OSINT framework
A modern OSINT framework, built for live data
An OSINT framework is a structured map of open-source intelligence resources organized by the identifier you start with, so you know which tool to use next. If you are new, read what OSINT is first, then pick tools from the OSINT tools directory for each branch. Classic frameworks are static link trees. This one adds a repeatable workflow, live map layers and AI pivots.
How to use an OSINT framework
01Define the target and question
Write down exactly what you need to learn and which identifiers you start with: a username, email, domain, place, aircraft or company.
02Pick the branch for your identifier
Follow the matching branch of the framework (identity, infrastructure, geospatial, transport, records) instead of opening every tool.
03Pivot on new identifiers
Each result can reveal a new selector, such as an email from a domain record. Start the matching branch again with it.
04Verify with an independent source
Confirm every lead with a second, unrelated source before treating it as a finding.
05Map relationships and places
Link people, accounts and evidence on a mind map, and pin sourced locations on a map with timestamps.
06Report with citations
Record where and when each finding was observed so others can reproduce it.
Framework branches
Search & archives
Start broad: operators, cached pages and archived copies reveal what a target published before.
Google advanced search · Wayback Machine · archive.today · DuckDuckGo
Usernames & identity (SOCMINT)
Enumerate a handle across platforms, then pivot on reused avatars, bios and linked emails.
WhatsMyName · Sherlock · Have I Been Pwned · Gravatar lookup
Domains & infrastructure
Certificates, DNS history and registration data link domains to shared hosting and owners.
crt.sh · ICANN Lookup · DNSDumpster · Shodan · URLScan · PeeringDB
Geospatial & satellite (GEOINT)
Verify where an image was taken and what changed on the ground over time.
Sentinel Hub EO Browser · NASA Worldview · OpenStreetMap · SunCalc
Aircraft, ships & transport
Correlate transponder tracks with time and place to confirm movements.
ADS-B Exchange · OpenSky Network · FAA TFR list · MarineTraffic · IMF PortWatch
Hazards & situational awareness
Layer disasters, fires and outages to explain events in a region.
NASA FIRMS · GDACS · USGS Earthquakes · IODA · GDELT
Companies & public records
Officers, filings and sanctions lists connect people to organizations.
OpenCorporates · SEC EDGAR · OpenSanctions · OCCRP Aleph
Link analysis: Maltego-style graphs vs AI mind maps
Maltego popularized graph-based link analysis: you add an entity and run transforms to expand related entities. Cylect takes a lighter approach: describe the target in plain language and the AI analyst suggests pivots and adds people, accounts, domains and evidence to a mind map you can edit by hand. It runs in the browser, and paid plans can connect a local model (Ollama, LM Studio, Unsloth) instead of a cloud AI. Use whichever fits your workflow; many analysts use both.
For the full case-file, mind-map and map-pin workflow, see the Cylect field guide.