Ethical OSINT: Investigating Your Own Digital Footprint with Maltego and Spiderfoot

You have already been doxxed and you do not know it. One recent Sunday morning I pointed Spiderfoot HX at my main email and pulled 412 hits in 38 minutes: brokers like BeenVerified and Spokeo, old Collection #1 dumps, a forgotten Last.fm profile from 2011 using the same photo I have on LinkedIn, and two tech forums where I posted my city in the bio. None of those points is dangerous on its own. Combined, they deliver an approximate address, probable salary band, current tech stack, and even my usual sleep hours. That is the blind spot ethical self-OSINT closes, and it is exactly why you should run the exercise before an adversary does.

Why run OSINT against yourself first

Self-OSINT is reconnaissance from the attacker's chair with the ethical advantage that the target consented: you. The goal is to enumerate everything an adversary can gather from open sources and correlate, then shrink it deliberately. Keep the exercise ethical and legal by scoping strictly to your own accounts and data; do not pivot into someone else's mailbox because a shared breach lists them. Work from a clean VM or a dedicated browser profile so the queries themselves do not pollinate your accounts with new sign-in alerts. This self-assessment is the practical test of the model you built in OPSEC for Security Researchers: Building a Personal Threat Model: if the paper model says your home address is protected and a ten-minute scan proves otherwise, the model was fiction.

Maltego Community Edition: the teachable start

Maltego Community Edition is still the most teachable starting point in 2026. Install version 4.6, create a free account, and enable the default Hub transforms: Have I Been Pwned, Shodan free tier, DNS, and WhoisXML. Create an Email Address Entity with your primary address, right-click, and run To Breaches [HIBP]. Then drag a Phrase entity with your full name and run To Websites [using Search Engine]. The graph grows fast, and the trick is to use the Collections tab to collapse nodes before they turn into visual spaghetti. Tag every new node by color: red for real PII, yellow for pseudonyms, green for disposable. That early OPSEC discipline keeps the map readable and turns a sprawling graph into an inventory you can actually act on.

Spiderfoot: automate the tedious sweep

Spiderfoot complements Maltego where manual work burns you out. Use the official container: docker run -p 5001:5001 spiderfoot/spiderfoot and open http://localhost:5001. Create a Footprint scan with your email, personal domain, and phone number, enable All modules except those requiring paid keys, and let it run for 30 to 90 minutes. The sfp_haveibeenpwned module lists historical breaches, sfp_hunter returns secondary emails tied to your domain, and sfp_spider crawls your personal site looking for emails commented out in old HTML. I found a partial ID number in a 2018 conference PDF still indexed by Google, a classic problem retroactively fixed by the techniques in Metadata Hygiene: Stripping EXIF, PDF and Office Before You Publish. Export the scan as CSV so you can diff it against next quarter's run.

Breach data and credential exposure

Breach data is the fastest path from an email to a plaintext or hashed password, and adversaries start there. Check every address you own against Have I Been Pwned, then, within legal limits and only for your own accounts, review credential-exposure aggregators to see which passwords leaked in clear. The correct response is not panic but rotation: change any reused password, move the account to a passkey or a unique passphrase in your manager, and enable phishing-resistant second factors. Treat a leaked password that you still use anywhere as an active incident. The lesson from breach review is always the same: unique credentials per service turn a catastrophic dump into a single, contained account reset. Pay special attention to old accounts you no longer use, because a decade-old password often reveals the pattern you still build newer passwords from, and attackers exploit exactly that human predictability with rule-based cracking.

Photos, reverse image search and EXIF

The least glamorous part is the most valuable: cross-referencing photos. Use PimEyes carefully or, better, self-host FaceCheck.ID via Docker and run your professional headshot against it. In parallel, run exiftool on every public image of you: exiftool -a -G1 -s headshot.jpg leaks GPS latitude, camera model, and sometimes a serial number when you forgot to strip metadata. I once saved a client from active stalking because his Instagram still carried precise GPS for his house in 2019 photos he never cleaned. The full workflow to compartmentalize future visual identities lives in Digital Compartmentalization: Separate Identities Without Leaking Metadata, and it is worth reading before you ever spin up another profile that reuses your face.

Phone numbers: the underestimated vector

Phone numbers are the vector most underestimated. Run PhoneInfoga against your line: phoneinfoga scan -n +14155551234. The tool hits NumVerify, OVH, and Google dorks that surface the number indexed in classifieds, public WhatsApp groups, and even forgotten Google Sheets. Then check it in Truecaller through a clean app in an Android VM to see how third parties see you, often with a nickname leaked by some delivery app. Combine that with regional people-search lookups and you already hold the same dataset a scammer would buy for a handful of dollars on the deep web. For the regional broker playbook, Anti-Doxxing Personal Security: Removing Data from Brazilian Data Brokers is the closest reference even if you operate elsewhere, because the opt-out mechanics generalize.

Usernames and social enumeration

Usernames are connective tissue: reuse one handle across platforms and you hand an adversary a single thread that unravels everything. Run Sherlock or the WhatsMyName list against your common handles to see where the same name resolves, from GitHub to niche forums to abandoned gaming profiles. Each hit is a node to correlate: an old profile might expose a former employer, a school, or a real name in a display field. The remediation is either deletion or deliberate divergence, giving each future identity a fresh, unrelated handle. This is where self-OSINT stops being a report and starts changing how you register accounts for the rest of your career.

Document everything and drive remediation

Document everything in a markdown file structured by category: Email, Phone, Name, Photo, Address, Employer, Family, Usernames. For every exposed item, write a remediation action with a deadline: file an opt-out request, swap the recurring photo, delete an old post, move to passkeys wherever you still use SMS. Re-run the full scan every 90 days and diff the results, and you will see the actual impact of the work. Your digital footprint does not vanish; it only shrinks under discipline. Store the file encrypted alongside the threat model so both documents evolve together and neither drifts into fiction.

Stay inside the ethical and legal line

Ethical OSINT has hard boundaries. Investigate only your own identifiers and accounts; the moment a query would touch a third party without authorization, stop. Do not attempt to log into any surfaced account, do not purchase stolen credential dumps, and prefer tools that query public indexes over those that scrape gated data. The same techniques become illegal the instant the target is not you, so keep a written note of scope for your own records. The discipline you practice on yourself is exactly the discipline that keeps a paid engagement lawful when the target is a client who signed a statement of work.

FAQ: is running these tools on myself legal?

Investigating your own accounts, emails, phone numbers and public footprint is legal in essentially every jurisdiction because you are the data subject. The gray zones appear when a breach dataset also contains other people, when a reverse image search returns strangers, or when you attempt to authenticate into an account to confirm access. Stay read-only, stay scoped to your own identifiers, and never act on data about others. If you want to run the same sweep for a client, get written authorization first, exactly as you would for a pentest.

FAQ: how far back should I look?

As far back as the internet remembers, which is further than you think. Forgotten forum accounts from a decade ago, archived versions of deleted pages, and old conference PDFs routinely carry the most damaging correlations because you have stopped thinking about them. Query archive services and old usernames explicitly, because current-web tools miss what only survives in caches. The oldest data is often the most dangerous precisely because it predates your OPSEC discipline and you no longer control the accounts that leaked it.

Practical takeaway: block 4 hours on your calendar now, install Maltego CE and Spiderfoot this week, and treat your own name as a bug bounty target whose payout is your own peace of mind. Run the sweep once to establish a baseline, remediate the worst exposures, then schedule the same scan every quarter. Keep the raw exports so you can prove to yourself that a specific opt-out actually removed a record rather than merely promising to, because brokers routinely re-ingest the same data months later. The footprint you cannot see is the one an adversary uses first, so the only winning move is to see it before they do.