Introduction to OSINT, Malaysian Edition: HackDev MY on What Is Public, What Is Legal and Why Integrity Comes First

On 1 October 2026 the Malaysian community channel HackDev MY streamed Introduction to OSINT, a sharing session of just over two hours in Malay and English (HackDev MY, 2026). It had two speakers:

• Tunku Irfan, a recent computer-science diploma graduate, gave a beginners' slot on what open-source intelligence is and what it can find.

• Foxy, a cyber threat intelligence (CTI) researcher, talked about how intelligence work is done properly, and why integrity matters more than publishing fast.

This post is paraphrased from the session's Malay auto-generated captions. The timestamps jump to the matching moment.

A note on scope: parts of the session demonstrate how much can be learned about a person from a name, phone number or identity-card number. We summarise those parts as risks to be aware of, not as methods. We do not list which services reveal what.

Part one: what OSINT is

It is research, not hacking. OSINT, open-source intelligence, means gathering and analysing information that is already public: websites, social media, public registries. Social-media intelligence (SOCMINT) is one branch of it (watch from 4:00; 5:00).

Doxxing is the line. Tunku Irfan jokes that OSINT can look like "advanced stalking", then draws a clear line. Publishing someone's address in a comment section to win an argument is doxxing, and it is a crime. Asked again in the Q&A, the answer is the same: doxxing is illegal (watch from 6:00; 48:00).

The uses are ordinary. OSINT is used in threat intelligence and sometimes in penetration testing. Personal uses include checking out a future manager, or a background check before a family decision (watch from 7:00).

The best example is the speaker's own

Researching themself for a diploma project, Tunku Irfan found that their university had left a semester-fee receipt publicly reachable. During the project showcase they showed it to the faculty's deputy dean, and the university removed it within days. The speaker's advice: if you find your own data exposed by your school or university, tell someone there who can fix it (watch from 9:00; 10:00; 11:00).

The techniques, at a glance

The session tours the standard beginner toolkit:

• Search operators ("Google dorking"): restricting a search to a site, a title, a URL or a file type (watch from 14:00). The speaker notes that AI-generated search summaries have changed what these searches return (watch from 22:00).

• Username searches across many platforms at once, with open-source tools such as Sherlock (watch from 27:00).

• Company registries, for business owners (watch from 32:00).

• Reverse image search, raised in the Q&A (watch from 51:00).

• Permanent account IDs. Social platforms keep an internal account ID that does not change when someone changes their username (watch from 35:00).

For the company-registry demonstrations, the speaker says a friend's details were used with that friend's permission.

The uncomfortable part

The most important lesson is not a technique. It is how much a few identifiers unlock in Malaysia:

• Phone numbers lead to names. Contact-lookup apps and some payment screens can show the name behind a number (watch from 11:00; 12:00).

• IC numbers act as keys. Many online services check nothing more than an identity-card number (watch from 40:00). The speaker welcomed MyDigital ID now standing in front of some of those checks (watch from 53:00).

• Cameras are exposed. Searches can surface CCTV cameras whose owners exposed them to the internet. The speaker urges businesses to check their own (watch from 43:00).

• Leak sites exist. The speaker names the lookup site caghi and calls it very dangerous (watch from 39:00). Our report on the two lookup sites covers what happened to those sites.

The fix for the first two belongs to institutions, not users. An identity-card number is not a secret, and should never work as a password.

Before you post. Deleting a post is not enough, because someone may already have downloaded it. Check for anything sensitive before you publish, not after (watch from 33:00).

Part two: integrity comes first

Foxy's half is the more unusual one. It is less about tools and more about the job and its ethics (watch from 54:00; 55:00).

A local starting point. Foxy began by tracking QR-code scams spread around Hari Raya. Victims who scanned them lost their Telegram accounts. The hijacked accounts were then used to message the victims' family and close friends asking for money, so one victim led to the next (watch from 57:00; 1:14:00).

What OSINT does in CTI. Analysts watch public chatter, leak-site claims, newly registered domains and cloned brand pages. They connect posts that might share a campaign, enrich alerts with what else is public, and warn the people who can act (watch from 1:01:00; 1:03:00).

Know when to stop. OSINT is fast, and legal if you stay public. Stop when the next step means logging into a clone site, scanning a scam QR code with your bank app, or naming an actor you cannot defend (watch from 1:04:00; 1:05:00).

Scams repeat. Running campaigns costs money, so operators recycle domains and kits. When one domain goes down, another goes up. Odd file extensions arriving on WhatsApp should be treated as malicious (watch from 1:07:00; 1:08:00).

Don't overclaim. Saying a named bank was hacked when the bank has said nothing can harm others and invite legal trouble. Much real CTI is deliberately general for that reason (watch from 1:17:00).

The unglamorous part. Most of the job is writing "low confidence" and asking for a second pair of eyes, not naming villains. It also means telling apart an actor who runs a campaign from a toolkit sold to many buyers (watch from 1:20:00).

Different readers need different intelligence. Banks and e-wallets want fake QR codes, account takeovers and mule activity. Universities want cloned student portals and scholarship scams. Telcos and government want something else again (watch from 1:24:00).

Reading intelligence in the AI era

Foxy's checklist for any CTI post or blog (watch from 1:25:00; 1:26:00):

• Origin. Who wrote it, and why?

• Primary source. What is it: a post, a domain, a certificate? Is there a screenshot?

• Freshness. Is the claim dated, and is the infrastructure still alive?

• Independent confirmation. Did another person or organisation find the same thing on their own?

• Fact or guess. Are facts separated from guesses? If you removed the adjectives, would any evidence remain?

Two warnings recur. Fluent writing is not evidence. And asking an AI to confirm your own report is not verification, because the model may simply agree with you. Get a human second opinion (watch from 1:00:00; 1:27:00).

The rule worth keeping: if you would not defend a sentence to a sceptical friend, do not post it. Foxy also points out a mistake in their own old write-up: malicious links should be defanged so that nobody clicks them by accident (watch from 1:28:00).

The Q&A that follows is mostly career advice for students: internships, CTF experience, certifications versus projects (watch from 1:41:00). The session ends with a quiz.

Why it matters

The session is a useful corrective to a word that is being misused. One of the lookup sites in our report sold searches of Malaysians' identity numbers and home addresses as an "OSINT platform". By the definitions given here, that is not OSINT. OSINT works with what is genuinely public, stops before access that is not, and publishes only what it can defend.

Three takeaways for everyone else:

1. Search yourself, lawfully. Ask institutions to fix what you find.

2. Assume your IC number is known. Push services to stop treating it as proof of identity.

3. Write as an analyst. If you report on scams or leaks, date your claims, cite your sources and defang your links.

References

HackDev MY. (2026, October 1). Introduction to OSINT [Video]. YouTube. https://www.youtube.com/watch?v=xoArPBmp1VY