简体中文
EnglishWhat OSINT tools and techniques are featured on osintme.com?
Updated
osintme.com is a practitioner-written blog by Matt that covers OSINT tools and techniques across several recurring areas: dedicated web browsers for investigators, Reddit research methods, darkweb resources, Linux desktop apps for an OSINT machine, and website-level techniques such as favicon research. The site also publishes threat-actor overviews, reading lists, and adjacent material like ransomware research resources and CISSP exam notes. If you want hands-on, tool-oriented guidance rather than vendor marketing, the browser, Reddit, and Linux app posts are the most directly useful.
Dedicated web browsers for OSINT investigators
The site's browser post is described as "a brief review of dedicated web browsers and third party solutions for OSINT investigators." That framing matters: it treats the browser as an investigative instrument rather than a general-purpose app.
Typical reasons an OSINT workflow separates browsers:
- Profile and identity isolation — keeping sock-puppet accounts, research sessions, and personal browsing apart.
- Extension control — limiting or deliberately choosing which extensions can see page content.
- Fingerprint and leak reduction — reducing what a target site can learn about the investigator.
- Repeatable configuration — a known, documented setup you can rebuild on a new machine.
If you are choosing a browser for this purpose, compare candidates on the same dimensions: isolation model, extension support, update cadence, and how much manual hardening is required. The osintme.com post is a review, so use it as a starting point and verify current behaviour yourself, since browser features change quickly.
OSINT tools and techniques for research on Reddit
The Reddit post is explicitly "a list of hands on tested Google dorks and third party tools for doing OSINT research on Reddit.com." That combination — search-operator queries plus external tooling — is the practical core of Reddit investigation.
What this approach is good for:
- Finding posts and comments by username, subreddit, or date range.
- Surfacing deleted or edited content through third-party mirrors and archives.
- Mapping a user's activity across subreddits to build a behavioural picture.
- Locating discussions tied to a keyword, domain, or event.
A concrete task where this matters: you have a username and want to know whether the same person appears in other communities. Google dorks scoped to the site plus a third-party Reddit search or archive tool will get you further than Reddit's own search, which is limited for historical and deleted content.
Caveats worth planning for:
- Reddit content changes and disappears; capture what you find as you go.
- Third-party Reddit tools vary in reliability and coverage.
- Usernames are not identities — treat correlations as leads, not conclusions.
Darkweb OSINT resources
The site publishes a yearly darkweb resource roundup, described as "some Tor website links and resources for darkweb investigators." The 2025 edition is the one referenced in the site's own index.
This category is about resource discovery rather than a single technique: where to look, and which Tor-accessible sites are relevant to investigators. Treat any such list as perishable — onion addresses go offline, get seized, or get replaced by impersonators. Verify links through more than one source before relying on them, and assume anything you find there needs independent corroboration.
Linux desktop apps for an OSINT machine
The Linux post recommends "Linux Mint native desktop apps for OSINT & general productivity." Two things are worth noting about the scope:
- It is distribution-flavoured — recommendations are framed around Linux Mint native apps, not a distro-agnostic list.
- It mixes OSINT-specific tooling with general productivity, which reflects how an investigator's machine actually gets used: note-taking, screenshots, file handling, and documentation alongside collection tools.
If you are building or rebuilding an OSINT workstation, use this as a shortlist and check each app against your own distro, package manager, and whether you need it sandboxed or isolated from your main environment.
Website-level techniques: favicons and more
One of the site's more distinctive technique posts is on "the importance of favicons in website OSINT research." The premise is that a site's favicon can be a useful pivot: the same icon appearing across multiple domains can suggest a shared operator, template, or infrastructure.
This is a good example of the site's general style — taking a small, easily overlooked artefact and showing how it becomes an investigative lead. As with any single indicator, a shared favicon is a hypothesis, not proof; confirm it against registration data, hosting, content, and other signals.
Adjacent coverage
Beyond tools and techniques, the index shows:
| Topic | What it covers |
|---|---|
| Threat actor overviews | E.g. psy-op domains associated with Handala, a pro-Iranian threat actor group |
| Ransomware research | "Multiple sources and datasets for investigating ransomware activity" |
| Reading lists | A 2026 reading list of OSINT and online crime books |
| Newsletters | Recommended OSINT newsletters |
| Career/study | Notes on planning for and passing the ISC2 CISSP exam |
Who this is for
The content is aimed at practising investigators and OSINT enthusiasts who want tested, specific guidance — dorks that were actually run, apps that were actually used, and resources compiled by someone doing the work. It suits people who already know the basics and want concrete tooling and technique, rather than an introductory course.
If you are new to OSINT, the Reddit and browser posts are the most accessible entry points; the darkweb and threat-actor material assumes more context and more operational caution.