| title | Use cases |
|---|---|
| description | Real-world scenarios where Osintly makes a difference, from a first-time lookup to an enterprise-grade investigation. |
| icon | crosshairs |
Osintly works for complete beginners running a one-off search and for experienced analysts managing multi-target investigations. The workflows below cover the most common scenarios. Each one gives you a concrete sequence you can follow right now, whatever your background.
Always ensure your use of OSINT tools complies with local laws and your jurisdiction's regulations on data collection and privacy.
A handle found on a forum, a Telegram username, a Reddit account. This is often where investigations start.
Go to [Search](https://osint.ly/search), select **Pseudonym**, and enter the handle. Results stream in from social platforms, forums, and leak databases. Check the module cards for associated contact data. If you find an email, run a new **Email** search in the same project to expand the profile. Layer results: username to email to phone to IP. Each layer adds context and confirms or rules out connections between accounts. The **Leaked Results** and **Breached Accounts** panels show what data appeared in known breaches: password hashes, previous IPs, service names. Open the AI Analyst chat and ask it to build a chronological timeline from the results. Useful for establishing account creation dates and activity patterns.<Note>AI Analyst is available on Pro and Advanced plans.</Note>
You received a phishing email, a threat, or a contact request you cannot verify. The email address is your starting point.
Select **Email** and paste the address. The search checks breach databases, registered accounts, and social profiles at the same time. The **Registered Accounts** panel lists services where this email has an active account. It tells you a lot about the person behind it. **Breached Accounts** shows which data breaches included this address and what fields were exposed: password hash, username, IP, and more. If the email uses a custom domain rather than Gmail or Outlook, run a **Domain** search to understand the infrastructure behind it.If the email appears in multiple breaches with different associated usernames, search each username separately for a broader profile.
You have a domain or IP from a malware sample, a C2 server, or a suspicious redirect. You need to understand what is behind it.
Select **Domain** and enter the root domain. Review DNS records, subdomains, WHOIS registration data, and linked IPs. For every IP discovered, run a new **IP address** search. Check ASN, hosting provider, geolocation, and threat intelligence signals. Geographic clustering of IPs can reveal whether infrastructure is centralized or deliberately spread across jurisdictions. If the domain is active, create a monitor to get alerted when new DNS records, subdomains, or IP changes appear.<Note>Monitoring is available on Pro and Advanced plans.</Note>
A wallet address appears in a fraud report, a ransom payment, or a transaction you need to understand.
Select **Cryptocurrency** and paste the full wallet address. Osintly returns transaction history, linked addresses, and risk signals. Follow the transaction graph to find wallets that sent or received funds from this address. If exchange addresses or usernames surface in the results, run parallel searches on those identifiers.You are evaluating a potential partner, supplier, or acquisition target and need a broad picture quickly.
A **Domain** search surfaces WHOIS registration history, hosting details, subdomains, and any breach exposure linked to the company's infrastructure. If you have emails for founders or executives, run **Email** searches to check for breach exposure or linked accounts. Set a domain monitor to track infrastructure changes, new subdomains, or data leak appearances going forward. Use **Export to PDF** or **DOCX** to produce a structured deliverable for internal review or legal counsel.<Note>Export formats depend on your plan. See [Credits & subscriptions](/billing/credits-subscriptions).</Note>
A source contacts you via a pseudonymous account. You need to assess credibility without revealing your investigation.
Enable **Mask query from result page title** in Search Settings. This keeps the search term out of browser history and tab titles. Run a **Pseudonym** search on the handle, username, or account name provided. Module cards surface account creation dates, post history, and activity across platforms. A freshly created account with no activity history is a clear signal. Ask the AI to summarize all signals into a credibility assessment. You can ask follow-up questions directly in the chat.Step-by-step guide to your first search. Ask questions and share techniques with other investigators.