Intro to Cybersecurity · How hackers think and act · Day 3 of 4
Intro to OSINT, "Who Sent This?"
How to find out who really sent a suspicious message using only public information, so you can tell a scam from the real thing. Guided practice on fictional cases.
By the end of today you can
- Say what OSINT is and where its information comes from
- List the public clues a message carries about its sender
- Trace a suspicious email, link or number using public sources
- Reach a judgement, with reasons, on whether something is a scam
A message lands: "Your account is locked. Confirm your details now." It looks official. Is it? Today you learn to answer that question the way an investigator does, using only information that is already public.
This is a defender’s skill. Scammers count on you reacting before you check. OSINT is how you check. Every case today is fictional, built for the session, so you practise the method without pointing it at a real person.
1. What Is OSINT?
Definition
OSINT stands for Open Source Intelligence. It means drawing conclusions from information that is already public: a website, a public profile, a company register, the visible details of an email. No breaking in, no secret access. Just reading what is already there, carefully, and putting the pieces together.
Real-Life Scenario
You get a text saying a parcel needs a small fee, with a link. Before paying, you notice the link does not go to the real courier’s website, the sender’s number is a personal mobile, and the courier’s real site says they never ask for fees by text. Three public clues, one clear conclusion: scam. That is OSINT, and you probably already do a little of it.
Passive only. You look at what is public. You never log in to anyone’s account, never message the target to fish for information, and never try to reach anything private. Reading a public page is fine. Anything more is a different activity with different rules.
2. The Clues a Message Carries
Every message brings more than its words. Here is where beginners learn to look.
| Clue | What it can tell you | How to read it |
|---|---|---|
| The real link | Where a link truly points | Hover or long-press to see the true address before tapping |
| The sender domain | Who really owns the address | Read the part after the @ in an email, slowly |
| The display name | Nothing by itself | A name is typed by the sender. It is a claim, never proof |
| A phone number | Country, sometimes carrier | Check its format and country code against who it claims to be |
| Timing and tone | Pressure is a warning sign | "Act now or lose access" is how scams rush you past checking |
Read the Link, Not the Label
A link’s text and a link’s destination are two different things. The text is just a label the sender wrote. Look at the real one.
A friendly label over an unfriendly address
Your real bank uses its own domain. A verify page sitting on some unrelated address is one of the loudest warning signs there is. The label said one thing; the destination told the truth.
Read the Sender, Not the Name
An email shows a friendly name, but the address behind it is what matters.
A trusted name in front of an untrusted address
3. Tracing, Step by Step
Put the clues in an order. On the fictional cases today, walk this path.
- Capture, do not click. Note the link, the sender, the number. Do not tap anything.
- Read the true destination. Where does the link really go? Who owns that domain?
- Check the claim against the source. Does the real company do what the message says? Their official site usually tells you.
- Look up what is public. Is the domain brand new? Does the number match the country it claims? Do the details line up or contradict?
- Write the verdict. Scam or genuine, and the reasons. Always the reasons.
Open AquilaCyber and start Day 3: Who Sent This?
Take the first fictional message. Before anything else, write down the three clues you will check.
Walk the five steps above and reach a verdict with reasons.
Capture the flag the case hides for the correct conclusion. Expected: a solved case and a short written reason you could show someone else.
OSINT on fictional cases is practice. Pointing these steps at a real person to dig up their private life is harassment, and often a crime. We investigate the suspicious message and the claim it makes. We do not investigate strangers for fun.
A message arrives telling you to hurry. Yesterday the hurry worked. Today you feel the push and recognise it for what it is: the part of the scam that wants you to skip the checking. You slow down, read the real address, and decide for yourself.
Practise
- Label versus link. Write a message where the visible text looks trustworthy but the real destination does not. Explain how a reader would catch it.
- Sender check. Given "Bank of Lagos"
- Order the steps. List the five tracing steps from memory, in order.
- Solve a case. Finish at least two fictional cases in Day 3: Who Sent This? and write a one-line reason for each verdict.
Checkpoint
What makes information "open source"?
It is already public: a website, a public profile, a company register, the visible parts of a message. OSINT reads and connects public information. It never involves logging in to or breaking into anything private.
Why is a display name worthless as proof?
Because the sender types it themselves. Anyone can put "Webbo3 Support" or your bank’s name in front of any address. The address behind it, and the true link destination, are what you check.
Someone shares a stranger’s home address they found by digging. Is that OSINT practice?
No. That is targeting a real person, which is harassment and often illegal. OSINT practice here means judging fictional suspicious messages, not exposing real people.
Tick Before You Move On
- ☐ I can say what OSINT is and where its information comes from
- ☐ I can read a link’s true destination and an email’s real sender
- ☐ I can walk the five tracing steps and reach a reasoned verdict
- ☐ I solved cases in Day 3: Who Sent This?
Quick Recap
OSINT is drawing conclusions from information that is already public. A message carries clues: the true link, the real sender, the number, the pressure. Read the destination, not the label; read the address, not the name. Trace in order, reach a verdict with reasons, and only ever on fictional cases or your own safety.
Next: Day 4. You run a full mini investigation on a fictional target, learn how scammers choose who to target, and turn it around to shrink your own footprint. Then we crown the CTF winners.