OSINT Profiles: Analyzing the Small vs. Large Footprint
As an OSINT Analyst, you will often find yourself investigating subjects that fall into one of two primary categories. They will typically have either a Small Footprint or a Large Footprint, though there is plenty of grey area in between.
The Small Footprint
This category is where many teenagers and young adults in their early 20s fit. I categorize them as having a small footprint because their traditional online presence and general public record trail are relatively thin.
Your first thought might be: What about the mountain of social media posts they share across various platforms? While these subjects likely have an endless stream of selfies scattered across their accounts, in my opinion, that doesn't constitute a "large footprint." I view those posts as vertical data—they provide depth into a single area but don't create any real breadth across the investigation.
Key Challenges with Small Footprints:
- Volatility: These profiles are highly unstable. Younger individuals tend to change usernames frequently—either to avoid "unwanted eyes" like parents or law enforcement, or simply because they’ve outgrown a handle and want something "cooler."
- UID Dependency: Because of this volatility, analysts must rely more on the Unique User ID (UID) of the account rather than the display name or handle.
- Lack of Paper Trail: A small footprint also relates to a lack of life milestones. These subjects often do not have mortgages, registered automobiles, stable job histories, or public records available at a local clerk’s office.
The Large Footprint
This group generally includes more established individuals who have interacted extensively with "the system." They have typically lived long enough to create a trail of documented life events.
Key Characteristics of Large Footprints:
- Established Records: These individuals have likely established a permanent residence, built a credit history, obtained professional certifications, or registered to vote.
- Broad Data Scale: This means public records exist on a much wider scale. An investigation may yield years of employment and address history, traffic infractions, or even arrest records.
- Username Longevity: These subjects tend to retain their usernames for much longer periods. Because of this consistency, a search of a well-established handle is far more likely to yield a wealth of useful, interconnected data points.
Resources for Footprint Analysis
- OSINT Framework: A massive directory of tools for both public records and social media. OSINT Framework
- WhatsMyName: Excellent for finding the breadth of a "Large Footprint" across hundreds of sites. WhatsMyName.app
- CheckUser: A tool to see where a username has been registered historically. CheckUser.org
Footprint Comparison: Pivot Points & Data Sources
| Feature | Small Footprint (Vertical) | Large Footprint (Breadth) |
| Primary Pivot | Unique User ID (UID) / Email | Legal Name / Physical Address |
| Social Media | High volume, frequent handle changes. | Low to moderate volume, stable handles. |
| Key Platforms | Discord, TikTok, Snapchat, Gaming (Steam). | LinkedIn, Facebook, X (Twitter), Industry Forums. |
| Financial Trail | P2P Apps (Venmo/CashApp), Crypto. | Mortgages, Credit Headers, Liens/Judgments. |
| Public Records | Minimal (School directories, Voter reg). | Property deeds, Civil suits, Marriage licenses. |
| Technical Data | Breach logs, App UIDs, Metadata. | WHOIS data, Business filings (LLCs). |
Strategic Analysis
Small Footprint Strategy: "Follow the ID"
When investigating a small footprint, your goal is to find the constant in a sea of volatility.
- Pivot on UIDs: Use tools like Discord Lookup or SteamID to find the numerical ID that stays the same even if they change their username to something "cooler" next week.
- Breach Data: Younger subjects are often caught in game-related or app-related data breaches. These can link a temporary username to a permanent email address.
Large Footprint Strategy: "Connect the Silos"
For a large footprint, your goal is to bridge the gap between their digital persona and their legal identity.
- Public Record Aggregators: Use the subject's established residence history to find neighbors or associates who may provide indirect information.
- Professional History: LinkedIn or corporate filings often provide "breadth" by revealing professional affiliations, board memberships, and secondary email addresses.
Tools for Strategy Implementation
- EPIOS: Excellent for "Small Footprint" subjects to see which Google-linked services (like Maps or YouTube) an email has touched. EPIOS
- OpenCorporates: The largest open database of companies in the world, perfect for "Large Footprint" professional traces. OpenCorporates