Skip to content
osint.platform

What does the internet already publish about you?

Digital footprint research is the same set of tools an investigator would use, pointed at yourself. Run it against your own identifiers to see what is publicly retrievable, and then decide what to do about it.

Accepts an email address, username, domain, IP address or URL.

Your investigations are private to your browser session, are never shown to anyone else, and can be deleted permanently at any time.

Where to start

  1. 01

    Start with your email address

    It reveals the most: which mail platform you use, whether your domain authenticates its mail properly, whether a public avatar is registered against your address, and, where breach data is available, which incidents have included it.

  2. 02

    Then your usual handle

    Check the username you reuse. You will usually find accounts you forgot existed. Each result links straight to the public profile so you can decide what to tidy up.

  3. 03

    Then any domain you own

    Certificate transparency logs are public and permanent. Every subdomain you have ever issued a certificate for is listed, including internal-sounding names you may not have meant to publish.

Exposure people usually miss

None of this requires anything clever. It is all information you published, or that was published about your infrastructure as a side effect of using it normally.

Certificate transparency is permanent

Every certificate issued for your domain is written to a public append-only log. Subdomain names like staging, vpn, internal or admin are published the moment you request a certificate for them, and cannot be removed.

Gravatar links your address to an image

Gravatar serves an avatar keyed by the MD5 of your email address. Anyone who knows or guesses your address can retrieve it, and many sites display it without asking.

Handle reuse is a correlation risk

Reusing one handle lets anyone build a list of your accounts in seconds. This platform reports that as a lead rather than a fact, but people building profiles about you will not be so careful.

Profile fields are self-published

The company, location and website fields on developer profiles are public and indexed. They are often the strongest link between a pseudonymous account and a real identity.

Missing mail authentication is exploitable

If your domain has no DMARC policy or a weak SPF record, anyone can send mail that appears to come from your address. This affects personal domains as much as corporate ones.

What to do with what you find

  • Publish a DMARC policy, starting at p=none with a reporting address, and tighten it once you can see who sends as you.
  • Review the subdomains in your certificate transparency history and confirm each one is meant to be publicly known.
  • Remove the company, location and website fields from profiles where you do not want them linked.
  • Use a distinct handle for accounts you want kept separate, correlation is the easiest attack there is.
  • Where a breach shows an address exposed, rotate the password on that service and anywhere you reused it.
  • Enable DNSSEC on domains you control, and check that your SPF record is a single, correct record.