简体中文
EnglishDoes osintme.com provide threat intelligence and investigation resources?
Updated
Yes. osintme.com publishes threat intelligence and investigation material alongside general OSINT tradecraft. Its threat-focused content includes a write-up on the pro-Iranian threat actor Handala and its psy-op domains, a resource list for researching ransomware, and a darkweb resources list for investigators. These sit next to practical guides on browsers, Linux tooling, Reddit research and favicon analysis, so the site works as a mix of threat reporting and investigator how-to rather than a pure news feed or a pure tool directory.
Threat actor and campaign coverage
The clearest example of threat intelligence on the site is the Handala article, described as an "overview of psy-op domains associated with Handala, a pro-Iranian threat actor group." That framing tells you what to expect: domain-level infrastructure analysis tied to a named actor, useful if you are tracking influence or hack-and-leak operations rather than malware internals.
If your work involves attributing or monitoring a specific group, treat this as one source among several. The value is in the domain list and the context around it; you would still want to corroborate infrastructure against your own telemetry or other trackers before acting on it.
Ransomware and darkweb investigation resources
Two entries target investigators who need starting points rather than finished analysis:
- Ransomware research — "Multiple sources and datasets for investigating ransomware activity." This is a pointer list, so expect to spend time at each source rather than get a single consolidated feed.
- Darkweb OSINT — "Some Tor website links and resources for darkweb investigators – 2025 edition." The year in the title matters: darkweb links rot quickly, so check whether a newer edition exists before relying on it.
Both are best used as a launchpad. Verify that each linked source is still live and still relevant to your jurisdiction or sector before building a workflow on it.
Website and platform OSINT techniques
The site also covers the investigative craft around infrastructure and platforms:
| Topic | What the page offers |
|---|---|
| Favicon research | How favicons can support website OSINT — useful for linking sites that share infrastructure |
| Reddit research | "Hands on tested Google dorks and third party tools" for OSINT on Reddit |
| Browsers | A review of dedicated browsers and third-party solutions for investigators |
| Linux tooling | Recommended Linux Mint native desktop apps for OSINT and general productivity |
The Reddit and favicon pieces are the most directly reusable, because they describe techniques you can apply to your own targets rather than reporting on a specific actor.
Who this is for
The content is aimed at investigators and OSINT practitioners. Signals pointing that way include the CISSP exam preparation post, the annual reading list of "OSINT & online crime books for investigators," and a recommended OSINT newsletters list. If you are a beginner looking for a single structured course, this is not that — it is a working blog with dated posts, comments enabled, and pagination running to at least 14 pages.
Practical caveats
- Dates run into 2026 on several posts, so check publication dates before citing anything as current.
- Resource lists age. Darkweb and ransomware link collections in particular need re-verification.
- No pricing information is given in the available material, so do not assume the content or any linked tools are free.
- Threat actor posts are single-source overviews. Use them to orient, then corroborate.