THE EMPORIUM
OSINT

Map Your Own Digital Footprint in an Afternoon

Editorial··2 min read

Before an attacker phishes your staff or spoofs your brand, they do homework — and their homework uses sources you can check yourself, for free, this afternoon. This walkthrough is written for a small business or an individual professional; adapt the scope to fit.

Ground rule: assess only what you own or are authorized to assess. Everything below is applied to your own name, domain, and accounts.

1. Start with your domain

Your domain leaks more than your website shows. Check what’s publicly recorded about it:

# Registration details and nameservers
whois yourdomain.com

# What your DNS publishes
dig yourdomain.com ANY +noall +answer
dig TXT yourdomain.com +short

Look for: personal names or home addresses in WHOIS (use registrar privacy), stale TXT records referencing services you no longer use, and SPF records that list every vendor you email through — a handy vendor map for a phisher.

2. Enumerate what certificates reveal

Every TLS certificate ever issued for your domain is in public Certificate Transparency logs. Search your domain on crt.sh and you’ll see every subdomain that ever got a certificate — including that staging. or vpn. host you forgot about. Forgotten subdomains are a classic entry point; anything you find that shouldn’t be public goes on the cleanup list.

3. Search yourself like a stranger would

Use quoted searches for your name, business name, and phone number, plus your email addresses. Then repeat with site: filters against the platforms you actually use. You’re looking for:

  • Old accounts you forgot existed (each one is an attack surface and a password-reuse risk).
  • Personal details in public posts — birthdays, pet names, and hometowns are password-recovery answers.
  • Documents you didn’t mean to publish: add filetype:pdf or filetype:xlsx with your domain to find them.

4. Check breach exposure

Search your email addresses on Have I Been Pwned. A hit doesn’t mean you’re currently compromised — it means a password you used there is circulating. Any account sharing that password needs it rotated, and everything important needs multi-factor authentication regardless.

5. Review your people surface

For a business, staff are the most-targeted surface. Look at what your team lists publicly on professional networks: job titles that identify who handles payments, posts that reveal internal tool names, out-of-office details that time attacks. The fix is awareness and policy, not censorship — people should just know what those details are worth to an attacker.

6. Triage what you found

Sort every finding into three buckets:

  1. Remove — data that serves no purpose: dead subdomains, old accounts, exposed documents. Delete, decommission, or take down.
  2. Reduce — data that must exist but says too much: tighten WHOIS privacy, prune old posts, generalize job descriptions.
  3. Accept and monitor — data that has to stay public. Set alerts for your name and domain so you notice when something new appears.

An afternoon of this, once a quarter, keeps your footprint deliberate instead of accidental — and it’s the same map an attacker would draw, minus the surprise.