osintme.com

osintme.com is a practitioner-written blog by Matt that covers OSINT tools and techniques across several recurring areas: dedicated web browsers for investigators, Reddit research methods, darkweb resources, Linux desktop apps for an OSINT machine, and website-level techniques such as favicon research. The site also publishes threat-actor overviews, reading lists, and adjacent material like ransomware research resources and CISSP exam notes. If you want hands-on, tool-oriented guidance rather than vendor marketing, the browser, Reddit, and Linux app posts are the most directly useful.

Dedicated web browsers for OSINT investigators

The site's browser post is described as "a brief review of dedicated web browsers and third party solutions for OSINT investigators." That framing matters: it treats the browser as an investigative instrument rather than a general-purpose app.

Typical reasons an OSINT workflow separates browsers:

• Profile and identity isolation — keeping sock-puppet accounts, research sessions, and personal browsing apart.
• Extension control — limiting or deliberately choosing which extensions can see page content.
• Fingerprint and leak reduction — reducing what a target site can learn about the investigator.
• Repeatable configuration — a known, documented setup you can rebuild on a new machine.

If you are choosing a browser for this purpose, compare candidates on the same dimensions: isolation model, extension support, update cadence, and how much manual hardening is required. The osintme.com post is a review, so use it as a starting point and verify current behaviour yourself, since browser features change quickly.

OSINT tools and techniques for research on Reddit

The Reddit post is explicitly "a list of hands on tested Google dorks and third party tools for doing OSINT research on Reddit.com." That combination — search-operator queries plus external tooling — is the practical core of Reddit investigation.

What this approach is good for:

• Finding posts and comments by username, subreddit, or date range.
• Surfacing deleted or edited content through third-party mirrors and archives.
• Mapping a user's activity across subreddits to build a behavioural picture.
• Locating discussions tied to a keyword, domain, or event.

A concrete task where this matters: you have a username and want to know whether the same person appears in other communities. Google dorks scoped to the site plus a third-party Reddit search or archive tool will get you further than Reddit's own search, which is limited for historical and deleted content.

Caveats worth planning for:

• Reddit content changes and disappears; capture what you find as you go.
• Third-party Reddit tools vary in reliability and coverage.
• Usernames are not identities — treat correlations as leads, not conclusions.

Darkweb OSINT resources

The site publishes a yearly darkweb resource roundup, described as "some Tor website links and resources for darkweb investigators." The 2025 edition is the one referenced in the site's own index.

This category is about resource discovery rather than a single technique: where to look, and which Tor-accessible sites are relevant to investigators. Treat any such list as perishable — onion addresses go offline, get seized, or get replaced by impersonators. Verify links through more than one source before relying on them, and assume anything you find there needs independent corroboration.

Linux desktop apps for an OSINT machine

The Linux post recommends "Linux Mint native desktop apps for OSINT & general productivity." Two things are worth noting about the scope:

• It is distribution-flavoured — recommendations are framed around Linux Mint native apps, not a distro-agnostic list.
• It mixes OSINT-specific tooling with general productivity, which reflects how an investigator's machine actually gets used: note-taking, screenshots, file handling, and documentation alongside collection tools.

If you are building or rebuilding an OSINT workstation, use this as a shortlist and check each app against your own distro, package manager, and whether you need it sandboxed or isolated from your main environment.

Website-level techniques: favicons and more

One of the site's more distinctive technique posts is on "the importance of favicons in website OSINT research." The premise is that a site's favicon can be a useful pivot: the same icon appearing across multiple domains can suggest a shared operator, template, or infrastructure.

This is a good example of the site's general style — taking a small, easily overlooked artefact and showing how it becomes an investigative lead. As with any single indicator, a shared favicon is a hypothesis, not proof; confirm it against registration data, hosting, content, and other signals.

Adjacent coverage

Beyond tools and techniques, the index shows:

Who this is for

The content is aimed at practising investigators and OSINT enthusiasts who want tested, specific guidance — dorks that were actually run, apps that were actually used, and resources compiled by someone doing the work. It suits people who already know the basics and want concrete tooling and technique, rather than an introductory course.

If you are new to OSINT, the Reddit and browser posts are the most accessible entry points; the darkweb and threat-actor material assumes more context and more operational caution.

Yes. osintme.com publishes threat intelligence and investigation material alongside general OSINT tradecraft. Its threat-focused content includes a write-up on the pro-Iranian threat actor Handala and its psy-op domains, a resource list for researching ransomware, and a darkweb resources list for investigators. These sit next to practical guides on browsers, Linux tooling, Reddit research and favicon analysis, so the site works as a mix of threat reporting and investigator how-to rather than a pure news feed or a pure tool directory.

Threat actor and campaign coverage

The clearest example of threat intelligence on the site is the Handala article, described as an "overview of psy-op domains associated with Handala, a pro-Iranian threat actor group." That framing tells you what to expect: domain-level infrastructure analysis tied to a named actor, useful if you are tracking influence or hack-and-leak operations rather than malware internals.

If your work involves attributing or monitoring a specific group, treat this as one source among several. The value is in the domain list and the context around it; you would still want to corroborate infrastructure against your own telemetry or other trackers before acting on it.

Ransomware and darkweb investigation resources

Two entries target investigators who need starting points rather than finished analysis:

• Ransomware research — "Multiple sources and datasets for investigating ransomware activity." This is a pointer list, so expect to spend time at each source rather than get a single consolidated feed.
• Darkweb OSINT — "Some Tor website links and resources for darkweb investigators – 2025 edition." The year in the title matters: darkweb links rot quickly, so check whether a newer edition exists before relying on it.

Both are best used as a launchpad. Verify that each linked source is still live and still relevant to your jurisdiction or sector before building a workflow on it.

Website and platform OSINT techniques

The site also covers the investigative craft around infrastructure and platforms:

The Reddit and favicon pieces are the most directly reusable, because they describe techniques you can apply to your own targets rather than reporting on a specific actor.

Who this is for

The content is aimed at investigators and OSINT practitioners. Signals pointing that way include the CISSP exam preparation post, the annual reading list of "OSINT & online crime books for investigators," and a recommended OSINT newsletters list. If you are a beginner looking for a single structured course, this is not that — it is a working blog with dated posts, comments enabled, and pagination running to at least 14 pages.

Practical caveats

• Dates run into 2026 on several posts, so check publication dates before citing anything as current.
• Resource lists age. Darkweb and ransomware link collections in particular need re-verification.
• No pricing information is given in the available material, so do not assume the content or any linked tools are free.
• Threat actor posts are single-source overviews. Use them to orient, then corroborate.

osintme.com is a practitioner-focused OSINT blog written by Matt, covering four broad areas: investigator tooling (browsers, Linux desktop apps), research techniques (Reddit, favicons, dark web resources), threat intelligence (named threat actors, ransomware), and learning resources (books, newsletters, exam advice). It is useful if you want hands-on, tested methods rather than vendor marketing — the Reddit and dark web posts are explicitly described as hands-on tested, and the reading list is framed as personal recommendations. It is not a tool itself, a data provider, or a formal training course.

Investigator tooling

Two posts in the visible index deal with the machine an investigator works from:

• Web browsers for OSINT investigators — described as a brief review of dedicated browsers and third-party solutions for OSINT work.
• Linux desktop apps for your OSINT machine — recommended Linux Mint native desktop apps for OSINT and general productivity.

The pairing is worth noting: the browser post is about what you browse with, the Linux post about what you run on. If you are building or rebuilding a dedicated workstation, these two are the starting points.

Research techniques

• OSINT tools and techniques for research on Reddit — Google dorks and third-party tools for investigating Reddit, described as hands-on tested.
• The importance of favicons in website OSINT research — how favicon data supports website attribution and infrastructure research.
• Darkweb OSINT resources for investigators – 2025 — Tor site links and resources, presented as a dated annual edition.

The dated editions matter: a "2025" label tells you the author intends to refresh the list, so check whether a newer edition exists before relying on the links.

Threat intelligence

• Pro-Iranian threat actor Handala – new websites — an overview of psy-op domains associated with Handala, a pro-Iranian threat actor group.
• OSINT resources for researching ransomware — multiple sources and datasets for investigating ransomware activity.

These are domain-specific rather than general tradecraft: you get a named actor or a crime category plus the sources used to research it.

Learning resources

• OSINT & online crime books for investigators – the Osint Me 2026 reading list — a personal list of reading recommendations.
• List of recommended OSINT newsletters — the author's picks for quality OSINT updates.
• Tips & recommendations for passing the CISSP exam — how the author planned for, studied for, and passed the ISC2 CISSP exam.

The CISSP post sits outside OSINT proper but signals the site's wider security-and-career scope.

What the site is not

The visible material is editorial: reviews, technique write-ups, link lists, and reading recommendations. There is no evidence in the available page data of a paid tier, a subscription, or a product behind a login — but absence of pricing signals is not proof that everything is free or accessible without registration, so verify on the site itself if that matters to you.

How to decide whether to follow it

The index shows 14 pages of posts, so the five headings above are a sample of the front page rather than the full archive — browse the pagination if none of these match your focus.

osintme.com is a practitioner-written blog for OSINT investigators, security researchers, and technically minded enthusiasts who want tested tools, techniques, and resource lists rather than vendor marketing. It suits you if you already know what OSINT is and want hands-on material: browser setups, Linux tooling, Google dorks, darkweb starting points, and reading lists. It is less useful if you need a structured training course, a paid platform, or beginner-level explanations of core concepts.

What osintme.com covers

The site's content clusters around a few recurring themes, based on its published article list:

Two things stand out from this list. First, the scope is deliberately broad within the investigator workflow — from the browser you use, to the OSINT machine you run it on, to the specific dorks and third-party tools for a target platform. Second, the author (Matt) writes from personal experience: the CISSP piece is framed as how he planned for, studied for, and passed the exam, and the Reddit article is described as "hands on tested" dorks and tools. That means you get operational observations and lessons learned, not just link dumps.

Who gets the most value

• Working OSINT investigators who want to compare browser options, find Linux desktop apps for a dedicated machine, or pick up platform-specific techniques without building a toolchain from scratch.
• Cybersecurity practitioners tracking threat actors or ransomware, who can use the Handala domain overview and the ransomware resource list as starting points for their own collection.
• OSINT enthusiasts and self-directed learners who prefer curated lists — newsletters, books, darkweb links — over formal courses.
• Certification candidates in security roles, for whom the CISSP study notes offer one person's preparation approach.

If you are looking for a definition of OSINT, a syllabus, or a tool that does the analysis for you, this site is not aimed at that need.

How to use it effectively

1. Browse by theme rather than chronologically. The article list is paginated (14 pages at the time of the source material), so scanning the index by topic — browsers, Linux apps, Reddit, darkweb, ransomware — is faster than paging through everything.
2. Treat list articles as starting points, then verify. Tool recommendations and darkweb links age quickly. Check that a linked tool still exists and still does what the article claims before adding it to your workflow.
3. Read the technique articles for method, not just links. The Reddit and favicon pieces are about how to approach a research problem; the specific dorks or lookups are examples you can adapt to other platforms.
4. Use the reading and newsletter lists for ongoing coverage. These are the site's lowest-maintenance sections — they point you to sources that keep updating after the original article is written.
5. Check dates before relying on anything. Entries in the source list run from 2024 through 2026, and threat-actor or darkweb content in particular can be stale within months.

Practical limitations to keep in mind

• The site presents itself as a personal blog with recommendations and reviews. There is no indication in the available material of a structured curriculum, certification, or support channel.
• Pricing, account requirements, and access restrictions are not specified in the source material, so do not assume any content or linked resource is free or open without checking.
• Threat actor and darkweb articles describe domains and resources at a point in time; infrastructure associated with actors like Handala changes frequently, so cross-check against current reporting before acting on it.

If your goal is to build or sharpen a personal OSINT workflow with tested, investigator-oriented material, osintme.com is a reasonable regular read. If you need guided instruction or a managed platform, look elsewhere and use this site as a supplementary source.

osintme.com is an English-language blog and resource site for OSINT investigators, written by an author publishing as "Matt." It is not a tool or a data platform — it is a collection of hands-on articles, reviews, and curated resource lists on investigation techniques. If you want practical write-ups on browsers, Linux setups, Reddit research, darkweb sources, or threat actor tracking, this site is aimed at you. If you need a searchable database, an API, or a training course, it is not that.

What the site covers

The published article list shows a consistent focus on the working environment and methods of an investigator rather than news of the day:

• Investigator tooling — "Web browsers for OSINT investigators" reviews dedicated browsers and third-party solutions; "Linux desktop apps for your OSINT machine" recommends Linux Mint native desktop apps for OSINT and general productivity.
• Platform-specific techniques — "OSINT tools and techniques for research on Reddit" lists Google dorks and third-party tools the author says were hands-on tested.
• Threat actor and domain research — "Pro-Iranian threat actor Handala – new websites" gives an overview of psy-op domains associated with a pro-Iranian threat actor group.
• Website-level investigation — "The importance of favicons in website OSINT research" explains how favicon research is used.
• Resource collections — "Darkweb OSINT resources for investigators – 2025" (Tor links and resources), "OSINT resources for researching ransomware" (sources and datasets), and "List of recommended OSINT newsletters."
• Reading and career material — an annual reading list ("OSINT & online crime books for investigators – the Osint Me 2026 reading list") and a first-person account of preparing for and passing the ISC2 CISSP exam.

Who writes it and how it is structured

All listed articles carry the byline "Matt" with a publication date and, in most cases, a later update date — for example, the Handala piece is dated 22/03/2026, and the browser review is dated 30/09/2026 and updated 02/10/2026. That pattern suggests articles are revisited after publication rather than left static.

The archive is paginated, running to at least 14 pages, so the site has a substantial back catalogue rather than a handful of posts. Several articles show reader comments (one on the Handala post, four on the Reddit post, three on the favicon post), which indicates an audience that engages rather than a purely read-only publication.

What it is useful for, and what it is not

Two caveats worth noting before you rely on it. First, the author describes some material as personal — the reading list is "a personal list of reading recommendations," and the CISSP piece is explicitly a first-person account of how he planned, studied, and passed. Treat those as one practitioner's experience, not institutional guidance. Second, dated resource lists such as the 2025 darkweb edition will age; check the publication and update dates before using any link collection for current work.

How to start

If you are new to the site, the most efficient entry points are the technique articles that match a task you already have — for instance, if you are building an investigation workstation, start with the browser review and the Linux desktop apps piece; if your target is a social platform, start with the Reddit article. Use the paginated archive to browse older material, and check each article's update date, since the author appears to revise posts after publication.