Disclaimer: This article is for education and for lawful, authorised professional research. Use these methods only where you have a legitimate purpose and a lawful basis, and follow the laws and platform terms that apply to you, including data protection law such as the UK GDPR and EU GDPR. See our Terms of Service.
TL;DR
- OSINT pivoting means taking an attribute from one result (a domain, a username, a company number, a wallet) and using it as the input for the next search. Done well, one email address becomes a verified set of leads.
- Every pivot has a strength. Email to its own domain is near-certain; username to "same operator on another site" is often weak. Rate each hop, and never let a chain be stronger than its weakest link.
- Most false links come from a short list of causes: common handles, recycled phone numbers, shared hosting, privacy-protected registrations, exchange wallets and namesakes. We show how to test for each.
- The manual route uses dig, RDAP, crt.sh, maigret, the Companies House API and a blockchain API. UserSearch OneScan and Cases do the same pivots with source attribution and a stored search history.
One Identifier, Twenty Tabs, No Answer
OSINT pivoting is the practice of taking an attribute from one search result, such as a domain, a username or a wallet, and using it as the input for the next search. Every research job starts with a single thread: an invoice email, a handle in a chat log, a wallet in a payment request. The first search returns a handful of results. Each result has three or four new identifiers in it. Twenty minutes later there are twenty tabs open, a notepad full of half-copied usernames and no clear record of which result came from which search.
That is pivoting without a method, and it produces two failures. The first is the obvious one: you miss the link that mattered because it was in tab fourteen. The second is worse. You connect two things that are not connected, because a username matched or a phone number appeared twice, and the false link flows straight into a report and a decision.
This guide gives you a disciplined pivot method: how to move from an email to a domain, accounts, a company and a wallet; how to rate the confidence of each hop; how to test for the common false links; and how to keep the chain auditable.
What Is Pivoting in OSINT?
A pivot is a hop from one identifier to another through a shared attribute. The business mailbox [email protected] contains a domain; the domain has registration records and certificates; the certificates list other hostnames; the website names a company; the company filing lists officers and an address; the website publishes a payment wallet. Each arrow is a pivot.
Under the hood, pivoting is a form of record linkage: deciding whether records in different datasets refer to the same entity. Record linkage has a long history in statistics, and one lesson carries over directly. Deterministic matches on unique keys (a company number, a full email address, a wallet address) are strong. Probabilistic matches on non-unique fields (a name, a handle, an avatar) are only as good as the number of independent fields that agree.
So the unit of pivoting is not the identifier. It is the link between two identifiers, and each link needs its own confidence rating.
Why Careful Pivoting Matters for Compliance and Security Teams
Official sources increasingly publish identifiers designed to be pivoted on. When OFAC designated the Garantex successor exchange Grinex and associated companies in August 2025, the published designation details included website addresses, digital currency addresses and foreign business registration numbers alongside names. A compliance analyst who can pivot from a customer's wallet or domain to those listed identifiers, and rate the strength of the match, is doing exactly what sanctions screening needs.
Registers are changing too. Since 18 November 2025, Companies House requires identity verification for new directors and people with significant control, with existing officers moving across during their next confirmation statement. That should make officer records more dependable over time, but it also means a pivot from company to officer can look different depending on when you run it. Date every hop.
For AML teams, the payoff is fewer false matches and faster escalation of true ones, which is why our anti-money laundering page puts pivoting and source attribution at the centre of the workflow.
How Do You Run a Manual Pivot Chain from an Email Address?
Here is the chain we run by hand, starting from an email address at a company domain. Record every command, its output file and the time in UTC.
Email to Domain and Mail Infrastructure
The domain is in the email. The first question is whether it actually receives mail and who hosts it.
dig +short MX example-trading.example.com
dig +short TXT example-trading.example.comMX returns the mail servers; a domain whose MX points to a large hosted mail provider tells you little, while one pointing to its own server is more distinctive. TXT returns SPF and verification records, which sometimes name the third-party services a company uses. If MX returns nothing, the address may not receive mail at all, which is itself a finding for an invoice email.
Domain to Registration History
WHOIS output is inconsistent and often redacted. RDAP is its structured replacement. You can query it through ICANN's registration data lookup in a browser, or from the command line:
curl -sL https://rdap.org/domain/example-trading.example.com | jq '.events, .entities[].roles'-L follows the redirect from the rdap.org bootstrap service to the authoritative registry, and the jq filter pulls registration, expiry and last-changed events plus the roles of listed entities (registrar, registrant). Expect registrant details to be redacted for most domains. The creation date alone is often the most useful field: a domain registered last month behind an invoice claiming a ten-year trading history is a red flag.
Domain to Related Hostnames via Certificates
Certificate Transparency logs record every publicly trusted TLS certificate. crt.sh searches them for free, with no key.
curl -s "https://crt.sh/?q=%25.example-trading.example.com&output=json" \
| jq -r '.[].name_value' | sort -u%25 is a URL-encoded wildcard, so the query covers all subdomains; output=json returns machine-readable results; sort -u removes duplicates. crt.sh is a free community service and times out or returns errors under load, so retry later rather than hammering it. Subdomains such as pay. or portal. can reveal services the main site does not mention.
Brand Handle to Other Platforms
The purpose at this step is supplier verification: you are checking whether the business accounts around a company mailbox really belong to the company it names. If the website footer lists a brand handle, for example exampletrading_official, maigret checks it across thousands of sites.
pip install maigret
maigret exampletrading_official --html
maigret exampletrading_official -a --htmlBy default maigret checks the top 500 sites by traffic; -a checks all of them, which takes much longer. --html writes a report file for your appendix. Maigret also extracts new usernames and IDs from pages it finds and searches those automatically. That makes it a pivot engine in its own right, so review every chained result before you trust it. Our guide to mapping a username's footprint across 3,000 sites covers that review step.
Domain to Company
The website footer or terms page usually names a legal entity. In the UK, confirm it against the register through the Companies House API. You need a free API key, sent as the basic-auth username with nothing after the colon.
curl -s -u "YOUR_API_KEY:" \
"https://api.company-information.service.gov.uk/search/companies?q=example+trading"
curl -s -u "YOUR_API_KEY:" \
"https://api.company-information.service.gov.uk/company/00000000/officers"The first call searches by name; the second lists officers for a company number. The documented rate limit is 600 requests per five minutes per key, after which you get HTTP 429 until the window resets. Name searches return many near-matches, so pivot on the company number as soon as you have it.
Website to Wallet
If the company publishes a payment wallet, the public ledger is the next hop. The mempool.space REST API needs no key for light use.
curl -s "https://mempool.space/api/address/bc1q...placeholder"
curl -s "https://mempool.space/api/address/bc1q...placeholder/txs"The first call returns funded and spent totals and transaction counts; the second returns recent transactions, which give you counterparty addresses for the next pivot. Treat any clustering or attribution of those addresses as a low-confidence pivot until an independent source supports it.
A Confidence-Rated Pivot Table
Rate every hop before you use it as the base for the next one. This is the table we use as a starting point. Adjust it for your sources.
| From | To | Method | Default confidence | What raises it | Common false link |
|---|---|---|---|---|---|
| Its domain | Parse the address | High | MX records resolve | Free-mail domains tell you nothing | |
| Domain | Company | Website footer, terms, register match | Moderate | Register lists the domain or matching address | Lookalike names; resellers |
| Company number | Officers | Official register | High | Verified officer status | Namesakes across other companies |
| Business mailbox | Brand accounts | Email Intelligence | Moderate | Account content matches other facts | Stale or reused addresses |
| Email local part | Username | Same string as a handle | Low | Bio links back to the domain | Common handles |
| Username | Same operator elsewhere | maigret, Username Intelligence | Low | Two or more independent matching attributes | Different people with the same handle |
| Domain | Other domains | Shared IP, favicon, certificate | Low to moderate | Unique favicon plus shared registrar and dates | Shared hosting, CDNs |
| Phone number | Listed business | Phone Intelligence, public listings | Low to moderate | Recent, consistent listings | Recycled numbers |
| Website | Wallet | Wallet published on the site | High | Archived copies show it over time | Copied or swapped addresses |
| Wallet | Counterparty entity | Transaction analysis, attribution data | Low to moderate | Attribution from an independent source | Exchange and service wallets |
The rule that makes the table useful: a chain's confidence is the confidence of its weakest link. If you reach a wallet through a low-confidence username hop, the wallet finding is low confidence, however solid the last hop looks.
How Do False Links Get In, and How Can You Test for Them?
Common Handles
Short or wordy handles such as jdoe, alex92 or crypto_king exist on hundreds of sites, owned by different people. Before you treat two accounts as one operator, require at least two independent attributes to agree: a bio link to the same domain, the same avatar image, overlapping and distinctive interests, or consistent account creation dates. One matching string is a lead, never a link. Our username analysis knowledge base covers uniqueness checks in more depth.
Recycled Phone Numbers
Mobile numbers are reassigned after they are disconnected. In the US, the FCC's reassigned numbers database was built precisely because tens of millions of numbers change hands each year, as this legal explainer on the database's launch sets out. A number that appeared in a 2019 listing may belong to someone else today. Treat old phone links as history and weight recent, consistent listings above old ones.
Shared Infrastructure
Thousands of unrelated sites share an IP address on cheap hosting or behind a CDN. A shared IP is only interesting on a dedicated server. Favicon hashes are stronger, because a custom favicon is rarely reused by accident, but template favicons are common. Check both against registration dates before connecting two domains.
Privacy Services and Registrar Defaults
Two domains with the same redacted registrant or the same privacy service are not linked by that fact. Millions of domains show identical privacy details.
Exchange and Service Wallets
Funds that pass through a large exchange mix with those of countless other customers. Two users who both paid an exchange deposit address are not connected to each other. Identify service wallets before you pivot through them.
Namesakes in Registers
Officer searches by name return every person with that name. Pivot on distinguishing attributes (correspondence address and other appointments) rather than the name alone.
Running the Same Pivots in UserSearch with OneScan and Cases
The manual chain above works, but it spreads your evidence across a terminal, a browser, a spreadsheet and three API accounts. In UserSearch 2.0, each hop is a search in one workspace with 18 Search types and 100+ third-party data sources behind one account.
OneScan is built for the first hop. It runs one input, say the email address, across several data sources you select, merges the results and keeps source attribution on each item, so you can rate each link by the provider that produced it. The Credit cost is the sum of the selected sources and is shown before you run it. From there, each new identifier becomes the input for the next search type: Domain Intelligence for ownership, history and favicon; Corporate Intelligence for the company; Username Intelligence for handles; Cryptocurrency for wallets; IP Intelligence for hosting. Bulk search runs up to five inputs through one Module at a time, which suits a list of handles or officer names.
Cases hold the chain together. In Forensic Mode, your search history and bookmarks are stored in the Case, so every hop has a timestamped origin and a reviewer can replay the route. Shared team Cases let a colleague check your weakest links before a report goes out. When you need an extra pair of hands, SargeBot can suggest and build entity searches against a lawful objective you set; treat its suggested links as hypotheses to rate, not conclusions.
Worked Scenario: An Invoice Email Leads to a Lookalike Domain
Context. An accounts payable team at a UK manufacturer receives an email from [email protected] asking them to update the bank details for Example Trading Ltd (fictional), a long-standing supplier whose real domain is exampletrading.example.com. The finance controller asks: is this email from the supplier?
Actions. The analyst opens a Case in Forensic Mode and runs OneScan on the email. Domain Intelligence on the sender domain shows it was registered six days earlier; the real supplier domain was registered in 2012. Certificate data shows a single hostname. The sender domain's MX points to a free hosted mail service, while the real domain uses its own mail server. Corporate Intelligence confirms the company number and registered office match the real domain's website, not the new one.
Outcome. Confidence rating: the email-to-domain hop is high, and the domain-to-supplier hop fails (no connection to the company on any source). The analyst reports "highly likely the request did not come from the supplier" and the team verifies by calling the supplier on a number from their existing contract file. The payment details stay unchanged. The whole chain, with timestamps, sits in the Case for the audit file.
Worked Scenario: The Handle Shared by Unrelated Accounts
Context. A security team finds the handle @example_handle in a public paste promoting a lookalike login page for their company. They want to map which accounts and infrastructure connect to it.
Actions. Username Intelligence returns 14 accounts with that handle. The analyst applies the two-attribute rule. Three accounts share an avatar and link to the same newly registered domain, login-example.example.org, which Domain Intelligence shows shares a distinctive favicon with the lookalike page. The other 11 accounts have different avatars, languages, creation years and interests: a gaming account from 2014, a photography account, a hobby code repository and others.
Outcome. The report links three accounts (moderate confidence, supported by avatar, domain and favicon) and explicitly excludes the other 11 as unrelated namesakes. Without the rule, the report would have linked a hobby code repository and a photography account to the campaign. With it, the team files abuse reports against three accounts and one domain, and no unrelated account ends up in the file. Our guide to reverse username OSINT covers handle analysis in more detail.
Advanced Pivot Patterns
Pivot on Time, Not Just Attributes
Creation dates are underused. A domain, a Telegram channel and three social accounts all created within the same week is a pattern even when no shared string connects them. Build a simple timeline of first-seen dates for every identifier in a case and look for clusters.
Favicon and Certificate Pivots for Infrastructure
For infrastructure work, favicon hashes and certificate details are among the best pivots available, because operators reuse templates across campaigns. Domain Intelligence shows favicon history; certificate logs show when new hostnames appear. See our domain and WHOIS infrastructure guide for the full method.
Set a Pivot Budget
Before you start, decide how many hops from the original identifier are in scope. Three hops is usually enough for due diligence. Every hop beyond that multiplies the chance of a false link and pulls in data about people with no connection to your question.
Reverse the Chain to Test It
When you reach a conclusion, start from the end and pivot backwards. If the wallet does not lead back to the domain through an independent route, the forward chain may rest on a coincidence.
Pivoting Within Legal and Ethical Limits
Pivoting is where scope creep happens, because each hop offers five more. Write your question and your pivot budget down before you start, and stop when you have answered it. Collect only identifiers relevant to that question, keep them in the Case rather than scattered across personal notes, and set a retention date.
Work from public and lawfully available sources, respect platform terms and rate limits, and record your lawful basis, which for most private-sector work is legitimate interests supported by an assessment. Be most careful with people who appear in a chain by coincidence: namesakes, previous holders of a phone number, other customers of the same exchange. Exclude them explicitly in your report. Search results are leads to corroborate, not facts, and coverage and freshness depend on the underlying source.
Frequently Asked Questions About OSINT Pivoting
What is OSINT pivoting?
OSINT pivoting is the practice of taking an attribute from one result, such as a domain, a username, a company number or a wallet address, and using it as the input for the next search. Each hop between two identifiers is a pivot, and when it is done with a method, one email address can become a verified set of leads.
How do you rate the confidence of a pivot?
Rate each pivot on its own before using it for the next search. Deterministic matches on unique keys, such as a full email address, a company number or a wallet address, are strong, while matches on names, handles or avatars are weak. A chain of OSINT pivots is only as strong as its weakest link, however solid the final hop looks.
What causes false links in OSINT pivoting?
Most false links in OSINT pivoting come from a short list of causes: common handles used by different people, recycled phone numbers, shared hosting and CDNs, identical privacy-protected domain registrations, exchange and service wallets that mix many customers' funds, and namesakes in company registers. Each cause needs its own test before two identifiers are treated as connected.
How can you tell if two accounts with the same username have the same operator?
One matching username is a lead, never a link. Before treating two accounts as one operator, require at least two independent attributes to agree, such as a bio link to the same domain, the same avatar image, overlapping and distinctive interests, or consistent account creation dates. Accounts that differ in language, age and interests should be excluded as namesakes.
What tools are used for OSINT pivoting?
Common free tools for OSINT pivoting include dig for mail and DNS records, RDAP for domain registration history, crt.sh for certificate transparency, maigret for brand handles, the Companies House API for company officers and the mempool.space API for Bitcoin wallets. The Companies House API needs a free key; the others need no key for light use.
How many pivots should an OSINT research job use?
For due diligence, three hops from the original identifier is usually enough. Setting a pivot budget before starting keeps OSINT research in scope, because every extra hop multiplies the chance of a false link and pulls in data about people with no connection to the question. Writing down the question and the budget also supports data minimisation.
Turn One Identifier into Leads You Can Defend
Good pivoting is not about how many hops you can make. It is about knowing the strength of each one, testing for the familiar false links, and keeping a record that lets someone else walk the same path.
Stop guessing. Start researching with UserSearch. One account reaches 100+ data sources across 18 Search types, OneScan runs your first identifier across the sources you choose with attribution on every result, bulk search handles lists of handles or names, Cases in Forensic Mode store every hop with its time and origin, team Cases let a colleague test your weakest link, and SargeBot can build the next searches and draft a PDF report for you to verify.