Lecture 1: Understanding Proactive Internet Investigation
Justin David Pineda CISSP, CISM
Jun 2026 (rev 2)
Skills Check / Audience Poll
Raise your hand if you have ever:
Learning Objectives
How Much of Our Lives Are Online?
Think about:
Question:
How much information about you already exists online?
Why Internet Investigation Matters
Criminals Have Gone Digital
Today's criminals use:
Traditional Investigation vs
Internet Investigation
Traditional | Internet Investigation |
Physical surveillance | Online monitoring |
Witness interviews | Online intelligence |
Physical evidence | Digital evidence |
Crime scene | Digital environment |
The principles remain the same:
Find facts. Verify facts. Build intelligence.
What is Proactive Investigation?
Investigative activities conducted before a crime occurs or before significant harm occurs.
Goal:
Examples
Proactive vs Reactive Investigation
Proactive | Reactive |
Before incident | After incident |
Prevention | Response |
Intelligence gathering | Evidence gathering |
Threat identification | Incident investigation |
What is Intelligence?
Intelligence Is Not the Same as Evidence
Intelligence:
Evidence:
Discussion
Can intelligence eventually become evidence?
Criminal Activities Commonly Seen Online
Digital Footprints
Everything Leaves Traces
Examples:
People often reveal more than they intend.
Can you remember all the apps and sites you have signed up to since the first time you used the Internet?
Activity 1: Username Tracking
Namechk is a free online tool and OSINT resource that allows users to instantly check the availability of a specific username or domain name across hundreds of social media platforms and website extensions simultaneously.
Website: https://namechk.com/
Reducing Personal Attack Surface | J. Pineda | Jan 2024
14
How to use
How to use
2. Check which sites have an existing account using your email address.
Sources of Online Intelligence
No hacking required.
Understanding OSINT
Open Source Intelligence (OSINT)
The collection and analysis of publicly available information.
Purpose:
OSINT is legal information gathering.
The Investigative Mindset
WHO?
Who is involved?
WHAT?
What activity is occurring?
WHERE?
Where is it happening?
WHEN?
When did it occur?
WHY?
Why is it occurring?
HOW?
How is it being conducted?
Criminal Use of Social Media
Social Media Is a Powerful Intelligence Source
People reveal:
Social Media Indicators
Examples of suspicious indicators:
Criminal Use of Websites
Websites often provide valuable investigative leads.
Infrastructure Behind Online Activities
Examples:
Investigators can often learn from the infrastructure itself.
Activity 2: Website Profiling
Builtwith is an infrastructure profiling tool that reveals the underlying technology stack, server configurations, and third-party integrations used by a website to help investigators identify potential vulnerabilities.
Website to access: builtwith.com
How to use
How to use
2. Enter Website address of target then click Lookup
How to use
3. Explore and Discover: enjoy seeing exactly what software and servers the site is hiding!
Participants Task:
The Target: shopee.ph
Step 1: Access the Website
Participants open builtwith.com.
Step 2: Lookup Target
Type in shopee.ph and hit Lookup.
Step 3: Explore and Enjoy
Activity 3: Website Version Profiling
Wayback Machine is a tool that lets users view archived versions of websites from the past
Website to download: https://web.archive.org
How to use
How to use
2. Type any link and press enter
How to use
3. Press the date of your choice and it will redirect you to the website archive of that time
Participants Task:
Objective:� Explore how websites change over time using archived snapshots.
Participant Tasks:
Open the Website – Go to the Wayback Machine.�Enter a Website URL – Type a website (e.g., a company or school website).�Search Archive – Click Browse History.�Select a Year – Choose an available year from the timeline.�Open a Snapshot – Click a highlighted date to view the archived page.�Compare Content – Observe differences between the past and current website.�Document Findings – Note one major change (e.g., design, content, or features)
Intelligence Cycle
Ethical and Legal Considerations
Collect information:
✔ Lawfully
✔ Ethically
✔ Professionally
Avoid:
✖ Unauthorized access
✖ Hacking
✖ Evidence contamination
Key Takeaways
Proactive Investigation: