---
{
  "title": "Search Victim-Owned Websites",
  "summary": "Research of an organization's own websites uses its published information to build targeting context.",
  "topic": "offensive",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "published": "2026-10-04",
  "units": [
    5
  ],
  "aliases": [
    "T1594"
  ],
  "sources": [
    {
      "title": "MITRE ATT&CK T1594: Search Victim-Owned Websites",
      "url": "https://attack.mitre.org/techniques/T1594"
    }
  ],
  "editorialVersion": 2
}
---

## What it means

Research of an organization's own websites uses its published information to build targeting context. Team pages, documents, and contact patterns can be useful to an adversary.

MITRE ATT&CK catalogs this behavior as **T1594**, within reconnaissance. The technique describes a behavior; assigning the label does not by itself prove an actor identity or successful compromise.

## An investigation example

A phishing message imitates a role and terminology presented on the company's public website.

## Evidence to examine

Compare the message with published information, inspect delivery provenance, and verify claimed authority separately.

## A common analytical pitfall

Accurate corporate wording does not prove an internal sender or prior access.

## Response considerations

Maintain appropriate publication review and protect sensitive workflows through independent identity and approval checks.

## The organization is an authoritative source for some facts

A fictional academy publishes staff roles, course dates, and partner announcements. Those pages can help an adversary choose a timely pretext. They are authoritative for what the academy chose to announce, but not evidence that a later email using the same facts came from the academy. Public accuracy and sender authenticity are separate questions.

Review documents as well as visible pages. Downloadable brochures and older publications may contain contact patterns or organizational details that remain available after a redesign. Publication owners should understand retention and revision needs without assuming every old document is a security incident.

The right response is often process resilience rather than secrecy. A finance change, account recovery, or confidential document request should require authority independent of publicly available company knowledge. Removing a team page cannot repair a workflow that accepts persuasive wording as authorization.

## Map a pretext to its public ingredients

Create a fictional message that references a public course launch and requests a sensitive account change. List which details could have come from the academy's website and which claim requires independent verification. Choose a trusted callback or internal workflow to verify the request rather than using contact details supplied by the suspicious message.

For an investigation, preserve the relevant page version and timing if available. A page updated after the message cannot automatically explain what the sender knew beforehand. Avoid claiming prior compromise solely from correct company terminology. The technique illustrates how ordinary publication can support targeting, while the defensive lesson is to distinguish public context from actual authority and maintain verification controls that remain effective even when an adversary has researched the organization well.

## Related concepts

- [[osint]]
- [[rules-of-engagement]]
- [[threat-intelligence]]
- [[gather-victim-identity-information]]
- [[phishing-for-information]]
- [[search-open-technical-databases]]
- [[establish-accounts]]