Overview#
A fraud investigator receives a tip that a suspect is operating multiple fake identities across social media platforms. The investigation starts with a single username. Within minutes, the analyst needs a map of every account, domain, email address, and profile photo connected to that starting point, across dozens of platforms, in a form they can attach to their case file with documented confidence. Manual OSINT work that used to take days now runs as an automated discovery campaign, with every finding scored, reviewable, and linked back to the investigation.
Digital Footprint Discovery is built for criminal investigation units, military intelligence teams, and corporate fraud examiners who need systematic, auditable OSINT collection within a governed investigative workflow.
Open Standards#
- OASIS STIX 2.1 / TAXII 2.1: OSINT collection tasks support analyst-configured TAXII 2.1 feed subscriptions, and discovered threat intelligence objects are modelled in alignment with STIX 2.1 object types for interoperability with external CTI platforms.
- WHOIS (RFC 3912): Domain ownership lookups use the WHOIS protocol to retrieve registrant, registrar, and nameserver data as part of domain and organisational footprint discovery.
- GraphQL (June 2018 specification): All discovery queries, mutations, and real-time status polling are exposed over a typed GraphQL API, covering operations such as
triggerOsintDiscovery,discoveryStatus, anddigitalFootprints. - ISO 8601 / RFC 3339: All discovery timestamps, activity dates, and audit trail entries are serialised in ISO 8601 UTC format to ensure interoperability with downstream case management and evidence systems.
- ITU-T E.164: Phone number seeds submitted to the phone-based discovery workflow are normalised to E.164 international format before dispatch to CDR and third-party provider lookups.
- GDPR (EU Regulation 2016/679): Built-in compliance controls enforce lawful-basis scoping, jurisdiction-based collection restrictions, data-subject access request processing, and configurable retention policies across all discovery activity.
- X.509 / TLS (RFC 5280): SSL certificate inspection is performed as part of domain footprint enrichment, extracting issuer, subject, and validity metadata linked to the subject's digital infrastructure.
- OAuth 2.0 (RFC 6749): Third-party OSINT provider integrations support OAuth 2.0 bearer-token authentication alongside API-key and basic-auth schemes, enabling secure federation with external intelligence services.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14
Key Features#
Automated Discovery#
Automated detection and correlation of digital identifiers across platforms. The system discovers social media accounts, identifies email address patterns, resolves domain ownership, correlates usernames across services, and performs reverse image search to link profiles across the digital landscape.
Broad Platform Coverage#
Coverage spanning major social networks, professional networks, code repositories, communication platforms, dating and lifestyle applications, and gaming platforms. The platform continuously expands coverage as new platforms emerge.
Verification Workflow#
All discoveries are assigned confidence scores based on discovery method and supporting evidence. Manual verification queues let analysts review, confirm, or reject automated findings. Screenshot and documentation attachment maintains chain of custody for investigative use.
Privacy Compliance#
Built-in compliance controls support GDPR-aware discovery settings, jurisdiction-based collection restrictions, complete audit trails for all discovery activity, configurable data retention policies, and subject access request processing. Collection is always limited to the scope of the authorised investigation.
Discovery Methods#
Automated OSINT scanning, manual analyst entry, email domain correlation, cross-platform username matching, profile photo reverse image search, and domain WHOIS ownership lookup. Each method produces calibrated confidence scores reflecting the reliability of the source.
Organisation Investigation#
Map the complete digital footprint of corporate entities including domain ownership, employee professional profiles, corporate social media presence, associated email domains, and website technology fingerprinting. Visualise organisational digital presence and identify connections between entities.
Use Cases#
- Subject Profiling: Build comprehensive digital profiles for persons of interest by discovering social media accounts, correlating usernames, mapping activity timelines, and identifying associated contacts
- Organisation Investigation: Map the digital footprint of corporate entities including domain ownership, employee profiles, and associated digital infrastructure
- Fraud Investigation: Identify fake identities and sockpuppet accounts through cross-platform account correlation, account creation timeline analysis, and profile image reverse search
- Threat Assessment: Discover and monitor the online presence of subjects under investigation for threatening behaviour, tracking digital activity changes and emerging communication channels
Integration#
Connects with person and organisation profile management, OSINT intelligence platforms, evidence management systems, and investigation case management. Discoveries flow directly into subject profiles and investigative workflows, with every finding traceable to its source and the analyst who verified it.