OSINT: What Strangers Can Find About You Online

What Is OSINT?

Open-Source Intelligence (OSINT) is the practice of collecting and analyzing information from publicly available sources — social media, websites, public records, domain registrations, and data broker databases. Intelligence agencies, journalists, private investigators, and, unfortunately, stalkers and criminals all use the same techniques.

You do not need hacking skills to perform OSINT. Most of the tools are free, and most of the data was volunteered by you — or collected without your knowledge by companies that profit from it.

What a Stranger Can Find Right Now

Your Home Address and Phone Number

Data brokers like Spokeo, BeenVerified, Whitepages, and Intelius aggregate public records — voter registrations, property records, court filings, and phone directories — and sell access to anyone willing to pay a few dollars. Many offer free previews. Search your name and city on any of these sites to see what is visible.

Property tax records are public in most US states. Your county assessor's website likely lists your home address, purchase price, and square footage, all indexed by name.

Your Workplace and Professional History

LinkedIn is an OSINT goldmine. Even with a private profile, your employer, job title, and career history may be visible to logged-out users through Google's index. Hunter.io can guess your work email from your name and domain. Clearbit and similar tools do the same.

Your Family Members and Social Graph

Data broker profiles routinely list "associated persons" — family members, former roommates, anyone who shared an address with you. Facebook's graph, even with privacy settings applied, leaks relationships through mutual friends, event attendance, and photo tags.

Your Daily Routine

Strava fitness app routes are public by default. If you run the same loop every morning, that data — including your home neighborhood — is searchable. Instagram geotags, Foursquare check-ins, and background details in photos (street signs, license plates, distinctive buildings) all contribute to a map of your movements.

Breached Credentials

Haveibeenpwned.com aggregates data breach databases. If your email appears in a breach, your old passwords — and often your address, phone number, and security question answers — are circulating in criminal forums.

How to Reduce Your Exposure

Opt Out of Data Brokers

This is tedious but effective. The major brokers offer opt-out processes — some automated, most requiring you to submit a form or email. Services like DeleteMe (paid) or Privacy Bee automate removal requests across dozens of brokers. Key brokers to prioritize:

• Spokeo
• BeenVerified
• Whitepages
• Intelius
• PeopleFinder
• MyLife
• Radaris

Note that removal is not permanent. Brokers re-add data from public records periodically. You need to repeat the process every few months or use an ongoing service.

Lock Down Social Media

• Set all social profiles to private
• Remove your phone number and address from Facebook and Google accounts
• Disable location tagging on photos before posting (strip EXIF data using a tool like ExifTool or your phone's built-in option)
• Review which apps have access to your location and revoke unnecessary permissions
• On Instagram and Twitter/X, use a username that does not include your real name

Protect Your Public Records Footprint

• Use a PO Box or mail forwarding service (like Anytime Mailbox) instead of your home address for deliveries, online orders, and forms
• Register to vote using an alternative address where your state permits (some states have Address Confidentiality Programs for at-risk individuals)
• Use a registered agent or attorney address for any business filings

Secure Domain Registrations

If you own a domain, your registrant contact information (name, address, phone, email) is published in the WHOIS database unless you enable privacy protection. Enable domain privacy through your registrar — it is free or very low cost with most providers.

Use Separate Email Addresses

Using a single email address ties all your accounts together. Use different addresses for different risk levels: one for financial accounts, one for social media, one for newsletters and signups. Services like SimpleLogin or Apple's Hide My Email generate aliases that forward to your real inbox.

Check Yourself First

Before trying to reduce your exposure, do an OSINT audit on yourself:

1. Google your full name in quotes, with and without your city
2. Reverse image search your profile photos (Google Images, TinEye)
3. Search your phone number on Google
4. Check your email at haveibeenpwned.com
5. Run your name through three or four data broker sites

Document what you find. This gives you a baseline and a checklist of what to remove.

The Realistic Goal

Complete anonymity is not achievable for most people. The goal is raising the cost of finding you. A casual bad actor or an annoying ex will give up if the first few searches yield nothing. A dedicated, motivated adversary with resources is a different problem that requires professional help.

For most people, opting out of major data brokers, locking down social media, and using separate contact information for different contexts provides meaningful protection without dramatic lifestyle changes.