How to Use OSINT to Research LinkedIn Profiles, Careers and Professional Connections

Learn how to get the most out of LinkedIn as an OSINT resource

Using LinkedIn for Investigative Research

Like many social media OSINT techniques, researching LinkedIn is generally best conducted using an account, as many profiles are only fully accessible once signed in.

For legitimate networking purposes, using an account in your real name is obviously recommended. However, investigators should also understand the operational security implications of using a personally identifiable account when conducting research.

Because of this, many investigators maintain separate research accounts to minimise attribution and avoid alerting subjects to their interest.

Managing Your LinkedIn Footprint

LinkedIn allows users to control the visibility of their profile views. You can choose to appear as:

fully anonymous,
identified only by industry or job type,
or fully identifiable.

To adjust these settings:

Open Settings & Privacy
Select Visibility
Choose Profile Viewing Options

From there, you can select the level of footprint visibility most appropriate for your work.

Investigators should periodically review these settings, as LinkedIn occasionally updates platform settings and privacy controls.

Searching LinkedIn Directly

Once signed in, LinkedIn allows users to search for other account holders and filter results by:

country,
city,
current employer,
previous employer,
industry,
schools and universities,
and other professional criteria.

However, LinkedIn’s internal search functionality can sometimes restrict visibility to profiles within three degrees of your own network connections.

Because of this, investigators often obtain better results using external search engines.

Using Google to Search LinkedIn

One of the most effective techniques for researching LinkedIn profiles is using Google’s site: operator.

For example, if searching for:

Neil SMITH
linked to OSINT,
policing,
and Taunton,

a search might look like:

site:linkedin.com "Neil Smith" Taunton Police OR OSINT

This approach often identifies profiles that may not appear prominently through LinkedIn’s own search interface.

Searching Country-Specific LinkedIn Domains

Investigators can also search country-specific LinkedIn domains.

For example:

site:uk.linkedin.com "Neil Smith" Taunton Police OR OSINT

Similarly:

site:ie.linkedin.com searches Irish LinkedIn results,
site:fr.linkedin.com searches French LinkedIn results.

This can be particularly useful when researching multinational organisations where investigators are only interested in employees linked to a specific country.

Additional pre-set Google searches can be found here:

UK-OSINT LinkedIn Resources

Assessing LinkedIn Profiles

As with any intelligence source, LinkedIn information should always be critically assessed.

When someone creates a LinkedIn account, there is very little verification of the information they provide. Employment history, qualifications, and experience may therefore be exaggerated, inaccurate, or entirely false.

However, there are indicators that may help assess whether an account appears more genuine.

For example, when viewing a profile:

clicking on the account holder’s name next to the profile image will open a new tab that may reveal:
- the year the account was created,
- and whether company email addresses linked to organisations have been verified by LinkedIn.

Whilst not proof of authenticity, these details may provide useful context when assessing the credibility of an account.

Reviewing Contact Information

When viewing an individual’s LinkedIn profile, investigators should also review the Contact Info section.

Depending on what the account holder has chosen to share, this may include:

LinkedIn profile URLs,
company websites,
contact email addresses,
phone numbers,
or occasionally dates of birth.

This information can provide valuable pivot points for wider investigations.

Looking Beyond Current Employment

When reviewing a LinkedIn profile, investigators should avoid focusing solely on a subject’s current role. Historic information can often be equally valuable. For example: schools and universities may indicate the individual’s approximate age or previous locations.

Similarly, previous employment history may help establish timelines, movement between organisations, or links between individuals.

Investigators should also review the subject’s recent account activity, including posts, comments, articles, shared documents, and interactions with others. This may help determine how active the account is, any professional interests, and associations with other people or organisations.

Third-Party Sites Displaying LinkedIn Profiles

The following resource page also contains links to third-party websites that display scraped LinkedIn profile data: UK-OSINT LinkedIn Resources.

Some of these services allow profile searching without needing to sign in to LinkedIn itself. One example is RocketReach. In addition to displaying profile information, some paid services like this may also provide:

linked email addresses,
phone numbers,
and additional contact information associated with profiles.

LinkedIn Alternatives for International Research

When conducting international investigations, investigators may encounter platforms similar to LinkedIn that are more widely used in certain regions.

Bayt - Bayt is widely used across North Africa and the Middle East as a professional networking and recruitment platform. Many profiles can be viewed without signing in, although creating an account generally provides fuller access.

Xing - Xing is a Hamburg-based professional networking platform focused primarily on German-speaking markets, including Germany, Austria, and Switzerland. Most Xing profiles require sign-in before they can be viewed properly.

The UK-OSINT LinkedIn resource page also includes pre-set Google searches for both Bayt and Xing.