A Curated OSINT Cheat Sheet That Also Tells You How Not to Get Burned
You're researching a target, a domain, or a person, and you need tools. You start bookmarking, and within an hour you've got forty tabs, half of them dead, and no idea which ones are safe. The OSINT Cheat Sheet by Jieyab89 collects those tools, datasets, tips, and Maltego transforms in one place—and, unusually, pairs them with a set of safety practices so you don't torch your own machine while you work.
What It Does
At its core, this is a list. It gathers OSINT tools (both free and paid), OSINT tips, datasets, and Maltego transforms into a single repository. The scope is broad rather than deep—the README doesn't walk you through each tool, it points you at them and categorizes them. The maintainer is upfront that some resources may be gone or contain errors, since the list isn't regularly checked, and that new entries get added along with their category as they come up.
Beyond the list itself, the project links out to a GitHub Wiki ("Jieyaboo Wiki") covering OSINT tips, OSINT branches, and intelligence knowledge, plus a Gitbook that's described as holding write-ups, use cases, and research. Be aware: the README notes that, as of an August 2026 update, both the Gitbook and the GitHub Wiki have been made private. So the core value you can count on today is the repository content itself. Everything is framed as educational, the owner takes no responsibility for how you use it, and you're told to take your own risks.
Why It's Cool
-
The safety guide is the real standout. Most tool lists hand you a pile of links and wish you luck. This one opens with a "Tips & Trick Safe Guide" that treats the collection as a threat surface. It points at supply chain attacks, the OWASP Top 10 2025, and campaigns involving fake captchas, injected scripts, and obfuscated code—then tells you to run everything in a sandbox machine that holds no personal or office data.
-
It assumes you'll be targeted, not just the target. The advice covers fake social accounts, temp email and phone numbers, VPNs, Tor, and P2P networks. There's a practical note about staying active on platforms (posting, following) so you don't get flagged as a bot, which is the kind of operational detail you rarely see spelled out.
-
The tool-shopping advice is refreshingly blunt. If a tool is paid, try the demo with a sock account first. If payment is in crypto, track the transaction with Arkham or similar. If it's not crypto, check for real contact and support info before paying. Don't rush. If you must pay, find the cheapest tier and use a virtual account. That's honest guidance for a space full of sketchy vendors.
-
It covers the boring-but-important stuff. Disable JavaScript and ads with privacy extensions, scan every file you download, encrypt your traffic and disk, and be wary of macro documents—check properties before you ever hit enable. It also warns against running obfuscated code from plugins, browser extensions, or editor extensions without reviewing the source and checking community usage.
-
It self-polices. The maintainer says malicious or untracked resources will be removed, and asks you to report weird captchas or broken links through issues or discussions. That feedback loop is what keeps a list like this usable over time.
How to Try It
This is a reference, not a package—there's nothing to install. The fastest path:
- Open the repository at github.com/jieyab89/osint-cheat-sheet.
- Read the safety guide at the top before you click anything. It's short and it matters.
- Set up your environment first—a VM, Docker container, or cloud VPS with no personal data, plus AV, firewall, and IDS enabled.
- Browse the categories that fit your work and note what you need. Check each resource's status yourself, since the maintainer doesn't regularly verify links.
- If something's broken or looks malicious, file an issue or start a discussion.
Keep in mind the Wiki and Gitbook are currently private, so the repository is your primary reference for now.
Final Thoughts
This isn't a polished, continuously audited directory—it's a working list maintained by one person, with the caveats stated plainly. That honesty is part of its appeal. It's best for people getting into OSINT who need a starting map and, more importantly, a realistic sense of the risks involved in clicking through unfamiliar tools. If you already have a mature toolkit, you'll mostly benefit from the safety section. Either way, the reminder to isolate your environment and question every download is worth more than the links themselves.
Follow @githubprojects for more developer tools and open source projects.