---
{
  "title": "Search Open Websites/Domains",
  "summary": "Open-web research gathers publicly available information that can support targeting.",
  "topic": "offensive",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    5
  ],
  "aliases": [
    "T1593"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1593: Search Open Websites/Domains",
      "url": "https://attack.mitre.org/techniques/T1593"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Open-web research gathers publicly available information that can support targeting. The source may be a social profile, forum, publication, or another open site.

MITRE ATT&CK catalogs this behavior as **T1593**, within reconnaissance. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.

## An investigation example

A deceptive message draws on an employee's publicly shared project details to appear credible.

## Evidence to examine

Review available public information and the actual message while avoiding unsupported assumptions about the researcher's identity.

## A common analytical pitfall

A detailed message is not proof that internal systems were breached; public sources may explain its knowledge.

## Response considerations

Verify the requested action independently and use the incident to assess avoidable public exposure without blaming ordinary professional communication.

## Public context can be assembled without internal access

A fictional adversary reads public discussion threads and community pages mentioning a company's software rollout. The resulting terminology can make a later support impersonation seem convincing. This preparation does not require access to the company's network, and accurate technical wording is therefore weak evidence of a legitimate internal sender.

Open sources vary in reliability. A forum post may describe a personal experiment rather than a company deployment. A copied article can omit the original date. A search result snippet can be stale or misleading. Record the original source, timing, and context before using a detail in an assessment.

Organizations cannot remove every public reference to themselves. They can provide publication guidance, avoid unnecessary sensitive disclosure, and ensure consequential workflows verify authority independently. A helpdesk process should not disclose an account recovery secret merely because the caller knows the product names used by the team.

## Separate facts from inferred relationships

For a learning exercise, use fictional public posts about a company and label each as a direct statement, an opinion, or an inferred connection. Add two people using the same software and explain why that does not prove they share an employer or campaign.

If a suspicious message repeats a public phrase, note the similarity without asserting that one source definitively caused the message. Correlate delivery and account evidence for stronger conclusions. Public research is valuable for understanding exposure and context, but ethical study should minimize personal-data collection and stay within authorized purposes. The core analytical habit is to preserve where a claim came from and what it actually supports, rather than treating familiarity as proof of access or identity.

## Related concepts

- [[osint]]
- [[rules-of-engagement]]
- [[threat-intelligence]]
- [[phishing-for-information]]
- [[search-open-technical-databases]]
- [[establish-accounts]]
- [[compromise-accounts]]