People who come to us usually believe one of two things. Either the person behind an anonymous account can never be found, or a good investigator can unmask anyone from public data. Both are wrong. This guide explains how an OSINT investigation works, in the order we work it, and where public data runs out.
An anonymous account feels untouchable, but the people behind one leave traces. Open-source intelligence (OSINT) is information anyone can lawfully access, gathered and checked with discipline.
The persona leaves a trail
An OSINT investigation starts with the account, not the person. A persona builds a history, and that history often carries more than its owner intends:
- The same username, or a close variant, on other platforms.
- Recurring self-branding, such as a stage name, a show title or a signature phrase.
- Bios, linked websites and the accounts they point to.
- Posting-time patterns that suggest a time zone and a daily routine.
- Location details in photos, check-ins and casual comments.
- Distinctive writing habits, including spelling, punctuation and favorite phrases.
We profile the persona first and tie it to a real person only when the evidence supports it. Platform-specific guides: anonymous X (Twitter) accounts and fake Instagram accounts. For worked examples, read tracing a fake account to a real identity.
Technical fingerprints in an OSINT investigation
Many personas rely on a website, an email address or a phone number, and those leave their own records. We check current and historical domain registration (WHOIS), hosting details and reverse image searches on profile photos. We look for the same email address or phone number reused across services, and we correlate with breach data where the law allows. Privacy-protected domain registration is a finding in itself, because it shows the owner took steps to hide.
What an IP address can and cannot tell you
An IP address is the network address of the device that connected. Public lookups show only a general area and the internet provider, not a name or a street address. The address becomes useful when you combine it with other findings.
IP addresses come from a few places: the full headers of an email you received, or a lawful, controlled engagement that records the address when the person opens a link. Platforms hold them too, but release them only through court action. We are not a law firm, and we work with your attorney when a case goes that way.
VPNs and proxies can hide the real address, so we treat an IP address as one piece of evidence and not the answer. Our guides cover how to trace an IP address, how to find a fake email sender and whether a private investigator can trace a phone number or IP address.
File metadata, and why it usually isn’t there
An original photo or document can carry the device, the time and the author. Most platforms delete that data when a file is uploaded, so a screenshot or a downloaded image rarely has any. That is why the originals you saved matter: the email with its full headers, the file as it was sent, the message before it was edited. Save them before the account disappears.
Public records corroborate
In an OSINT investigation, property records, court filings, business registrations and professional licenses do the corroborating work. They turn a finding that is “consistent with” a person into one that is “supported by” the evidence. A username that matches a business name, a time zone that matches a city and a license that matches both carry far more weight than any one of the three alone.
Some records live offline
Some records never reach the web: police contact logs, old school records, agency files. The way in is a lawful request to whoever holds the record. This step often breaks a case open, and it is the one most do-it-yourself efforts never reach.
We score suspects; we do not guess
When a few people could fit, an OSINT investigation weighs each candidate on location, timeline, motive and behavior, and we show the weight we give each factor. “Several plausible candidates, none confirmed” is an honest answer, and it is worth more than a forced name that falls apart in front of a judge or a human resources panel.
Here is a composite example, built from common patterns and not from any real case. A harassing account posts mostly between 9 p.m. and midnight Eastern, reuses a nickname that also appears on a gaming profile, and links a small blog registered with privacy protection.
Each clue alone is weak. Together they narrow the field to a few people, and the investigation moves on to corroborate or rule out each one.
When public data runs short
Some harassment setups are built so that the platform holds the key records: the IP addresses used at upload, device IDs and account registration details. Only a court can compel a platform to release those. We do everything we can to reach the answer another way first, so many cases never need that step. The main tool is a carefully controlled, lawful engagement that records details the person reveals when they respond, which we then check against the OSINT profile.
If a case does end up in court, we are not a law firm, but we work with attorneys all the time and provide litigation support: findings, reports and testimony that your lawyer can use. The case plan depends on what the open sources have already shown.
What a good OSINT investigation delivers
A good OSINT investigation either names the person with the evidence behind the name, or tells you plainly where the case stands and what we do next. Both outcomes save money, because you stop paying for searches that cannot succeed. If money was taken, also report it to the FBI Internet Crime Complaint Center.
Read about all of our cyber investigation services, or see how we handle social media investigations. To talk about your case, start here for a free consultation, or write to .
Rexxfield is a cyber-investigations firm, not a law firm. This page is general information, not legal advice. The composite example is illustrative and does not describe a real case.
