Passive OSINT, explained: mapping FTSE 100 infrastructure without touching it
Every FTSE 100 company profile on this site — hosting provider, subdomains, mail routing, DNS, domain registration, public GitHub footprint, corporate filings — was built without sending a single request that company didn't already invite by publishing the information itself. That's not a legal disclaimer bolted onto a scanning tool. It's the actual method, and it's worth explaining, because "OSINT" gets used to mean everything from this to unauthorised port scanning, and those are not the same activity with different names.
What "passive" means here, specifically
Certificate Transparency logs. Every public TLS certificate issued by a trusted certificate authority gets logged to a public, append-only ledger — that's been a CA/Browser Forum requirement for years, precisely so certificate issuance is auditable. A company's subdomains show up in CT logs because the company itself requested a certificate for them, not because anyone probed for them. Reading that ledger is reading something the company's own certificate authority already made public.
A bounded, polite crawl of the company's own published pages. The one piece of this pipeline that fetches anything directly is a same-origin crawl of each company's own primary website — robots.txt honoured and treated as fully disallowed if it can't be fetched (not fully allowed — the safer default), rate-limited, capped per company, and reading only page titles and link structure, never body text. It's the same page any visitor's browser would request.
DNS. MX, nameserver, SPF and DMARC records are queried the same way any mail server or DNS resolver on the internet queries them — public records, answered by public resolvers, about how a domain has told the internet to route its own traffic.
RDAP. Domain registration data — registrar, registration date, nameservers — comes from RDAP, the structured registry protocol every domain registry operates specifically to make this information available. It's the direct successor to WHOIS, run by the same registries for the same disclosure purpose.
A routing-registry lookup for hosting. Attributing a website to a hosting provider uses a DNS-based query against a public mirror of the internet's own routing registry data (who announces which IP ranges) — again, a lookup, not a probe of the target's servers.
Bulk government and public-interest datasets. Companies House's own bulk open-data products for company filings and beneficial-ownership (PSC) data — published by the UK government specifically for reuse, under a lawful basis (public transparency of corporate ownership) that a private company reusing it for the same transparency purpose can rely on.
What this deliberately doesn't do
No port scanning. No vulnerability probing. No fetching anything behind authentication, ever. No following a link off a company's own domain into a third-party system to see what's there. No aggregating personal data beyond what a public register (like Companies House PSC) already discloses, and no cross-referencing that register against anything else. The legitimate interests assessment behind this dataset is public, specifically so the boundary isn't just a claim.
The result is a real infrastructure map — see what it actually finds in the cross-portfolio hosting, mail, DNS and registrar rankings and subdomain naming patterns — built entirely from what these companies, their certificate authorities, their registries, and the UK government have already made public. That's the whole method. It's also, not coincidentally, the same boundary a defender should assume any outside party can reach without needing permission.