LabHub

Blog

Modern OSINT (Open Source Intelligence) Tools 2026 Deep Dive - Maltego, Spiderfoot HX, Recon-ng, theHarvester, OSINT Industries, Trace Labs, Bellingcat, Lampyre, Aleph Project, TheHive Field Guide

2026-05-16 · 22 min read · #osint#maltego#spiderfoot#recon-ng#theharvester#osint-industries#trace-labs#bellingcat#lampyre#aleph-project#thehive#english

한국어English日本語

Intro — In May 2026, OSINT Has Become a Cross-Discipline Skill

Five years ago, OSINT (Open Source Intelligence) was largely the domain of intelligence agencies, a handful of investigative outlets, and some security teams. In May 2026, that boundary has all but dissolved. Investigative journalism (Bellingcat, OCCRP, ProPublica, Newstapa in Korea, OCCRP Japan), threat intelligence (Recorded Future, Mandiant, Group-IB), due diligence (Sayari, Kharon, Castellum.AI), missing-person response (the Trace Labs CTF format), AML and sanctions, fraud investigations, and social media monitoring all share roughly the same tool stack now.

This post is not a marketing matrix. It is an honest accounting of what fits where as of this date — Maltego 4.6 shifts, the Spiderfoot HX SaaS tier, Recon-ng 6.x, the limits of theHarvester, premium aggregators like OSINT Industries, Epieos, and Pimeyes, AI geolocation models such as GeoSpy AI, OCCRP's Aleph Project, the Trace Labs CTF format, and post-EU-AI-Act facial recognition restrictions.

OSINT in 2026 — Who Uses It and for What Cases

In May 2026, OSINT users fall into six broad groups.

  1. Investigative journalism: Bellingcat, OCCRP, ICIJ, ProPublica, Newstapa. MH17, Syrian chemical weapons, the Ukraine war, the Panama/Pandora/Pluto Papers.
  2. Cyber threat intelligence (CTI): Mandiant, Recorded Future, the Microsoft Threat Intelligence Center (MSTIC), Group-IB. Domain, IOC, and infrastructure tracking.
  3. Financial and sanctions compliance: Sayari, Kharon, Castellum.AI, Refinitiv World-Check, Dow Jones Risk. UBO (ultimate beneficial owner) research, sanctions-evasion investigations.
  4. Missing persons and trafficking response: the Trace Labs CTF, NCMEC, Polaris Project. Volunteer-driven citizen OSINT.
  5. Law enforcement and government: Europol, Interpol, Korea's NIS, JPCERT/CC, NICT NICTER, Japan's PSIA. Within the lawful collection envelope.
  6. Private investigations and brand monitoring: Mintel, Kroll, K2 Integrity, Hill & Knowlton. M&A diligence, reputation monitoring.

The workflows differ but the tool stack overlaps by roughly 90 percent. Link analysis (Maltego / Aleph), automated recon (Spiderfoot / Recon-ng), people tracking (Sherlock / Epieos), infrastructure lookups (Shodan / Censys), breach databases (HIBP / DeHashed), geolocation (GeoSpy / Mapillary), and the dark web (Tor / Ahmia) form the seven standard layers.

Link Analysis — Maltego, Lampyre, i2 Analyst's Notebook, Cytoscape, Aleph

Link analysis is OSINT's signature visualisation. You graph data as "entities (nodes) and relationships (edges)" and look for patterns.

A typical Maltego flow looks like this:

1. Create New Graph
2. Drag a Domain entity onto the canvas, enter the domain (e.g. example.com)
3. Right-click > Run Transform > "To DNS Name [Robtex]"
4. Chain additional transforms across the new nodes
5. Tidy with Layout > Block Layout or Hierarchical
6. Record hypotheses with Notes / Bookmarks
7. Save as Maltego Graph (.mtgx)

Maltego is powerful but the learning curve is steep, and the Community license is in practice a training license. The 2026 majority view is that practical OSINT entry is faster via Spiderfoot than via Maltego.

Automated Recon — Spiderfoot HX, Recon-ng, theHarvester, OSRFramework

Automated reconnaissance tools take a single target (a domain, an email, a person's name) and fan out across every available OSINT source.

A typical theHarvester invocation looks like this:

theHarvester -d example.com -l 500 -b bing,duckduckgo,crtsh

Spiderfoot CE is self-hosted: stand it up as an HTTP server and drive it from the web UI.

git clone https://github.com/smicallef/spiderfoot
cd spiderfoot
pip3 install -r requirements.txt
python3 sf.py -l 127.0.0.1:5001

Recon-ng is an interactive CLI.

[recon-ng][default] > marketplace install all
[recon-ng][default] > workspaces create demo
[recon-ng][demo] > modules load recon/domains-hosts/hackertarget
[recon-ng][demo][hackertarget] > options set SOURCE example.com
[recon-ng][demo][hackertarget] > run

The shared weakness of automated recon tooling is "API keys and cost". The Shodan, Censys, and SecurityTrails free tiers are so tight that serious work requires paid keys.

People and Accounts — Sherlock, Maigret, WhatsMyName, OSINT Industries, Epieos

The first move when tracking a person is usually checking which sites a given username has been registered on.

Sherlock is trivially simple to run.

pip install sherlock-project
sherlock johndoe

OSINT Industries ships both a web console and a CLI / API. Results come back as JSON and feed naturally into Maltego and Aleph.

The biggest concern in this category is privacy and stalking risk. The same tools can power stalkerware, so vendors have moved toward attestation and revocation when usage logs, consent, or legitimate purpose are not on file.

Image and Reverse Search — Yandex, Bing, Google Lens, TinEye, Pimeyes, FaceCheck.ID

Image OSINT is the fastest-moving category in 2026.

Standard OSINT practice is to throw any image at three or more engines (Google Lens, Yandex, Bing) at once. "Match in Yandex but no match in Google" is a common pattern.

Geolocation — SunCalc, GeoGuessr Technique, Mapillary, GeoSpy AI

Inferring where a photo or video was taken is the marquee OSINT discipline.

For geolocation, methodology drives 80 percent of the result, not the tool itself. The Bellingcat standard flow is (1) terrain cues (mountains, rivers, coastline) -> (2) artefacts (buildings, signage, roads) -> (3) shadows and sun -> (4) vehicles and vegetation -> (5) final cross-check against Street View or Mapillary.

Social Media OSINT — X, Telegram, Discord, Reddit, Mastodon, LinkedIn

OSINT friendliness varies sharply by platform.

The platform-OSINT trend line is consistent: API prices climb, unofficial scraping erodes. The money flows toward commercial aggregators like OSINT Industries.

Domain and Infrastructure — Shodan, Censys, SecurityTrails, DomainTools, VirusTotal

This is the threat-intel core.

A typical Shodan CLI session looks like this:

pip install shodan
shodan init <YOUR_API_KEY>
shodan search 'product:nginx country:US port:443' --limit 20
shodan host 1.2.3.4

The biggest shift in this category has been PassiveTotal's absorption into Microsoft. Pricing and licensing tightened versus its independent-SaaS days, and many mid-sized investigative outfits substituted a Censys + URLscan + VirusTotal combo.

Breach and Leak Databases — HaveIBeenPwned, DeHashed, Intelligence X, LeakIX

Breach data is the most ethically and legally contested category.

This category is highly jurisdictional. Downloading, holding, and using leaked data must be cleared against GDPR, Korea's Personal Information Protection Act, and Japan's privacy law before any operational use.

Documents and the Dark Web — Tor Browser, Ahmia, OnionScan, Dark.Fail

Dark-web (Tor onion services) OSINT is its own specialty.

In practice, 90 percent of dark-web OSINT lives in criminal forums and Telegram channels, not on onion services proper. From the late 2020s onward, trade and crime traffic increasingly migrated to Telegram and Discord.

Visual Investigation — Bellingcat Method and Forensic Architecture

Methodology matters as much as tooling. In 2026, two organisations set the visual-investigation standard.

The Bellingcat standard visual-investigation flow is (1) verify the source video's metadata -> (2) extract keyframes -> (3) estimate geolocation -> (4) estimate time (shadows, weather) -> (5) cross-check against Street View or Mapillary -> (6) cross-check against Twitter / Telegram posts at the same timestamp -> (7) document hypotheses and explicitly consider falsification.

Korean OSINT Ecosystem — KISIA, NIS, FIU

Korea's OSINT scene is small but growing fast.

In Korea, OSINT operates under heavy gravity from the Personal Information Protection Act. Collecting, retaining, or using usernames, emails, or phone numbers all require either subject consent or a statutory basis. Legitimate journalistic or academic purposes are partial exemptions, but the boundary is fuzzy.

Japanese OSINT Ecosystem — NICT NICTER, JPCERT/CC, PSIA

Japan's OSINT ecosystem leans more on government and academia than Korea's.

In Japan, OSINT lives under the Act on the Protection of Personal Information. It is less strict than Korea or the EU, but the 2022 amendments tightened cross-border transfer rules and consent requirements.

CTF and Training — Trace Labs CTF, OSINT Dojo, HackTheBox

OSINT learning is hands-on more than book-driven. The 2026 standard path is roughly as follows.

A common progression: (1) OSINT Dojo beginner -> (2) Cyber Detective CTF -> (3) Trace Labs CTF participation -> (4) HackTheBox / TryHackMe OSINT rooms -> (5) self-directed case studies following the Bellingcat workbook.

Law and Ethics — GDPR, EU AI Act, Korean and Japanese Privacy Law

The legal and ethical environment for OSINT shifted faster between 2024 and 2026 than in any prior stretch.

The standard practitioner checklist looks like (1) confirm a lawful basis -> (2) minimise data collection -> (3) assess anonymity and re-identification -> (4) declare retention periods -> (5) record source, time, and confidence -> (6) assess disclosure risk before sharing externally.

AI Augmentation — Claude / ChatGPT, LangChain plus Maltego Transforms, GeoSpy AI

The biggest 2025-2026 change has been LLM augmentation.

LLMs still hallucinate, so OSINT practice has settled on a firm rule: every LLM-extracted entity must be human-verified.

TheHive and MISP — Collaborative IR Platforms

OSINT work that needs team sharing requires a collaboration platform.

This layer is what moves OSINT output from "ad-hoc analysis" to "organisational asset". Solo investigators can skip it, but team OSINT almost always deploys MISP or OpenCTI.

Workflow Standardisation — A Seven-Step OSINT Cycle

As of 2026, citizen OSINT and CTI converge on a seven-step cycle.

  1. Planning: What, why, and for whom — including the legal and ethical basis.
  2. Collection: Passive (open-source lookup) first. Active (interactive) steps are minimised.
  3. Processing: Cleaning unstructured data and extracting IOCs and entities from PDFs, images, and HTML.
  4. Analysis: Graphing, visualisation, timeline construction — Maltego, Aleph, Cytoscape.
  5. Verification: Multiple sources, cross-checking, and explicit falsification — Bellingcat standard.
  6. Reporting: Document hypotheses, evidence, and confidence together, attaching source and timestamp.
  7. Retention: Data minimisation, retention windows, deletion, and access control.

This is the intelligence-community OSINT cycle adapted to a citizen-OSINT context, and it has become the formal curriculum for most OSINT training programmes in the late 2020s.

Tool Selection Guide — Where to Start

A recommended sequence for newcomers.

  1. Start with free tools: Sherlock, theHarvester, Spiderfoot CE, Maigret, Cytoscape. Spend a week trying each.
  2. Search and reverse-search: Pin Yandex, Google Lens, and TinEye to your bookmarks. Every case starts with five minutes of reverse image search.
  3. Infrastructure: Shodan (student tier), the Censys free tier, URLscan, VirusTotal. The first stop for any domain or IP enquiry.
  4. People and accounts: OSINT Industries is expensive. Start with Epieos plus Sherlock and Maigret.
  5. Breach databases: HIBP is free and lawful. DeHashed and Intelligence X only after a legal review.
  6. Link analysis: The Maltego Community Edition is for learning. Move to Professional or Aleph only when the work demands it.
  7. Automated recon: Self-host Spiderfoot CE. Add Recon-ng if you prefer a CLI.
  8. CTF practice: OSINT Dojo -> Cyber Detective -> Trace Labs CTF.
  9. Collaboration: Notes are fine solo. For a team, deploy TheHive plus MISP.
  10. AI augmentation: Use Claude / ChatGPT for unstructured triage. Human verification is non-negotiable.

The biggest trap is "installing every tool from day one". Spending a week deep on a single category (people search, say) builds skill faster than juggling thirty tools.

Outro — OSINT in May 2026: Democratised, but with Heavier Responsibility

Two conclusions. First, OSINT has democratised in a way that would have been hard to imagine five years ago. Free tooling plus LLM augmentation puts serious investigative capability in the hands of citizens, journalists, and analysts. Second, the responsibility scales with that capability — the EU AI Act, GDPR, Korean and Japanese privacy law, and stalkerware concerns push back on the old "search anything" reflex.

Methodology beats tool selection. Working through one or two chapters of the Bellingcat workbook by hand is worth far more than installing thirty OSINT tools. Whatever tool you use, never log a result without the three metadata tags — source, timestamp, confidence. That single habit handles 90 percent of OSINT.

References

Comments

No comments yet.

Sign in to leave a comment