OSINT Sources, Tools, and Collection Tradecraft

OSINT collection is a skill of pivoting — starting from one indicator and systematically expanding to a full picture of adversary infrastructure and identity.

Infrastructure Pivoting Methodology

INFRASTRUCTURE PIVOT WORKFLOW
Starting from a single IP: 185.220.101.9

Step 1: Initial IP enrichment
  Shodan: shodan host 185.220.101.9
    → Open ports, services, banners, hostnames
    → If port 50050 open: likely Cobalt Strike team server
    → TLS certificate: CN, SAN, organization field

  VirusTotal: IP lookup
    → Community detection votes, related files, URLs, communicating samples
    → "Relations" tab: domains that resolved to this IP

  WHOIS: registrant info, ASN, hosting provider
    → ASN identifies hosting provider preference (Frantech, Serverius = bulletproof)
    → Registration date relative to first malicious activity

Step 2: Passive DNS expansion
  SecurityTrails or VirusTotal Relations:
    → What domains resolved to 185.220.101.9?
    → When did they resolve? (timeline)
    → List all domains → proceed to Step 3 for each

Step 3: Domain analysis
  For each domain associated with the IP:
    → WHOIS: same registrant? Same registrar? Same registration date window?
    → Registrar pattern: attackers reuse registrars for ease
    → Domain creation date relative to attack timeline
    → DomainTools/SecurityTrails: what else did this registrant register?

Step 4: TLS certificate pivoting
  Shodan/Censys search by certificate:
    → If domain used a Let's Encrypt cert: cert may link to other domains
    → Self-signed cert: CN/O fields may contain attacker-chosen values
    → Search Shodan for other IPs presenting the same certificate

Step 5: Malware sample correlation
  VirusTotal "Communicating Files":
    → Any malware samples that beacon to this IP?
    → Download sample hashes → analyze for additional C2 domains
    → MalwareBazaar: search by hash for additional metadata

Step 6: Cluster assessment
  → Group infrastructure by registration date window, ASN, registrar
  → Identify the hosting provider preference
  → Map the timeline: when was infrastructure stood up relative to attacks?
  → Assess: is this dedicated infrastructure (targeted operation) or shared 
    bulletproof hosting (opportunistic/criminal)?

OUTPUT: Infrastructure cluster map with confidence ratings on each link

Key OSINT Tools Reference

# Shodan CLI (requires API key)
shodan host 185.220.101.9          # IP enrichment
shodan search 'ssl.cert.subject.cn:"Major Cobalt Strike"'  # Default CS cert
shodan search 'http.html:"Cobalt Strike"'                   # CS team servers
shodan search 'port:50050'         # Cobalt Strike default team server port

# VirusTotal via API
curl -s "https://www.virustotal.com/api/v3/ip_addresses/185.220.101.9" \
  -H "x-apikey: $VT_KEY" | jq '.data.attributes | {
    country, 
    as_owner, 
    reputation,
    last_analysis_stats
  }'

# Passive DNS via SecurityTrails API
curl -s "https://api.securitytrails.com/v1/history/185.220.101.9/dns/a" \
  -H "APIKEY: $ST_KEY" | jq '.records[] | {hostname: .hostname, date: .last_seen}'

# URLScan for domain analysis
curl -s "https://urlscan.io/api/v1/search/?q=domain:malicious-domain.com&size=10" | \
  jq '.results[] | {url: .page.url, ip: .page.ip, date: .task.time}'

# Certificate transparency for domain enumeration
curl -s "https://crt.sh/?q=%.malicious-domain.com&output=json" | \
  jq '.[] | {name_value, logged_at, issuer_ca_id}' | sort -u

# WHOIS automation
whois 185.220.101.9 | grep -E "OrgName|Country|NetRange|CIDR|NetName"

Dark Web Collection OPSEC

DARK WEB COLLECTION PROCEDURE
================================

Pre-collection setup:
☐ Dedicated VM (not your workstation) — Whonix or Tails preferred
☐ No personal accounts logged in on this machine
☐ Corporate VPN NOT active (traces back to organization)
☐ Tor Browser only for .onion sites — never regular browser on .onion
☐ Screenshot instead of downloading files where possible

During collection:
☐ Do not register accounts on criminal forums (counterintelligence risk)
☐ Do not post or reply — read-only collection
☐ Screenshot everything — sites disappear quickly
☐ Note the date/time of observation (UTC) — evidence timestamping
☐ Do not visit the same site repeatedly from a session that could be fingerprinted

What to collect:
  Ransomware leak sites: victim announcements, data samples (note: do not 
    download actual exfiltrated data — legal risk)
  Access broker listings: initial access for sale to your sector
  Malware developer forums: new tools, capabilities for sale
  Credential markets: check if your organization's credentials appear

Documentation format:
  Source: [Tor URL or .onion address]
  Date observed (UTC): 
  Screenshot: [filename]
  Summary of relevant content:
  Confidence in source reliability: [A-F per admiralty scale]
  
Dissemination:
  Do NOT include .onion URLs in reports shared externally
  Describe source type: "a criminal forum monitored as part of CTI collection"
  Include screenshots as evidence only for internal reports