonymised or pseudonymised actors
- OSINT research into online traces that have already been deleted
- OSINT research using multilingual sources
- OSINT research in the context of ongoing legal proceedings
- OSINT research for an insurance report
- OSINT research during an acute corporate crisis
- OSINT research in the context of corporate transactions (M&A)
- OSINT research into whistleblower reports
- OSINT research in cases of suspected social engineering
- OSINT investigation following a data breach
- OSINT research in the event of a trade mark infringement
- OSINT research into cryptocurrency fraud
- OSINT investigation following a ransomware incident
- OSINT research in cases where competitors poach staff
- OSINT research in cases of suspected breach of competition law
- Limitations on OSINT research due to closed or private platforms
- OSINT research when source information is contradictory
- OSINT research for executive and supervisory boards
- OSINT research using sector-specific registers and databases
- OSINT research into associations and non-profit organisations
- OSINT research into property and assets
- OSINT research as an emergency measure to prevent the imminent loss of evidence
Methodology, Legal Matters and the Order Process
- Forensically validating automated OSINT reports – manually verifying tool-generated results to ensure they are traceable
- Forensic assessment of the limitations of automated OSINT tools – transparently documenting technical and methodological limitations
- Data protection in OSINT research (GDPR)
- Rights of the individual in OSINT research
- Section 34a of the Trade Regulation Act (GewO): Why LanCologne is not a private investigation agency
- Admissibility of OSINT findings in court
- Collaboration with solicitors on OSINT cases
- Cooperation with law enforcement agencies in OSINT cases
- Reporting and report structure in OSINT reports
- Automated vs. manual: a comparison of our OSINT methodologies
- Quality assurance and the dual-control principle in OSINT
- Documentation of timing and timestamps in OSINT research
- Combined analysis: OSINT and traditional IT forensics
- Emergency response for businesses in the event of urgent OSINT incidents
- Communicating boundaries transparently: our approach to OSINT
- Preparation for clients: what we need for an OSINT investigation
- Cross-tool plausibility checks in OSINT
- The process and costs of an OSINT investigation
- Differences between corporate, individual and infrastructure OSINT
- International OSINT Research: Characteristics and Limitations
- The Future of OSINT Forensics: AI-Assisted Analysis and its Limitations
Other questions
- Detecting cloud misconfigurations using OSINT – Forensically identifying publicly accessible cloud resources
- Analysing mobile app metadata using OSINT – utilising publicly available app information for forensic purposes
- Analysing QR codes and short links using OSINT – forensically tracing shortened and encoded links
- Conducting technical checks on politically exposed persons (PEPs) using OSINT – carrying out forensic investigations into publicly available information on PEPs
- Verifying supplier compliance using OSINT – conducting forensic research into publicly available supplier information
- Supporting the prevention of money laundering through OSINT research – utilising publicly available information for prevention processes
- Investigating breaches of export control legislation using OSINT – conducting forensic investigations into publicly available evidence of breaches
- Assessing employee risks using OSINT – forensically documenting publicly available threat intelligence
- Supporting business location security using OSINT – conducting forensic checks on publicly available location information
- Researching public security vulnerability reports using OSINT – Conducting a forensic analysis of disclosed vulnerability reports
- Assessing physical security risks using OSINT – utilising publicly available information for risk assessment
- Forensic archiving of press articles and media reports – ensuring transparent preservation of public coverage
- Reconstructing historical website content using OSINT – Forensically tracing previous versions of websites
- Analysing job advertisements as a source of OSINT – using publicly available job advertisements for forensic analysis
- Checking company websites for hidden content using OSINT – Forensically detecting unlinked and concealed content
- Analysing PDF metadata using OSINT – Making forensic use of hidden PDF information
- Why LanCologne relies on Maltego
- SpiderFoot in detail: how it works and its limitations
- Shodan in detail: how it works and its limitations
- Manual research as a complement to automated OSINT tools
- Chain of Custody in OSINT Research