HECAVEX

Lab 03 · source selection

Choose the source that answers the question.

A practical selection from three established Awesome OSINT collections. Every entry explains when to use it, why it helps and what not to claim from the result.

Open the directory →

FREE OR FREE-TIER · 13 SECTIONS · REVIEWED 2026-08-14

39selected tools
13practical sections
3source collections
0queries sent by this page
Collection boundary. This page is a source-selection aid. It performs no lookup and sends no indicator to a third party. Opening a provider, submitting a URL or downloading a sample changes that boundary. Read the caution on each source first.

Source directory

Find the right tool for the job

Loading resources…

Curation basis

Selected, not copied wholesale

Dead, paid-only, invasive and low-value entries were intentionally excluded.

source list

jivoi/awesome-osint

The broad category backbone, including search, code, identity, domain, media and threat-intelligence resources.

Open repository ↗source list

Astrosp/Awesome-OSINT-List

Additional practical tools across recon, identity, source code, geolocation, malware and datasets.

Open repository ↗source list

brandonhimpfen/awesome-osint

A compact quality-oriented taxonomy covering search, social, maps, media, domains, networks and automation.

Open repository ↗

Pivot sequences

Useful order, not a magic recipe

Each next step should answer a stated question and produce a preserved observation.

URL OR PHISHING LURE

Delivery to infrastructure

  1. Preserve and defang the original URL.
  2. Search existing scans before submitting it anywhere.
  3. Extract redirects, responses, hashes, certificates and contacted hosts.
  4. Pivot exact artefacts into DNS, RDAP, CT and network history.
  5. Separate kit reuse from operator control.

FILE OR SCRIPT

Static artefact to related activity

  1. Hash the original and preserve collection context.
  2. Inspect strings, imports, configuration and embedded infrastructure statically.
  3. Search the hash and stable code fragments in public sources.
  4. Cluster on multiple invariants, not a family label alone.
  5. State what missing execution or payload stages prevent you from claiming.

IP, ASN OR CERTIFICATE

Hosting context without attribution

  1. Record the observation timestamp and source.
  2. Map allocation, BGP origin, certificate names and collected services.
  3. Compare historical state before assuming continuity.
  4. Look for repeated, uncommon artefacts across more than one source.
  5. Do not turn provider geography into operator nationality.

Evidence discipline

Four questions before a source enters the report

01 · Collection

What touched the target?

Distinguish passive lookup, provider-collected measurement, public submission and your own direct interaction.

02 · Time

When was it true?

Preserve first seen, last seen, scan time, retrieval time and the difference between them.

03 · Meaning

What does it prove?

Record the narrow observation before adding capability, clustering or attribution assessments.