OSINT Investigations

Updated 6 September 2026 by K3K Investigations

Open-source intelligence is how modern investigations start, and K3K runs it on a platform we built ourselves. Identity attribution, digital footprints, due diligence and geospatial research, produced to an evidential standard by senior investigators rather than by a subscription tool.

OSINT, open-source intelligence, is the discipline of collecting, verifying and analysing information from publicly available and lawfully licensed sources: social media, corporate registries, court and property records, imagery, technical data about domains and devices, and the vast archive of what people and companies have said about themselves online. Done well, it produces evidence. Done badly, it produces a screenshot. K3K Investigations is a UK private investigation agency that specialises in OSINT as a core capability, not a bolt-on, and that builds the tooling it runs on. Call 020 3343 7007 for a free, confidential conversation with a senior investigator, 24 hours a day.

What OSINT can establish

Who is really behind a name, account, number or email. Usernames get reused, photographs get recycled, phone numbers and payment details connect accounts that were meant to stay separate. Lawful attribution links a screen name to a person, or tells you honestly that it cannot be done. This is the foundation of our cyber investigation work on harassment, impersonation and scams.

Where someone is. Open-source research at depth, layered with licensed data and field enquiries, is how professional people tracing finds people that free searches cannot, whether a missing relative, a debtor or a beneficiary.

Whether a company or person is what they claim. Registries, filings, litigation history, property records, sanctions lists, press and the digital exhaust of a business partner, counterparty or prospective executive. OSINT is the first phase of every corporate investigation and due diligence instruction we take.

How a fraud was built. Cloned websites, lookalike domains, mule accounts, fake trading platforms and the infrastructure behind an invoice-diversion attack all leave technical traces. Mapping them tells your bank, Action Fraud and your solicitor what actually happened.

What a place looks like before we go there. Geospatial OSINT establishes the CCTV, road layout, transport patterns and public infrastructure around a location before a surveillance team deploys, and reconstructs what was there after an incident.

What is exposed about you. A digital footprint assessment shows an executive, a family or a litigant exactly what an adversary could find about them from open sources, and what to do about it.

Our own OSINT platform

Most investigators run OSINT through a patchwork of browser tabs and rented subscriptions. K3K built the K3K OSINT Console, an in-house open-source intelligence workbench designed by our own engineers for evidence-led work rather than for hobbyists. It runs identity and username sweeps across a wide set of platforms, analyses email addresses, phone numbers and domains, pulls Companies House records into the case file, extracts the metadata hidden in images, and keeps a library of prepared searches that turn an hour of manual work into minutes.

Its geospatial desk plots what is publicly known about any area of ground: public CCTV positions, telephone masts, cell towers, public Wi-Fi networks, street cabinets and internet-exposed devices, with a live overlay of aircraft overhead. Alongside it we run a live global monitoring desk fusing aircraft, shipping, satellite and traffic-camera feeds onto a 3D globe. Every search is written to an append-only, operator-attributed audit log, which is what turns a finding into evidence with a chain of custody. It runs on servers we control, so your subject's name is never sitting in a third-party vendor's logs. Read about the technology behind every K3K case.

OSINT with investigators behind it

The difference between an OSINT tool and an OSINT investigation is judgement. A username match is a lead, not a conclusion; a company filing is a fact, not the story. Our OSINT work is run by the same senior investigators who run our field operations, and it moves into the physical world whenever a case needs it: a trace confirmed by a field visit, an attribution corroborated by covert surveillance, a due-diligence finding tested by discreet enquiries. Desk research tells you where to look. Investigators tell you what it means.

Social media investigations

For employers, insurers and family-law clients, lawfully gathered social media evidence is often decisive: a claimant's public posts contradicting a claimed injury, an employee's public activity during certified sick leave, a counterparty's public associations. We capture material that is genuinely public, with timestamps and context, and we document how it was obtained so it survives a tribunal or court. We do not create fake profiles to befriend a subject, request access to private content under false pretences, or access anything behind a login that is not ours. Evidence gathered that way is both unlawful and worthless, and any agency offering it is offering you a liability.

Digital footprint and exposure assessments

Executives, high-net-worth families and people involved in contentious litigation increasingly ask us the reverse question: what could someone find about me? An exposure assessment runs our full OSINT method against you or your organisation, reports what is discoverable, from home addresses in company filings to family members identifiable through social media, and sets out the practical steps that reduce it. For boards, the same assessment on a senior appointment is part of executive due diligence.

The boundaries we work within

OSINT is lawful because of where the information comes from and how it is handled, and the lines are clear. We do not access accounts, devices or systems without authority, which would be an offence under the Computer Misuse Act 1990. We do not obtain personal data by deception, which is an offence under section 170 of the Data Protection Act 2018. We do not buy leaked databases or use data-broker sources that cannot show a lawful basis of their own, and we do not intercept communications. Every instruction is processed on a documented lawful basis under UK GDPR; K3K Investigations Ltd is an ICO-registered data controller (ZB535305). Where an investigation needs information that only a platform or a bank holds, the route is a court order such as a Norwich Pharmacal order, obtained through your solicitor, and our evidence is built to support that application.

What you receive

A written report that separates what was found from what it means: each finding cited to its source, captures timestamped and preserved, the method described plainly enough for a court to follow, and a clear statement of confidence and of what remains unknown. Where it matters, the console's audit log demonstrates when each query was run and by whom. Our investigators can give evidence about how material was obtained. If the honest answer is that attribution is not possible, or that the free checks you have already done were the right ones, the report says so and the invoice reflects it.

Cost and timescale

OSINT is usually the most cost-effective phase of an investigation, and often the only phase needed. Every instruction is quoted as a fixed price after a free consultation, so you know the cost before any work begins. As a guide, tracing work is fixed-fee in the £150 to £500 range with no-trace-no-fee terms on suitable cases, and verification products such as employment background checks and identity verification start from £750. Desk-based OSINT work is typically delivered within days; larger due-diligence and attribution instructions are scoped and timetabled individually.

Frequently asked questions

What is OSINT?

OSINT stands for open-source intelligence: information gathered from publicly available or lawfully licensed sources and analysed into something useful. In a private investigation that means social media, corporate and court records, property and electoral data, imagery, domain and device information, and the archive of what people have published about themselves, verified and cross-referenced by an investigator rather than taken at face value.

Is OSINT legal in the UK?

Yes, when it draws on information that is public or licensed for the purpose and is processed under a documented lawful basis. What is unlawful is bypassing access controls, obtaining personal data by deception, buying stolen data, or using the results to harass someone. K3K works entirely within those lines and is an ICO-registered data controller.

Can OSINT find someone's address?

Often, in combination with licensed data and field enquiries, and only where there is a legitimate purpose such as a debt, a legal claim, a family reunion or a beneficiary trace. We screen every tracing instruction for signs of stalking or harassment and decline the ones that fail. Where the person may not want contact, we use a welfare-check or intermediated approach rather than handing over an address.

Can you find out who is behind an anonymous or fake account?

Frequently, through lawful attribution: reused usernames, recycled photographs, linked phone numbers and payment details, writing habits and technical traces. A careless account can be attributed quickly; a careful, determined operator sometimes cannot be, and we say so rather than bill you to find out slowly. Where attribution needs data a platform holds, we build the evidence for a court application through your solicitor.

Do you use AI in OSINT investigations?

Yes, as an analyst's assistant. AI tooling helps our investigators sift large volumes of lawfully gathered material, spot patterns and draft summaries. Every finding that reaches a report is verified by a human investigator against its source; no conclusion rests on an AI output that cannot be traced back to evidence.

How long does an OSINT investigation take?

Most desk-based instructions, such as an attribution, a footprint assessment or the OSINT phase of a due-diligence report, are delivered within days. Complex multi-jurisdiction due diligence or fraud-infrastructure mapping is scoped and timetabled at the free consultation.

What does an OSINT investigation cost?

A fixed price agreed in writing before any work starts. Tracing is typically £150 to £500 with no-trace-no-fee terms on suitable cases, verification products start from £750, and bespoke OSINT instructions are quoted on scope after a free consultation.

Need to know who, where or whether? Speak to a senior investigator in confidence — free, no obligation, and honest about what open sources can and cannot establish. Call 020 3343 7007 (24 hours) or book a call.