Malte ZanderContents
OSINT means investigating with publicly available sources. For brand protection, a handful of mostly free sources is enough: RDAP for registration data, DNS and network records for hosts and infrastructure, certificate logs for new and related domains, web archives for earlier versions and ad libraries for ads. Work passively, never enter anything into a fake and record every step with a timestamp.
- The Berkeley Protocol of UC Berkeley's Human Rights Center and the UN Human Rights Office sets minimum standards for investigations using public online sources (UC Berkeley).
- Since 28 January 2025, RDAP has been the authoritative source of registration data for generic domains (ICANN).
- Publicly trusted certificates must appear in Certificate Transparency logs for Chrome to trust them (Chrome).
- Under the GDPR, processing personal data strictly necessary for preventing fraud constitutes a legitimate interest (GDPR, Recital 47).
What is OSINT in brand protection?
Open source intelligence: insight from open sources. It means information anyone can retrieve without credentials or tricks: registration data, DNS, network records, certificates, archived web pages, search engines and public ad libraries. For brand protection teams, OSINT is the toolkit for turning a single tip into a complete case: who is responsible, how long has the fake been running, are there more domains and is the case connected to earlier ones?
Which sources do you need?
| Source | What it shows | Tool |
|---|---|---|
| RDAP | Registrar, creation date, abuse contact | ICANN Lookup |
| DNS | IP addresses, name servers, mail servers, TXT records | dig, nslookup or web-based DNS tools |
| Network records | An IP's network operator and abuse contact | The regional registries' databases, such as RIPE |
| Certificate logs | Certificates for a domain and similar names | crt.sh |
| Web archives | Earlier versions of a page | The Internet Archive's Wayback Machine |
| Search engines | The same text, phone numbers or images on other sites | Searches in quotation marks and image search |
| Ad libraries | Ads that use your brand | The ad platforms' transparency pages |
With these seven sources, most cases can be fully cleared up, as far as public data allows. More on individual sources in DNS records explained, Hosting and IP lookups and Reading TLS certificates.
Which ground rules apply?
Five rules protect you, your investigation and your company:
Passive before active. Look up public data first, before you even open the fake.
No input. Never enter data into a fake, not even made-up data, and don't download anything you'd have to run.
Work in isolation. Use a separate browser or a virtual machine, kept apart from your work account.
Document. Every lookup with date, time, time zone and result, so others can follow it.
Respect the limits. No breaking into servers, no guessing passwords, no deceiving people. OSINT ends where information stops being public.
The Berkeley Protocol describes these principles in detail for open source investigations (UC Berkeley).
A typical path from tip to case
This is how a reported link becomes a complete case within an hour:
Check the tip: record the full URL and where the tip came from.
Registration: an RDAP lookup for the registrar, creation date and abuse contact.
Infrastructure: DNS records and network records for the host, CDN and mail servers.
Certificate: issuer, issue date and every name in the certificate. Extra names go on the watchlist.
Related domains: search the certificate logs for similar names.
Secure the content: screenshots, page source, an archived copy, in isolation and with the full link.
More traces: distinctive text and phone numbers in search engines, ads in ad libraries.
Link: match the traces against earlier cases, as described in Linking cases.
The result is an evidence package you can use to report to the host, the registrar and browsers.
What about personal data?
Handle it with judgment. OSINT turns up names, email addresses and sometimes photos of people, for example in registration data or on fakes. The GDPR recognises fraud prevention as a legitimate interest where the processing is strictly necessary for it (GDPR, Recital 47). So collect only what the case needs, store it securely and delete it when the case is closed. Agree your approach with your data protection officer.
Where does OSINT stop?
Where legal action or the police begin. With open sources you find infrastructure, connections and patterns, but rarely the person behind a fake. Registration data is often protected and hosting accounts are anonymous. Identifying the operator takes disclosure claims or investigative powers. Your OSINT evidence package is the best foundation for that. When it pays off is shown in Takedown or legal action.
How does AI Fraud Protect help?
AI Fraud Protect handles the routine of this process automatically: for every find, it captures registration, DNS, hosting and certificate data, secures screenshots and identifies the responsible parties. New finds are matched against earlier cases. Your team focuses on the review, and a person reviews and sends every report.
Start the free fraud scan for a short report within 48 hours, or request a demo to see detection, evidence and takedown in the app.
FAQ
Do I need paid tools for OSINT?
Not to get started. The sources above are free. Paid services pay off for historical data and high case volumes.
Is OSINT legal?
Retrieving public information is generally permitted. The limits are set by data protection, terms of service and the prohibition on breaking into systems or deceiving people. When in doubt, ask your legal team.
How much time does a case take?
With practice, just under an hour for the process above. Most of it is documentation, and that's exactly where automation helps.
May I investigate fakes on social networks?
Public profiles and posts, yes. Joining closed groups under a false identity goes beyond OSINT.
Sources
UC Berkeley Human Rights Center: Berkeley Protocol on Digital Open Source Investigations
ICANN: launching RDAP, sunsetting WHOIS, 27 January 2025