MyRecon OSINTPractical privacy and public-source guides
Choose the task you need to finish. These guides provide action steps and worked examples; examples are labeled so they are not confused with observed research. The breach, password and account-security explainers below complement the public-source workflows.
Username Checker False Positives: A Review Workflow
Recognize soft errors, generic login pages and ambiguous responses. Use verified controls and distinguish found, not found and unknown. Brand Impersonation: Review, Evidence & Reporting
Build an official account register, triage brand lookalikes, save an evidence packet and verify the outcome of a platform report. Digital Footprint Audit: A Practical Action Checklist
Audit your own accounts using saved records, signed-out profile checks, a prioritized action log and verification after each privacy change. Protect Research Notes: Storage, Sharing & Retention
Protect research notes with restricted sharing, a signed-out permission test, secret separation, redaction checks and a retention log. Log Public Web Evidence: URLs, Context & Integrity
Create a reproducible public-source evidence register with timestamps, access context, restricted screenshots and honest hash limitations. Search Usernames Across Platforms: Review & Action
Run a public username sweep, review source URLs, confirm your own old accounts and turn candidate results into verified account actions. Verify OSINT Account Matches
Verify username leads with original URLs, independent public links, conflicts and an illustrative decision log. Keep unresolved matches explicit. Your Account Was Hacked: What to Do in the First Hour
A runbook for the hour after an account is taken: regain access, revoke sessions, and find the quiet changes attackers leave behind that survive a password reset. Build a Data Breach Monitor With a Free API
A working breach monitor in about forty lines of Python, using a free keyless JSON API. Polling, change detection, alerting, and the mistakes that make one useless. How to Check If Your Email Was in a Data Breach
Learn what a data breach is, how to check whether your email address was exposed, and the exact steps to protect your accounts if it turns out that it was. DNS Records Explained: A, MX, TXT, NS and the Rest
A plain-English guide to DNS record types, A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, what each one does, and what it reveals during an investigation. How Data Breaches Actually Happen: The Seven Ways In
Almost every large data breach starts one of seven ways. What each route looks like, which famous cases it produced, and what actually stops it. How Data Brokers Collect and Sell Your Personal Data
Who data brokers are, where they get your information, how they profit from it, and the practical steps you can take to opt out and limit your exposure. How to Spot a Phishing Email or Website
A practical checklist for spotting phishing emails and scam websites: the red flags, how to inspect a link or domain safely, and what to do if you clicked. How to Investigate a Suspicious Domain: A Step-by-Step Guide
A repeatable workflow for investigating a domain you don't trust: registration age, DNS and mail setup, hosting and IP, subdomains, and certificate history. IP Geolocation and Reverse DNS: What an IP Really Reveals
How IP geolocation is estimated, what ASN and hosting flags mean, and how reverse DNS gives investigators a useful clue about a server's real identity. Passkeys Explained: Logging In Without a Password
What a passkey actually is, why a convincing fake site cannot use one, what happens when you lose the device, and the recovery path that quietly undoes the whole benefit. Do People-Search Apps Actually Find Anything?
What AI people-search apps really query, the two-minute test that shows whether one works, and the checks to run on a store listing before you pay for it. What Your Photos Give Away: EXIF and Image Metadata
What is stored inside an image file, which platforms strip it and which do not, how to read it, and why a missing timestamp proves nothing either way. How to Read a Data Breach Notification
What the phrases in a breach notice actually mean, which exposed fields matter most, how to tell a real notice from a phishing email, and what to do first. How to Read an Email Header
The fields that tell you where a message really came from, which ones can be forged, and the one line that settles most questions in a second. How to clear your digital footprint and reduce public exposure
A step-by-step routine to find, shrink and control the public data about you online, from breach checks and password hygiene to deleting old accounts. How to Remove Your Personal Information From Search Results
Delisting from a search engine is not deletion from the web. The order that actually works, the requests that succeed, and what no form can remove. Reverse Image Search: How to Trace a Photo's Origin
How reverse image search works, which tools to use, and a practical workflow for verifying photos, spotting fake profiles and tracing where an image appears. Search Operators: The OSINT Skill Hiding in the Search Box
The operators that still work, the ones quietly retired, and how to use them to audit what the web already publishes about you. SIM Swap Attacks: How a Phone Number Gets Stolen
How attackers move a number to their own SIM, why losing signal is the first symptom, the settings that prevent it, and what to do in the first ten minutes. How to Lock Down Your Social Media Privacy
A settings-by-setting guide to reducing what strangers can see and find on your social media, from discoverability to location history and old public posts. Email Authentication Explained: SPF, DKIM and DMARC
A plain-English guide to SPF, DKIM and DMARC, the DNS records that stop spammers spoofing your domain, how they work together, and how to read them. Stealer Logs: Why Your Password Leaked With No Breach
Understand how infostealer malware exposes credentials, how device infections differ from service breaches, and what to check after an exposure notice. Password Security: How to Create and Manage Strong Passwords
Why password reuse is dangerous, how to create strong passwords, why a password manager is the real fix, and how to check whether your passwords have leaked. Subscription Trap Apps: How to Cancel and Get a Refund
The design patterns behind apps that bill you weekly, how to cancel on Google Play and the App Store, how to request a refund, and what to do if that fails. Two-Factor Authentication: Why It Matters and How to Set It Up
What two-factor authentication is, why it stops most account takeovers, the different 2FA methods ranked by security, and how to set it up the right way. Username OSINT: How to Find Accounts Across Platforms
How username enumeration works across social and developer platforms, why a match is not proof of identity, and how to verify a profile with confidence signals. How to Verify an OSINT Finding Before You Act on It
A matching username is not proof of identity. A practical method for confirming a profile really belongs to who you think, and the traps that fool people. What a Website's Response Actually Tells You
200, 404, 403 and 429 mean very different things when you check whether an account exists. How to read platform responses, and why networks disagree. What Is OSINT? A Beginner's Guide to Open-Source Intelligence
A clear beginner's guide to open-source intelligence: what OSINT is, how it works, who uses it, the main techniques, and how to practise it ethically. WHOIS and RDAP Explained: Who Owns a Domain?
Understand a domain's registration record: registrar, creation and expiry dates, DNSSEC, status codes and nameservers, and why RDAP is replacing WHOIS. Why Username Checkers Report Accounts That Don't Exist
We measured what 24 platforms return for a real handle and an invented one. On several the responses are identical, which is why checkers invent accounts.
Recognize soft errors, generic login pages and ambiguous responses. Use verified controls and distinguish found, not found and unknown. Brand Impersonation: Review, Evidence & Reporting
Build an official account register, triage brand lookalikes, save an evidence packet and verify the outcome of a platform report. Digital Footprint Audit: A Practical Action Checklist
Audit your own accounts using saved records, signed-out profile checks, a prioritized action log and verification after each privacy change. Protect Research Notes: Storage, Sharing & Retention
Protect research notes with restricted sharing, a signed-out permission test, secret separation, redaction checks and a retention log. Log Public Web Evidence: URLs, Context & Integrity
Create a reproducible public-source evidence register with timestamps, access context, restricted screenshots and honest hash limitations. Search Usernames Across Platforms: Review & Action
Run a public username sweep, review source URLs, confirm your own old accounts and turn candidate results into verified account actions. Verify OSINT Account Matches
Verify username leads with original URLs, independent public links, conflicts and an illustrative decision log. Keep unresolved matches explicit. Your Account Was Hacked: What to Do in the First Hour
A runbook for the hour after an account is taken: regain access, revoke sessions, and find the quiet changes attackers leave behind that survive a password reset. Build a Data Breach Monitor With a Free API
A working breach monitor in about forty lines of Python, using a free keyless JSON API. Polling, change detection, alerting, and the mistakes that make one useless. How to Check If Your Email Was in a Data Breach
Learn what a data breach is, how to check whether your email address was exposed, and the exact steps to protect your accounts if it turns out that it was. DNS Records Explained: A, MX, TXT, NS and the Rest
A plain-English guide to DNS record types, A, AAAA, MX, NS, TXT, CNAME, SOA, CAA, what each one does, and what it reveals during an investigation. How Data Breaches Actually Happen: The Seven Ways In
Almost every large data breach starts one of seven ways. What each route looks like, which famous cases it produced, and what actually stops it. How Data Brokers Collect and Sell Your Personal Data
Who data brokers are, where they get your information, how they profit from it, and the practical steps you can take to opt out and limit your exposure. How to Spot a Phishing Email or Website
A practical checklist for spotting phishing emails and scam websites: the red flags, how to inspect a link or domain safely, and what to do if you clicked. How to Investigate a Suspicious Domain: A Step-by-Step Guide
A repeatable workflow for investigating a domain you don't trust: registration age, DNS and mail setup, hosting and IP, subdomains, and certificate history. IP Geolocation and Reverse DNS: What an IP Really Reveals
How IP geolocation is estimated, what ASN and hosting flags mean, and how reverse DNS gives investigators a useful clue about a server's real identity. Passkeys Explained: Logging In Without a Password
What a passkey actually is, why a convincing fake site cannot use one, what happens when you lose the device, and the recovery path that quietly undoes the whole benefit. Do People-Search Apps Actually Find Anything?
What AI people-search apps really query, the two-minute test that shows whether one works, and the checks to run on a store listing before you pay for it. What Your Photos Give Away: EXIF and Image Metadata
What is stored inside an image file, which platforms strip it and which do not, how to read it, and why a missing timestamp proves nothing either way. How to Read a Data Breach Notification
What the phrases in a breach notice actually mean, which exposed fields matter most, how to tell a real notice from a phishing email, and what to do first. How to Read an Email Header
The fields that tell you where a message really came from, which ones can be forged, and the one line that settles most questions in a second. How to clear your digital footprint and reduce public exposure
A step-by-step routine to find, shrink and control the public data about you online, from breach checks and password hygiene to deleting old accounts. How to Remove Your Personal Information From Search Results
Delisting from a search engine is not deletion from the web. The order that actually works, the requests that succeed, and what no form can remove. Reverse Image Search: How to Trace a Photo's Origin
How reverse image search works, which tools to use, and a practical workflow for verifying photos, spotting fake profiles and tracing where an image appears. Search Operators: The OSINT Skill Hiding in the Search Box
The operators that still work, the ones quietly retired, and how to use them to audit what the web already publishes about you. SIM Swap Attacks: How a Phone Number Gets Stolen
How attackers move a number to their own SIM, why losing signal is the first symptom, the settings that prevent it, and what to do in the first ten minutes. How to Lock Down Your Social Media Privacy
A settings-by-setting guide to reducing what strangers can see and find on your social media, from discoverability to location history and old public posts. Email Authentication Explained: SPF, DKIM and DMARC
A plain-English guide to SPF, DKIM and DMARC, the DNS records that stop spammers spoofing your domain, how they work together, and how to read them. Stealer Logs: Why Your Password Leaked With No Breach
Understand how infostealer malware exposes credentials, how device infections differ from service breaches, and what to check after an exposure notice. Password Security: How to Create and Manage Strong Passwords
Why password reuse is dangerous, how to create strong passwords, why a password manager is the real fix, and how to check whether your passwords have leaked. Subscription Trap Apps: How to Cancel and Get a Refund
The design patterns behind apps that bill you weekly, how to cancel on Google Play and the App Store, how to request a refund, and what to do if that fails. Two-Factor Authentication: Why It Matters and How to Set It Up
What two-factor authentication is, why it stops most account takeovers, the different 2FA methods ranked by security, and how to set it up the right way. Username OSINT: How to Find Accounts Across Platforms
How username enumeration works across social and developer platforms, why a match is not proof of identity, and how to verify a profile with confidence signals. How to Verify an OSINT Finding Before You Act on It
A matching username is not proof of identity. A practical method for confirming a profile really belongs to who you think, and the traps that fool people. What a Website's Response Actually Tells You
200, 404, 403 and 429 mean very different things when you check whether an account exists. How to read platform responses, and why networks disagree. What Is OSINT? A Beginner's Guide to Open-Source Intelligence
A clear beginner's guide to open-source intelligence: what OSINT is, how it works, who uses it, the main techniques, and how to practise it ethically. WHOIS and RDAP Explained: Who Owns a Domain?
Understand a domain's registration record: registrar, creation and expiry dates, DNSSEC, status codes and nameservers, and why RDAP is replacing WHOIS. Why Username Checkers Report Accounts That Don't Exist
We measured what 24 platforms return for a real handle and an invented one. On several the responses are identical, which is why checkers invent accounts.
Choose an outcome before collecting data
For your own accounts, start with the digital-footprint checklist and username workflow. For a public-source report, use account-match verification and evidence logging. For a team, protect research notes before sharing screenshots, and use the brand-impersonation workflow when a lookalike makes a misleading claim. A larger collection of profile links is not a substitute for a verified account action or a supportable finding.
Updated October 3, 2026. Worked examples are illustrative; external account flows were not tested on personal accounts.
MyRecon Android is in closed testing for eligible testers. App availability and details.