> For the complete documentation index, see [llms.txt](https://osint.cavementech.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://osint.cavementech.com/business-osint.md).

# Business OSINT

### Finding Acquisitions

* You’ve profiled one entity under one name.
* But targets run many brands, and parents absorb the companies they acquire.
* Acquisitions = new apex domains = fresh, often forgotten attack surface.
* Here: use corporate-OSINT to find a target’s acquisitions & subsidiaries, then pivot them into live domains. Example — Tesla.

{% embed url="<https://www.crunchbase.com/>" %}
A business-analytics aggregator that tracks acquisitions, funding and sub-organisations
{% endembed %}

{% embed url="<https://en.wikipedia.org/>" %}
the fastest human-readable map of a company’s structure.
{% endembed %}

{% embed url="<https://www.sec.gov/edgar/search/>" %}
free database of US public-company filings
{% endembed %}

SEC EDGAR is the free database of US public-company filings. In every annual 10-K, Exhibit 21.1 — “Subsidiaries of the Registrant” — lists the company’s legal entities and their jurisdictions. This is the most authoritative list of entity names for reverse-WHOIS and registry pivots. Search the company (or CIK), open the newest 10-K, open the EX-21.1 exhibit.

{% embed url="<https://opencorporates.com/>" %}
largest open database of companies, built from official corporate registries worldwide.
{% endembed %}

{% embed url="<https://www.aihitdata.com/>" %}