Corporate OSINT: Mapping Company Structures, IP and Web Assets

Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.

TL;DR

• Corporate opacity is a risk: Shell companies, nominee directors and scattered web assets make it hard to judge real business risk or which organisation actually runs an operation.
• The manual grind is slow: jumping between regional registries (Companies House, US state registries), patent databases and WHOIS records leads to missed connections and data silos.
• UserSearch brings the work together: Corporate Intelligence, Domain Intelligence and Product Intelligence let you connect registry data, directors, registered addresses and web assets (domains, ads, patents) from one account.
• Two worked scenarios: (1) A due diligence analyst checking a supplier's real scale; (2) A strategy team reading a competitor's new product direction from its IP filings.
• Bottom line: Look past the "About Us" page. Verify structure, ownership and infrastructure with structured Corporate OSINT.

2.1 The Less Obvious Web of Corporate Structures

In modern business, what you see is rarely the full picture. A glossy website and a prestigious address can sit in front of a dormant shell company, while a nondescript holding entity might own a portfolio of valuable intellectual property and high-traffic domains. For analysts, this opacity is a feature, not a bug, of the global financial system.

Corporate OSINT (Open Source Intelligence) is the practice of working through these layers. It is not just about finding a registration number; it is about mapping the living ecosystem of a business. That means connecting the legal entity (filings, directors, registered addresses) with its online reality (websites, advertising, patents, trademarks).

When you rely on quick checks, such as a simple Google search or a glance at a company page on LinkedIn, you miss the signals that define risk and opportunity. You miss the director whose previous companies all ended in insolvency. You miss the fact that the "headquarters" is a mail drop shared by 500 other firms. You miss the connection between a legitimate brand and a scammy affiliate network running on the same server infrastructure.

This guide shows how to move from a company name to a well-sourced company report, using both fundamental manual techniques and the faster workflows in UserSearch.

2.2 What Is Corporate OSINT?

Corporate OSINT is the collection and analysis of public data about business entities. It covers legal filings, financial reports, ownership structures, intellectual property registrations and web infrastructure.

Unlike research into online accounts, which often deals with fast-changing social media data, Corporate OSINT relies heavily on structured government registries. Every legitimate business must interact with the state to exist: to pay taxes, to limit liability, to hire employees. These interactions leave a paper trail.

Key data points include:

• Registration Data: Incorporation date, status (active/dissolved) and company type.
• Officers: Directors, other officers and shareholders, as published on the register.
• Addresses: Registered office, trading premises and correspondence addresses.
• Assets: Trademarks, patents and web domains.

For background on how corporate registries work around the world, the OpenCorporates data documentation and the ICIJ's reporting on the Panama Papers give useful context on why this data matters.

2.3 Why It Matters: Supply Chains, Fraud and Reputation

Why should you care about the deeper structure of a company? Because the legal entity is the anchor for liability and trust.

Supply Chain Risk: Supply chain incidents and vendor fraud remain top concerns for procurement and security teams. If you are onboarding a new vendor, you need to know whether it was incorporated yesterday, or whether its director also runs 50 other "logistics" firms from the same small address.

Journalism: Major stories, from the Panama Papers to local corruption scandals, often hinge on a single connection: a shared director, a reused address or a common patent filing. Following these links takes careful, multi-jurisdictional searching.

Brand Protection: Counterfeiters and scammers often set up lookalike companies. Spotting them means regularly reviewing trademark filings and domain registrations that infringe on your IP.

A tangible example is the "phantom vendor" fraud, where employees set up shell companies to bill their own employers. Without cross-referencing company directors and registered addresses against the approved supplier list, these schemes can run for years. The ACFE Report to the Nations consistently highlights billing schemes as among the most common forms of occupational fraud. Teams working on this problem can see how we support them on our anti-money laundering and compliance page.

2.4 Manual Corporate OSINT: The Registry Grind

Before we look at the platform, it is worth understanding how to gather this data by hand. The manual route teaches you how fragmented the registry world really is.

1. Registry Hopping

There is no single global database of companies. You must identify the jurisdiction and find the right registry.

• UK: Companies House
• USA: State business registries (50 different sites). Delaware is key for many corporations, but establishing the actual owners there is notoriously difficult because of its disclosure rules. Nevada and Wyoming are also popular for registrations that disclose little.
• Europe: France uses Sirene/Infogreffe; Germany uses Handelsregister. Each has its own language, search screens and data availability (some charge fees for basic documents).
• Asia: Hong Kong's ICRIS is powerful but often paywalled or awkward to use without a login.

You might search for "Acme Corp" in Delaware, find nothing, and miss that it is actually registered in Nevada. Or you might find "Acme Ltd" in the UK but fail to realise it is a wholly owned subsidiary of "Acme Holdings" in the British Virgin Islands because you did not check the shareholder list by hand.

2. Search Operators for Company Documents

You can use advanced search operators to find PDF filings or reports that are not easy to reach from the main registry pages.

site:gov.uk filetype:pdf "Acme Corp" "annual report"
site:sec.gov "Acme Corp" intext:"director"
site:find-and-update.company-information.service.gov.uk "Acme"
filetype:pdf "Acme Corp" "modern slavery statement"

Here is what each part does. site: limits results to one domain, filetype: limits results to one document format, and intext: requires a word to appear in the page body. Together they can bring up annual reports, public legal filings, regulatory notices and statutory statements. It is noisy, though. You will find marketing brochures mixed in with formal documents, so read each one before you rely on it.

3. IP and Trademark Searching

To find what a company owns, you have to pivot to IP databases.

• USPTO (US Patents/Trademarks)
• WIPO (Global Brand Database)
• Espacenet (European Patents)

Searching these requires specific knowledge of classification codes and naming variations. A company might file patents under "Acme Technologies LLC" while trading as "Acme Solutions". You have to try every plausible name variation by hand.

4. Web Infrastructure Checks

Finally, you check the company's online assets by hand.

• WHOIS: whois acme-corp.example (often redacted) or the ICANN Lookup service.
• Ads: Checking the Google Ads Transparency Center manually for the advertiser name.
• Tech Stack: Using generic lookups to see whether the site runs on Shopify or a custom enterprise stack.

The Friction Point: This process is slow. To build a report on one company, you might visit ten different websites, deal with three CAPTCHAs and struggle to collate everything into a single timeline. You risk missing that the "Director" found in step 1 is the same named officer as the "Patent Inventor" in step 3 because the names are formatted slightly differently (for example "J. Smith" and "John Smith").

2.5 The Pivot: Joined-Up Corporate Intelligence with UserSearch

UserSearch collapses this fragmented workflow into one platform. Instead of hopping between 50 state registries or separate patent databases, you run searches against 100+ third-party data sources through a single UserSearch account. This saves time, and it keeps your method consistent, so connections you might otherwise miss show up in one place.

Core Search: Company Records in Corporate Intelligence

The backbone of the Corporate Intelligence Search type is company registry data, including records drawn from OpenCorporates, one of the largest open databases of companies.

• Global Reach: Search active and inactive companies across many jurisdictions from one screen.
• Status Visibility: See quickly whether a company is Active, Dissolved or in Liquidation.
• Normalised Data: Directors and officers are listed in a structured format, which makes the next step easier.

The Director Pivot

Finding the company is just step one. The real value comes from checking the company's officers and their other published appointments.

• Network Mapping: Enter a director's name as it appears on the register to see the other companies where that officer holds an appointment. This is the fastest way to spot "serial directors" (often a sign of nominee services or shell networks) as well as genuine serial entrepreneurs.
• Cross-Jurisdiction: You might see that one officer sits on the board of a firm in the UK and another in New Zealand, hinting at a group that operates internationally.
• Keeping the Picture Together: Save the results and your bookmarks in a Case (Forensic Mode stores your search history), so the links between officers and companies stay documented and your team can review them later.

Registered Address Checks

Checking a registered office address turns one address into a list of entities.

• Shell Detection: If a specific office suite returns 200 registered companies, you are probably looking at a formation agent or mail drop, not a dedicated head office.
• Shared Premises: You can find companies that claim to be unrelated but share the exact same registered premises. This is a common pattern in fraud rings where several "competitors" are actually run from the same boiler room.

2.6 Advanced Strategies: Infrastructure and IP Forensics

Once you have the legal structure, you need to map the company's web presence. UserSearch Search types help bridge the gap between "paper" companies and their online reality.

1. Linking Domains to Corporate Owners

Use Domain Intelligence (ownership, history and favicon data) to verify whether the company actually controls its main domains.

• Search: domain ownership by domain name, or by the Email address listed as a contact.
• Strategy: If the corporate domain is registered to a personal webmail address rather than a corporate IT address, that points to an immature setup or "shadow IT".
• Historical Context: Check the domain's history to see whether it previously belonged to another organisation or whether the site content shifted dramatically (for example from an unrelated retail site to a logistics company), which is a major red flag.

2. Intellectual Property as a Signal

Patents and trademarks tell you what a company is building, not just what it is selling.

• Patents: Use Product Intelligence (trends, patents, scholarly material, app listings) to find R&D activity. A company claiming to lead in AI should have filings or citations in that area.
• Trademarks: Identify the brand assets it has registered. This matters for due diligence: does the company under review actually own the brand name it is selling?
• Scholarly Material: Look for academic papers published under the company's name. This helps validate technical claims made in sales material and pitch decks.

3. Marketing Presence (Ad Creatives)

Reviewing a company's ad creatives shows you its paid media history.

• Why it matters: You can see how the company positions itself to customers, which may differ from its investor pitch. You can also spot aggressive or misleading ad campaigns that could invite regulatory scrutiny.

4. Website Forensics and Cyber Hygiene

Use site history and shared third-party identifiers to analyse the technical stack.

• Change History: Did the "About Us" page change drastically just before a funding round? Were team members removed?
• Third-Party IDs: Do the analytics or ad IDs match those found on other, apparently unrelated websites? This is a classic OSINT technique for uncovering affiliate networks or undisclosed sister sites. The favicon data in Domain Intelligence can support the same kind of link.
• Reputation Checks: Pivot to Threat Intelligence for the company's main domain. If the corporate domain has a poor reputation or appears on malware blocklists, it suggests weak internal controls or a security incident worth asking about.

2.7 Corporate Red Flags Checklist

When building a company report, look specifically for these warning signs in your UserSearch results:

1. The "Small-Premises HQ": A firm claiming multi-million turnover whose registered office is a small non-commercial address with no trading premises on record.

2. The "Nominee Army": A director who appears on 50+ unrelated companies (often obvious once you list that officer's appointments).

3. The "Ghost Web": A company with no web presence at all (no ads, no patents, no historical website changes) despite claiming years of operation.

4. The "Zombie": A company marked as Dissolved in OpenCorporates that is still trading and taking money through its website.

5. The "Copycat": A domain registered weeks ago that mimics a major brand (compare the domain registration date with the company incorporation date).

2.8 Legal and Ethical Guardrails

Corporate OSINT relies on public data, but ethical boundaries still apply.

• Focus on the Entity: Keep your work on the business and on officers in their professional roles, using public registers. Collect only the personal data your purpose needs, and leave directors' private lives and relatives out of your report.
• Lawful Basis and Proportionality: Under the UK GDPR and EU GDPR, you need a lawful basis for processing personal data about company officers, even when it comes from a public register. Record your purpose (supplier due diligence, compliance, journalism) at the start of each Case, treat UserSearch results as leads for research and analysis, and verify them before any decision that affects an individual.
• Data Freshness: Registries can lag. A company marked "Active" might have entered insolvency yesterday. Always verify critical status with the primary source (the specific registry) before making legal or financial decisions.

2.9 Building a Complete Corporate Report

Corporate OSINT is about context. A company name on a contract is just a starting point. By mapping the directors, the addresses, the IP and the web infrastructure, you build a report that shows the real nature of the business.

Manual searches are necessary for deep legal validation, but for scoping, triangulation and network mapping they are too slow and too siloed. You need a platform that brings the whole picture together: one account, 100+ third-party data sources, OneScan to run one input across several sources with attribution, Cases to keep your work organised, and SargeBot to help draft a PDF report that you then verify.

Stop guessing. Start researching with UserSearch. Run structured corporate OSINT at usersearch.com.

Worked Scenario 1: Due Diligence on a "Global" Supplier

Context: A procurement manager is about to sign a contract with "Vertex Logistics Global", which claims to be a major player with offices in London and New York.

The Research with UserSearch:

1. Company Search: Queries "Vertex Logistics Global". Finds a UK registration only 3 months old.

2. Registered Address Check: The London address returns 400 other companies. It is a virtual office (mail drop).

3. Officer Appointments: The sole director, listed as "A. Smith", holds appointments at 15 other dissolved transport companies, with a pattern of companies created and dissolved roughly every 12 months.

4. Website Forensics: The domain was registered 2 weeks ago with a privacy service. The ads check shows no active campaigns, contradicting claims of global marketing.

5. Outcome: The "Global" presence is a facade. The supplier is probably a new shell or a phoenix company from a failed earlier venture. The manager pauses the contract for further verification.

Worked Scenario 2: Researching a Competitor's New Tech

Context: A tech CEO hears rumours that a competitor, "Omega Corp", is moving into blockchain, despite no public announcements.

The Research with UserSearch:

1. Patents Search: Searching "Omega Corp" in Product Intelligence brings up three recent patent applications for "distributed ledger logistics".

2. Trademark Search: Finds a new trademark filing for "OmegaChain".

3. Domain Ownership: An email-based domain search on the company's published admin address returns a newly registered domain, omegachain.example, which is currently just a holding page.

4. Scholarly Material: Finds a whitepaper published by Omega Corp on blockchain integration.

5. Outcome: The move is real and in the R&D phase. The CEO can now brief the strategy team with hard evidence of the competitor's direction.

Detailed Practitioner Notes

• Name Variations: Always try variations. "Acme Ltd", "Acme Limited", "Acme". Registry matching can be strict.
• Status Codes: Learn the difference between Dissolved (closed down) and Liquidation (closing down, often with debts).
• Cross-Border: Searching a group's company names across jurisdictions can show offshore subsidiaries that a single-country company search would miss.
• Mapping Links: Sketch the officer-to-company links as you go. A star pattern (one director, many companies) or a chain (Company A owns B, which owns C) becomes obvious quickly.
• Data Latency: OpenCorporates and other aggregators may run a few days or weeks behind the live registry. If a filing was made today, go to the source.