• What long-term posting history reveals

• Where to find high-value discussions (beyond just Reddit)

• A clean simple workflow

• …and why rollercoasters capture that one user’s imagination.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Turning Physical Media into an OSINT Archive Powered by AI

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

Reply Guys & Power Users: OSINT on Forums and Online Communities

The reply guy who just has to weigh in on every thread. The power user with 30,000 posts and even more opinions. The Boomer with a sign-off more dated than a digital calendar. The obsessive who’s been answering the same question about rollercoaster lugnuts since 2009 and still isn’t tired of it.

Every forum has them. From a real-life perspective, these people are (mostly) insufferable. From an OSINT perspective? These people are MVPs - the most valuable posters.

Give someone a forum and enough time, and they’ll build a record of everything: phases and bad takes included. That’s what makes forums powerful for OSINT. They track how users evolve when only their friends are watching.

This issue will teach you:

• What long-term posting history reveals

• Where to find high-value discussions (beyond just Reddit)

• A clean simple workflow

• …and why rollercoasters capture that one user’s imagination.

What Makes Forums Useful

Forums actually predate the Internet. Long before modern platforms, people were gathering in digital spaces to talk… and talk… and talk. Discussions are usually organised by topic, making it easy to follow context. Plus, small forum-specific details like join dates, post counts, locations, or signatures really add up.

Still - there’s more:

Long-term User History

What divides a forum from a chatroom? Post length is one thing, as is content being at least semi-public, and that post material is at least temporarily archived. The latter part means forums are built for persistence. Users keep the same account for years and years, and can build up thousands of posts tied to one identity.

For OSINT, you can see not just what somebody says now, but how these views and interests rise, fall and evolve over time. Once they were super into frogs, now they’re super into Alex Jones. Looks like a pipeline.

Unfiltered Personal Discussion

Forums tend to feel smaller and more community-driven than mainstream social platforms. As a result, users are often more direct and less curated in what they say.

It’s common to find users drop their filters as they get more comfortable on a site. Some platforms are more unfiltered than others. You might think this will give you better material, but don’t expect what you find on Kiwifarms or 4chan’s /b/ board to be genuinely useful. Or even make sense.

Beginner Platforms for Forum Surfing

Different platforms attract different types of users; all are annoying in their own special ways. Understanding where certain types gather and certain posts are made is key to finding the richest, most consistent data trails. Try:

Reddit

If you don’t already scroll your free time away here, welcome to Reddit. Large, active, and searchable(ish), Reddit is useful for identifying usernames, interests, and initial posting behaviour. Subreddits act like mini-forums, centred around specific topics or communities. These could be big subreddits for games or TV, like r/BaldursGate3 or r/breakingbad; or really niche stuff like r/mousepadreview, or people who pee in the sink.

Bear in mind: r/ for a community, and u/ for a user.

Niche Forums

These are smaller, topic-specific communities where users post more consistently and in greater depth about their Thing. Hobby, profession, or interest, these are spaces with higher-signal content and long-term engagement.

Comment Sections

Comment sections on blog and news sites are often overlooked, but sometimes valuable. These spaces can contain older, less moderated discussions… with older, less moderated users. Comment section posters can be more flip than usual about identity and information sharing, but certain sites - looking at you, Youtube - are less profitable than others.

A Four-Fold Workflow For Making Forums Work For You

Now say that title at double speed. By the time your Fs don’t falter, you’ll have found the forum post you were foreseeing you might find in the first place.

Give the following a try:

Step 1: Search Username or Topic

Start by identifying the username or discussion topic relevant to your investigation. Use search engines and/or platform search functions to locate where OSINT-useful activity is most likely happening.

Step 2: Track History

Once you’ve found that user, review their full post history. Once you find that post, review all the posts that led up to it. Don’t just skim - look across time and mark recurring themes, preoccupations, and activity patterns.

Step 3: Identify Behavioral Patterns

Look for consistency. Writing style, posting times, interests, interactions with other users. Do they build a clearer picture of the individual behind the account? Do they give context to the comment you were searching for?

Step 4: Profit!!!!

OK - four steps were necessary to pull off several jokes in this section, but this final link in the chain is in fact extremely necessary. Always cross-reference your OSINT findings, to avoid weak leads and mistakes.

Key Insights

People Reuse Usernames

Many forums reward repeated use of the same username, through point systems like Reddit karma or Stack Overflow badges. Even up- or down-vote systems encourage sticking with one profile. For ease or kudos, many users link accounts or carry the same handle across multiple platforms - making an OSINT pivot a breeze.

Oversharing Is Normal

Frequent posters tend to reveal more over time. As a user gets cosy in their home community, they can overshare: opinions, experiences, and sometimes even more personal details that can be pieced together.

Dusty Old Posts

Old forums rarely get cleaned up, and older content is often less guarded. The web of the past was a more innocent place. Before privacy awareness increased, users were more open. As a result, historical posts are especially valuable for investigators.

Thread closed. You’ve survived the forum trenches. You’re now - officially - a forum OSINT power user.

You should know:

• What makes forums unique

• How long-term posting history builds value

• Why the same username will come up again and again

…As for the obsessive: she’s been posting about that rollercoaster since 2009, because that’s the year she married it.

🏁 New CTF Challenge Live - Port Recon

A new CTF challenge has been posted on our CTF website. This week’s challenge involves
identifying the location of a cruise port and uncovering the names of the six cruise ships visible in the provided image. Can you find the port and identify all six ships?

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Final Boarding” where participants were tasked with identifying the airport from a photograph, finding its IATA code, determining the nearest boarding gate, and uncovering the name of a lounge.

Challenge solution WU :

To solve this challenge, participants should begin by performing a reverse image search on the photograph. One of the most distinctive elements is the walkway featuring the Revolut branding. Among the search results, they should find an exact match identifying the location as Leonardo da Vinci–Rome Fiumicino Airport in Italy. For example:

Once the airport has been identified, participants can look up its IATA code, which is FCO.

To determine the nearest gate, careful observation of the image is required. The gate number is not directly visible but can be seen reflected in the glass façade at the front of the photograph. The reflection reveals Gate A64, which is the closest gate to the location where the picture was taken.

Finally, the challenge asks for the name of the lounge located directly in front of the camera. Since the photograph was taken facing the gates, participants can inspect the airport terminal using Google Earth or the official terminal maps. By locating the area around Gate A64, they can identify the lounge opposite the camera as ITA Lounge Piazza Venezia.

Source links:

• https://www.google.fr/maps/place/A%C3%A9roport+L%C3%A9onard-de-Vinci+de+Rome+Fiumicino/@41.7978627,12.2524034,3a,75y,334.53h,90t/data=!3m8!1e1!3m6!1sCIHM0ogKEICAgIDEipqlwQE!2e10!3e11!6shttps:%2F%2Flh3.googleusercontent.com%2Fgpms-cs-s%2FABJJf52j4euLZQ9v2_RMmVkODsI3IyPpBgvlGKQfma1HATaq1QAtVRazhLu9RiMyUjAoHU_NAdi8-wQYD5XG14iPmtpvDRWCfVyE2GAlVjREZW-S_VGDiT7ERiDksawDxsIsVomkQIkMOw%3Dw900-h600-k-no-pi0-ya283.52704207011993-ro0-fo100!7i8704!8i4352!4m14!1m7!3m6!1s0x1325f0793898141f:0xafe513b4e358316f!2sA%C3%A9roport+L%C3%A9onard-de-Vinci+de+Rome+Fiumicino!8m2!3d41.8034632!4d12.2519211!16zL20vMDFreTVy!3m5!1s0x1325f0793898141f:0xafe513b4e358316f!8m2!3d41.8034632!4d12.2519211!16zL20vMDFreTVy?entry=ttu&g_ep=EgoyMDI2MDcwNS4wIKXMDSoASAFQAw%3D%3D

• https://earth.google.com/web/@41.79715746,12.25224872,13.3019093a,1747.35995742d,35y,298.08003297h,0t,0r/data=CgRCAggBQgIIAEoNCP___________wEQAA

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

The episode also covers EyeDex, an open directory search engine that indexes publicly exposed files, archives, and datasets scattered across the internet. Jake breaks down keyword and file-extension searches, directory pivoting, date sorting, and infrastructure discovery, plus the operational security habits every investigator should follow when poking around exposed servers.

Rounding things out, Jake puts you in the boardroom to investigate a company from the ground up: mapping directors, tracing subsidiaries and parent companies, and cross-referencing filings to spot patterns, covering where to find the paper trail and the pivot points that take you from a company to the people and places behind it.

🔒 Highlights from this episode:
📰 AI-powered second brains, ship tracking, and Bellingcat’s ML for civilian harm detection
🔎 New tools for Discord, email crawling, and console investigations
📚 Turning a physical media library into a searchable AI archive with Obsidian and Qwen
🗂️ Searching the internet’s exposed open directories with EyeDex
🏢 Uncovering who really runs a company and where the money flows

Links:

• Issue 111

• Issue 112

• Issue 113

• CTF: https://ctf.osintnewsletter.com/

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ OSINT Tool Tuesday: EyeDex

⚡ You’re Hired: OSINT and Company Intelligence

Let’s get started. ⬇️

OSINT News

📰 How to Build an AI Second Brain With Claude and Obsidian That Gets Smarter Every Day

A guide to connecting Claude to Obsidian so it can read, organize, and remember your notes across sessions, creating an AI-powered personal knowledge base that improves over time.

Read on X…

🎩 H/T: Yarchi

📰 How I Track Ships in the Strait of Hormuz

A beginner-friendly OSINT tutorial walking through how to track and identify ships in the Strait of Hormuz using free tools like MarineTraffic, VesselFinder, Equasis, and Copernicus satellite imagery, starting from a news report about vessel congestion near Bandar Abbas.

Watch on YouTube…

🎩 H/T: Benjamin Strick

📰 How to Use AI to Help Find Civilian Harm

Bellingcat developed a machine learning model to automatically rank Telegram posts by their likelihood of containing civilian harm, dramatically cutting the time researchers spent searching through war reporting content so they could focus on verification instead.

Read on Bellingcat…

🎩 H/T: Miguel Ramalho

OSINT Tools

🔎 DiscordUtils

A series of useful tools you can use in your OSINT investigations to interrogate Discord servers and users.

Web App

🔎 Email Crawl

Extract emails intelligently at scale for your OSINT investigations including validation, username extraction, and more.

GitHub

🎩 H/T: D4rk_Intel

🔎 XResolver

A collection of tools you can use to investigate users or activity on Xbox Live and the PlayStation Network. Some of the tools seem to be down but they open your mind to possible data points that you can collect.

Web App

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Turning Physical Media into an OSINT Archive Powered by AI

• In this issue, I’ll explain a few methods you can turn physical media into an OSINT archive and how you can leverage tools like Obsidian and Qwen to build a powerful engine on top of it.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

🚨 This tool has been added to the OSINT Resources for Open Directories page on The OSINT Newsletter for easy reference later. That list serves as a roadmap for new tutorials in the future. If there are any tools you’d like to see added to the list and covered, please reach out to jake@osint.news with details.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ You’re Hired: OSINT and Company Intelligence

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

EyeDex

EyeDex is an open directory search engine that indexes publicly accessible web directories and allows users to search across petabytes of exposed files hosted on open servers around the world. It acts as a search layer over open directories, making it easier to locate documents, images, videos, archives, datasets, logs, software, and other files that would otherwise be difficult to discover manually.

🎩 H/T: eyedex

EyeDex allows investigators to search using keywords, file names, file extensions, file groups, indexed server paths, and directory structures.

The platform is especially useful for:

• Discovering forgotten or abandoned public data.

• Locating leaked or exposed files.

• Identifying publicly accessible infrastructure.

• Finding archived datasets and documents.

• Pivoting into additional OSINT investigations.

In this guide, I’ll walk you through how EyeDex works, how to search effectively, practical use cases, and additional search techniques to help uncover further results.

Setup

Unlike many OSINT tools, EyeDex does not require installation or API access. It’s entirely web-based, so simply open up the EyeDex Search Interface and you’re good to go. (Command-line beginners can collectively breathe a sigh of relief!)

Understanding Open Directories

Before using EyeDex effectively, it helps to understand what “open directories” actually are.

An open directory is a publicly accessible web server directory listing where indexing or browsing has been enabled accidentally or intentionally. These often expose PDFs, ZIP archives, videos, source code, backups, configuration files, images, logs, and datasets.

In many cases, these directories were never intended to be publicly searchable. EyeDex indexes these locations and makes them searchable from a central interface.

Note: As always, just because a file is publicly accessible doesn’t mean you should download, distribute, or misuse it. Always operate legally and ethically.

Usage

Now that we’ve covered the basics, let’s dive into how to actually use EyeDex during investigations.

Basic Search

The best place to start is by searching for keywords. You could try a company name, username, project codename, email domain or file name to name but a few.

Example: osint

This may uncover exposed PDFs, archived backups, spreadsheets, internal documentation etc.

As you can see, search results typically include file name, server, location, file size, modification group, and file category e.g. ‘video’ or ‘text’.

🗒️ This is the best starting point for broad reconnaissance.

File Extension Searches

One of EyeDex’s most powerful features is searching by file extension e.g. pdf, sql, txt, log, json, csv etc. You can also combine keywords with extensions.

Example: Manual pdf

This is of course a very wide search query but you can see how it pulls up more recent pdf manuals. Using this feature can help narrow investigations toward specific file types.

🗒️ Extremely useful for identifying accidental data exposure.

File Group Filtering

EyeDex allows filtering by file groups/categories including documents, archives, pictures, text and video. This makes it easier to quickly pivot toward the type of content you’re investigating.

Example workflow:

• Search a company name.

• Filter by “Documents”.

• Review exposed PDFs and spreadsheets.

Server Pivoting

One underrated feature of EyeDex is the ability to pivot into entire exposed directory structures. Once you identify a useful result, you can inspect adjacent folders, browse sibling directories, identify naming conventions, and uncover additional hidden files.

This often reveals:

• staging environments

• old backups

• developer files

• forgotten exports

• archived media

🗒️ Many investigations expand significantly through directory pivoting rather than the initial keyword search itself.

Date Sorting

EyeDex allows sorting by date (and time), helping investigators identify recently modified files, fresh uploads, newly exposed data, and active infrastructure.

It may be a simple feature but this is especially useful during breach monitoring, leak investigations, threat intelligence monitoring, and ransomware tracking.

Infrastructure Discovery

Because search results expose server paths and hostnames, EyeDex can also support infrastructure investigations.

Results may reveal subdomains, internal naming conventions, CDN structures, storage buckets, legacy infrastructure, and mirrored servers.

These become valuable pivot points into:

• DNS investigations

• Shodan searches

• Certificate analysis

• Passive DNS

• Attack surface mapping

Use Cases

EyeDex is essentially a public file discovery and exposed infrastructure reconnaissance tool.

A key feature is its ability to support structured exploration of results and build a clearer picture from scattered publicly available information.

So where exactly is this tool useful in OSINT?

Data Exposure Discovery

This is arguably the primary use case as EyeDex can help investigators locate exposed backups, exported databases, internal documents, logs, and misconfigured storage. This can support breach investigations, attack surface monitoring, corporate reconnaissance, and vulnerability research.

Threat Intelligence

Threat researchers can use EyeDex to identify leaked datasets, locate malware samples, discover exposed infrastructure, uncover staging servers, and track threat actor file hosting. Open directories are frequently used for malware hosting, phishing kits, leaked credential storage, and pirated tooling.

Note: Always exercise caution when interacting with downloadable content.

Research & Archiving

EyeDex is also widely used by archivists and researchers looking for old software, datasets, scanned books, historical archives, and niche media collections. The open directory community has long used similar indexing techniques for archival discovery.

Corporate Reconnaissance

Security teams and investigators can use EyeDex to identify exposed internal documents, forgotten staging environments, publicly accessible backups, and leaked configuration files. This makes the tool valuable for red teaming, attack surface management, and external exposure assessments.

Operational Security Considerations

When using open directory search engines:

• Never execute unknown files directly.

• Avoid downloading executables from untrusted sources.

• Use isolated analysis environments/sandboxes.

• Verify hashes when possible.

• Treat exposed files as potentially malicious.

The wider OSINT and open directory community frequently warns about operational security risks associated with random downloads from exposed servers so in big, bold letters, EXERCISE CAUTION.

Additional Tips

Here are a few practical ways investigators improve EyeDex searches:

Search by extension:

pdf

sql

csv

Combine keywords:

company confidential

Search for backups:

backup zip

bak

Search usernames:

jdoe

Search infrastructure terms:

vpn config

Search exposed logs:

access.log

error.log

Search by media type:

Use file group filters to narrow results quickly.

🏁 New CTF Challenge Live - Monaco Suspect

A new CTF challenge has been posted on our CTF website. This week’s challenge involves geolocating the exact location of the Monaco explosion suspect using only a single CCTV image provided as evidence.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Disguised Fuel Convoy” where participants were tasked with locating a blurry video showing Russian occupying forces driving a disguised fuel convoy transporting fuel to Crimea.

Challenge solution WU :

Looking at the video and making regular pauses, we can notice several visual clues.
First of all a crosswalk, if we look closely we can notice the presence of a communication tower and a memorial-style sign.
At the end of the video we can hear the man recording, say that it’s in Kerch (city).

Using overpass turbo and applying filters to search for gas stations near a crosswalk and a communication tower we get a few results.

Comparing all of them with what we see in the video, only one of them matches perfectly when taking a look at sat imagery. The crosswalk is present and matches the video, the memorial-style sign is present too. (45.3397564 / 36.4044172)

Finally the gas station is also present and looking at OpenStreetMap in overpass turbo we can see that the name of the gas station is ATAN, and that the name of the nearest bus station is Дачи.

Overpass Turbo Query:

[out:json][timeout:180];

// Kerch (Kertch)
{{geocodeArea:Kerch}}->.a;

// stations essence
nwr“amenity”=”fuel”->.fuel;

// passages piétons proches des stations
node”highway”=”crossing”->.cross;

// antennes proches des stations
(
node”man_made”=”tower”;
node”tower:type”=”communication”;
)->.ant;

// sortie
(
.fuel;
.cross;
.ant;
);

out center;

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

• What you can uncover from company data

• Where to dig (without finding trouble)

• A clean investigative workflow

• …and how to win, bigly.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Using Generative AI for Sock Puppet Creation and Identification

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

You’re Hired: OSINT and Company Intelligence

Welcome to the boardroom - but you’re not here for the pitch.

You’re going to be playing (if you’re British) Sir Alan Sugar, or (if you’re American) He Who Will Not Be Named. That’s because we’re talking about the business end of OSINT. For this week’s task, you’ll be doing open-source company intelligence.

Lucky for you, you’re not here to judge questionable branding, nonsensical messaging or claims that your new apprentice “tastes success in his spit when he wakes up.” You’re here to find out: Who actually runs this thing? Where does the money flow? What’s going on behind the scenes that the owner would rather keep hidden?

Get it right, and you’ll be raking in the data. Get it wrong, and your investigation will feel a bit like an episode of The Apprentice after all - where you’re the one getting fired.

This issue will teach you:

• What you can uncover from company data

• Where to dig (without finding trouble)

• A clean investigative workflow

• …and how to win, bigly.

What Can a Company Reveal?

Let’s stick to talking about The Apprentice. Think of a company like a task team. It’s one unit on the surface, but underneath, there’s power dynamics, complicated relationships and a whole lot of questionable decisions.

Company Structure

Who’s officially in charge? Companies might claim that it’s one party, but only the OSINT tells the whole truth. Directors, shareholders and incorporation data are your friends.

Leadership Teams

The names listed in filings are real people with histories, often across multiple companies. And some of them are about to look very busy. If somebody’s listed across a vast number of companies, or where they shouldn’t be, you might have your hands on gold dust.

Corporate Relationships

There are many types of companies, and many ways they can connect. Sometimes the ‘company’ you’re looking for is a fragment of something bigger. Some companies turn out to be subsidiaries or shell layers, turning your investigation on its head.

Company OSINT Tools That Actually Work

There aren’t really ‘tools’ in the traditional sense - more like places to look. Still, anything’s a tool if it’s useful enough.

Company Registries

Start with official filings (e.g. Companies House in the UK, SEC filings in the US, or equivalent national registries). Here’s where to find director lists, registered addresses and filing histories.

Financial & Aggregation Sites

Platforms like OpenCorporates and Sayari pull together records across jurisdictions to help you zoom out. Useful when companies start hopping countries or operating through multiple entities. Ask: Who owns what, across borders? Who keeps showing up? Why would they move this way?

Corporate Websites

Yes, really. Of course they’re curated, but “About Us” pages, leadership bios, press releases etcetera are still useful. Especially for confirming roles and timelines against official filings.

A Clean Workflow for Running Your Investigation Like a Winning Task

Time to get structured. It’s your job (pun intended) to investigate a company. Let’s follow an OSINT workflow from beginning to end.

1. Identify Official Registration

Looking for a company? Lock in the legal entity first. You need an exact name (even if it’s not the one you thought), registration number, and jurisdiction. Get these wrong and you’ll be investigating the wrong ‘company’ altogether. Remember Four Seasons Total Landscaping?

2. Map Leadership Roles

On The Apprentice, everyone says they’re a “born leader.” Let’s find out who’s actually in charge. Pull every listed director and office, then start connecting them. Who appears across multiple companies? Who’s moving between roles? What does this suggest in terms of your investigation?

3. Find Subsidiaries or Parent Companies

Trace ownership up and down, as well as side to side. Investigating vertically as well as horizontally can show the loudest brand isn’t always the one with control. Unexpected shell, parent or subsidiary activity is a relatively common find with bigger corps at this stage.

4. Cross-Reference Filings

Compare everything. Names, addresses, timelines, jurisdictions, employee handsomeness.. If multiple entities share the same details, you’ve got a pattern — and hopefully a breakthrough. Visualisation tools like Maltego can really help here

Common Pivot Points

Company → People

Who’s the boss? Directors make great pivots. LinkedIn profiles and previous ventures are great ways to take the investigation personally.

Company → Addresses

Where are they? Shared offices can link entire clusters of companies. Especially useful for spotting shell setups or service-provider hubs.

Company → Partner Organisations

Who are they working with? Suppliers, parent firms or collaborators can expand your map fast.

Final Boardroom Discussions

Your team just won that one. You’re the boss of company OSINT.

Now you should know:

• What you can uncover from company data

• Why you should start with the precise legal entity

• How directors are your bridge to people

• Clear ways to get to the good stuff

If you’ve checked the filings, mapped the players, followed the structure, and tested the story against what’s actually recorded, you’ll get exactly what you need. Here’s to investigations that smell like Success.

Here’s what you’ve been waiting to hear: You’re hired.

See you next week, investigators!

🏁 New CTF Challenge Live - Disguised Fuel Convoy

A new CTF challenge has been posted on our CTF website. This week’s challenge involves identifying a location from a low quality Telegram video and using visual clues to determine the nearby gas station name.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Red Notice” where participants were tasked with investigating the company details of a financial actor who is wanted by INTERPOL under a Red Notice.

Challenge Solution WU :

Searching for the full name, we get a result from pappers.fr. Looking at the public records, we can see the date of registration of the first company that was first is still active until this day, just under that we also find the company name.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

This episode, Jake Creps walks through why public records and government databases deserve more respect than they get, then turns to how generative AI is reshaping the sock puppet game, both for building them and for spotting them.

Highlights:

📁 The Case for Boring OSINT - Why property records, court filings, business registrations, and licensing databases are some of the most reliable anchors in an investigation, and a simple three-step workflow (jurisdiction, search, cross-reference) for getting the most out of them.

🏁 CTF Corner - A look back at “The Scammer” challenge, tracing a phone number’s country and carrier, plus a preview of the newest live challenge: geolocating an intercepted image.

🤖 AI-Generated Sock Puppets - An update on how generative AI has changed sock puppet creation and detection since Jake’s original guide, covering the two paths to building a persona, why degraded image quality can now work in your favor, and how to keep a fabricated identity’s “voice” consistent over time (🔒 paid subscribers).

🕵️ OSINT Tools Roundup - Three new tools from this issue: a threat actor username checker with a clean true/false API, a Venmo OSINT tool for public profile and transaction lookups, and a 2-in-1 username/email scanner covering 240+ platforms.

If you’ve ever rolled your eyes at a government database, this one’s for you, right up until it isn’t.

Links:

• Issue 109: https://osintnewsletter.com/p/109

• Issue 110: https://osintnewsletter.com/p/110

• CTF: https://ctf.osintnewsletter.com/

🚨 It’s becoming increasingly difficult to find OSINT News that isn’t completely AI generated. I’m okay with AI generated summaries or blurbs but entire articles written by AI are trash. I’m unsure if the OSINT News section will persist; it may be reduced to 2 topics instead of 3. Thank you to the writers who remain authentic and produce original content.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Why Boring is Better: OSINT on Public Records & Government Databases

Let’s get started. ⬇️

OSINT News

📰 OSINT Field Notes #9: Nothing Was Really Hidden

The newsletter shows how OSINT researchers use public data and metadata to uncover hidden information tied to conflict, propaganda, and surveillance.

🎩 H/T: Benjamin Strick

Read on OSINT Field Notes…

📰 Heading Off: New Technique Helps Track Grain Smuggling Expansion to Libya

The investigation uses OSINT, satellite imagery, and AIS data to track a suspected Russian ship moving stolen Ukrainian grain from Crimea to Libya, revealing sanctions evasion despite GPS spoofing.

🎩 H/T: Bellingcat Investigation Team

Read on Bellingcat…

OSINT Tools

🔎 Threat Actor Username Search

This tool allows you to check if a username is associated with a threat actor. It’s not a username search, like you’re used to with Sherlock, it’s a true/false result. They also have an API. I love this idea.

Web App

🎩 H/T: CTI Updates

🔎 Venmo OSINT Tool

Venmo OSINT is a tool for searching public Venmo profiles and transactions, with lookup, search, and export features.

GitHub

🎩 H/T: Dennis Keefe

🔎 User Scanner

A 2-in-1 OSINT tool for email and username intelligence that scans 240+ platforms to map digital footprints, check account registrations, extract profile data, and export results, with bulk scanning, proxy rotation, and breach intelligence integration.

GitHub

🎩 H/T: kaifcodec

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Using Generative AI for Sock Puppet Creation and Identification

• Generative AI has come a long way when it comes to making photo-realistic content. In this issue, I’ll show you some methods you can use to create sock puppet accounts that appear more legitimate, giving you more options in your investigations; alternatively, it’ll give you the tools to identify sock puppet accounts created using similar methods.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

• Which data is easiest to find this way

• Why jurisdictions matter if you want to stay on track

• How the right workflow can make any OSINT fun

• …and why real life isn’t the X-Files.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Codifying Open Source Intelligence Methodology with AI

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

Why Boring is Better: OSINT on Public Records & Government Databases

Public records have a reputation problem. Namely, they’re boring.

A government database doesn’t have the fast-moving, high-noise chaos factor of social media. No avatars, hot takes, or late night posting sprees about that jerk Stephen Colbert. Instead, you’re working with PDFs, registries and forms that look like they were last accessed in 2002. It’s enough to bore an investigator to sleep.

Sure, this isn’t OSINT that screams “start here” - but that’s precisely the point. Public records are unchanging and largely unnoticed, and that makes them some of the most reliable anchors out there. You can spend hours chasing a username that leads nowhere, or watch an account or post vanish mid-investigation when OP decides it’s too cringe to bear. But once a public record’s recorded, it sticks, and it won’t have moved in years - no matter how toe-curling.

Sometimes, with OSINT, boring is better.

This issue will cover:

• What you can get from public records and government databases

• Where to start without getting lost in endless registries

• A fun, repeatable OSINT workflow for even the dullest investigations

• …and why Trump’s tweets are actually relevant here.

Just resting your eyes, right? Let’s get started.

What Counts as a Public Record?

Think less X-Files, more just… Files.

Put simply: public records are any documents created, filed, or maintained by government bodies as part of official processes. They’re usually verifiable, real-world data that maps activity in the real world, such as:

Property Records

The least exciting documents that answer the most useful question: where someone actually lives (or lived). Property records show the ownership of a house, land or business, alongside purchase history, co-owners, and addresses.

Court Records

If something serious went down, it probably ended up here. Court records cover disputes, and charges, adding the context, timelines, and connections you definitely won’t find on someone’s carefully curated online presence. In Florida, for example, arrests are a matter of public record under specific rules - blessing the world with Florida Man.

Business Registrations

Follow the companies, find the employees (or bosses). Business records list directors, shareholders, and addresses for premises. They’re perfect for mapping who’s connected to what - especially for financial investigations, or if you’re looking to verify the wild claims on a subject’s LinkedIn.

Licensing Databases

Speaking of verification, these can prove if someone is (or isn’t) what they claim to be. Licensing records cut through inflated bios with something much less exciting: the truth.

Depending on the jurisdiction, they can confirm occupations, qualifications, certifications, and sometimes disciplinary actions in sectors like healthcare, law, construction, or transport.

Beginner Tools for Digging Government Dirt

Don’t try to play The Lone Gunmen straight off the bat. Start simple, with official sources.

The beginner-friendly following will get you direct access to structured, government-held data for OSINT investigations that get results. No Mulder and Scully shenanigans required.

Government Open-Data Portals

Pros: Great for quick wins without advanced tooling.

Cons: Easy to get lost.

The official hubs of “we’ll just leave this here”. Governments publish datasets on everything. Property, crime, spending, infrastructure - they all get dumped here in searchable, downloadable, and surprisingly underused form.

County/State Record Search Tools

Pros: Solid and often the fastest way to anchor an investigation in reality.

Cons: Interfaces from hell.

If this type of OSINT could get any less glamorous, it just did. On a local level, registries for property, courts, or business filings usually let you search by name, address, or company. Interfaces can be clunky (and ugly as sin), but the data can be beautiful.

A Boredom-Busting Investigation Workflow

Let’s demonstrate why OSINT looks good in beige. Follow these steps for a high hit-rate:

1. Identify the Jurisdiction

   Start by figuring out where the records you need live. Rules governing database access can vary quite randomly by country, state, or even county. Get the jurisdiction wrong and you’ll either get locked out, or waste time combing through the wrong (potentially frustrating) system. Get it right and your search becomes far faster, and far less painful.

2. Search

   Once you’ve got the jurisdiction, search. Search names, companies, or addresses directly in official databases. Search, search, search. Don’t overthink it. It’s that easy.

3. Cross-Reference

   One record is a clue, but four that match is a jackpot. Always cross-check names, addresses, dates, and associates across different databases to validate what you’re seeing; this is important, real-world data, so mistakes can cost you big.

That’s it. You should have found what you’re looking for… and you’re still awake!

What You Can Learn From Public Record OSINT

Public records can help you find the following:

Ownership Ties

If you find out who owns what, and who they own it with, you can identify a subject’s partners in both business and life. It’s common to discover hidden relationships like family ties that aren’t visible elsewhere online through ownership records.

Business Relationships

Company filings can help trace networks of influence. Look for repeat partnerships, for example, or the same names in operation across multiple businesses. Structures are the thing to look for here.

Legal History

If there’s disputes, criminal charges, civil cases, financial issues… These can act as great behavioural context, showing patterns over time that help to strengthen your overall investigation.

Key Takeaways

See? Public records and government databases aren’t that painful. Sure, it’s all very static. This OSINT just sits still, being true. While everything else moves (and generates the excitement that comes with it), records don’t - but that’s exactly why they’re priceless.

You should now know:

• Which data is easiest to find this way

• Why jurisdictions matter if you want to stay on track

• How the right workflow can make any OSINT fun

• …and why real life isn’t the X-Files.

Still wondering why Trump’s tweets were relevant in this article? The answer: they’re a matter of public record. The US National Archives has all of them on a database, free to browse. Yes, all of them. Even covfefe. What OSINT value one could gain from an AI President dancing with the Cracker Barrel Man is unclear, but it’s there.

Maybe we need Mulder and Scully on it after all.

🏁 New CTF Challenge Live - Secret Meeting

A new CTF challenge has been posted on our CTF website. This week’s challenge involves geolocating an image that has been intercepted by a counter intelligence agency.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “The Scammer” where participants were tasked with conducting an investigation on a phone number linked to a suspected scammer, in order to find the country and the phone operator associated to it.

Searching for the country code +91, we can see that it belongs to India.
Using https://www.emobiletracker.com/trace-process.php, we can see that the operator is Reliance Jio.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Tools, tactics, and fresh investigations expanding the open-source intelligence toolkit.

Some of the best OSINT pivots start with the things people forget about. A phone number that has quietly followed someone across a decade of accounts. A methodology buried in a blog post that could be running in the background of every future investigation.

This episode covers Issues 107 and 108 of The OSINT Newsletter and explores two sides of how modern investigators get more out of what they already have: squeezing real intelligence out of the most overlooked data point in the toolkit, and turning the methodology in your head (and other people’s heads) into something an AI agent can run on your behalf.

In Episode 19 of The OSINT Podcast, host Jake Creps starts with Issue 107 and one of the most underrated data points in the toolkit: the phone number. He walks through what intelligence actually comes from a number, where to check first without overcomplicating it, and a clean five-step workflow from standardising the format through to pivoting outward into the wider account network. He covers the platforms worth checking (WhatsApp, Telegram, Signal, Truecaller, Sync.ME), the carrier and HLR lookups that ground a number geographically, and the high-value pivots, usernames, social accounts, and breach data, that turn a single number into a network. He closes with how to handle disposable numbers and burner tactics, where the absence of data is itself a signal.

Highlights include:

📞 What a Phone Number Actually Tells You – geographic origin, platform presence, and identity fragments hiding in plain sight.

🧭 The Five-Step Workflow – from standardising the format to pivoting outward, a clean methodology for running phone number OSINT without skipping steps.

🔥 Burner Logic – why disposable numbers are not a dead end, and how patterns of behaviour and gaps in data become signals in their own right.

🤖 Codifying Methodology – discovering methods worth codifying with a Google Dork, turning them into local markdown, and chaining skills together into a continuous discovery engine.

🔗 A Worked Investigation – running /username through Sherlock, pivoting into /person-search on nxthacker99, and producing a full subject profile assessment with named intelligence gaps.

Whether the investigation starts with a single phone number or a methodology lifted from someone else’s blog post, Episode 19 is about getting more out of the OSINT you already have in front of you.

References

• OSINT Newsletter – Issue 107

• OSINT Newsletter – Issue 108

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Call Data: OSINT on Phone Numbers

Let’s get started. ⬇️

OSINT News

📰 How To Investigate A Person Of Interest In 2026

An advanced guide on person search built for the year 2026. It includes tools, tactics, and techniques using available methodology. You can use this guide to build a Claude skill and augment it with your own methods.

Read on Medium…

🎩 H/T: Precious Vincent

📰 Inside Modern OSINT: Detecting Disinformation, Tools of the Trade, and the Ethics That Shape It

An OSINT guide on tracking coordinated disinformation through timing patterns, account behavior, and cross-platform signals, using verification tools like image search, geolocation, and archives, while considering privacy risks and ethical challenges in open-source investigation.

Read on Impact Grid…

🎩 H/T: Zoya Baig

📰 Signals in the Noise: Open Source Intelligence (OSINT) for AI Loss of Control Detection

An advanced OSINT/CTI framework for detecting AI loss of control. It maps threat models, observable traces like user transcripts and inference choke points, plus monitoring techniques using available methodology.

Read the paper…

OSINT Tools

🔎 OpenOSINT

OpenOSINT is an open-source OSINT framework for collecting, organizing, and analyzing publicly available data to support investigations, combining automation tools and modular workflows for reconnaissance, data gathering, and information analysis.

GitHub

🎩 H/T: Tommaso Bertocchi

🔎 Open Graph Intel (OGI)

OGI is an OSINT-focused tool for visualizing and analyzing connections in data, helping map relationships between entities, sources, and signals to support investigative workflows and structured analysis of information networks.

Web App

🎩 H/T: khashashin

🔎 Anthropic Courses

Anthropic’s learning hub is a training platform providing structured courses on using Claude, AI workflows, and developer topics, with lessons, quizzes, progress tracking, and certificates for completion.

Anthropic Academy

🏁 New CTF Challenge Live - The Scammer

A new CTF challenge has been posted on our CTF website. This week’s challenge involves

conducting an investigation on a phone number linked to a suspected scammer.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Last Order” where participants were tasked with finding a restaurant’s location, and the dish that a suspect had ordered.

Challenge Solution WU :

Using a reverse image search on the provided cctv image, we find a match showing a restaurant called Amor Gastronomia in London on TheFork.

By checking the restaurant’s official website, the address is listed in the footer as Halloway Road 139.

Finally, reviewing the restaurant’s London menu, the most expensive signature pasta dish appears to be TAGLIOLINI AL TARTUFO.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Codifying Open Source Intelligence Methodology with AI

• There are dozens if not hundreds of methods for open source intelligence collection, analysis, and dissemination. Everyone has a different process, too. In this issue, I’m going to show you how you can create a repository of methodology that you can use to instruct your AI of choice to automate.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year. I’ll start with How To Investigate A Person Of Interest In 2026 from the OSINT news section.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

• What intelligence comes from a phone number

• Where to check first (without overcomplicating it)

• A clean workflow for investigations

• …and why it’s not worth changing your name to Spiderman.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Creating Claude Skills for Open Source Intelligence

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

Call Data: OSINT on Phone Numbers

Phone numbers sit in a strange place in OSINT. They’re near-ubiquitous and tied to everything, but as a result very easy to overlook. Unlike usernames (which can change) or email addresses (easy to create), numbers tend to stick. They follow people across platforms, accounts, years of activity, and even States. Surprisingly few people want the hassle of learning a new number, even when they get a new phone.

You might create a new Gmail, and change your username (or legal name) to Baron Venom Balrog Sabretooth Vader Megatron Vegeta Robotnik Magneto Bison Sephiroth Lex Luthor Skeletor Joker Grind, but your phone number is mostly static. This persistence makes phone numbers one of the most reliable anchors you can work with for OSINT.

Sometimes OSINT is just a number. This issue will teach you:

• What intelligence comes from a phone number

• Where to check first (without overcomplicating it)

• A clean workflow for investigations

• …and why it’s not worth changing your name to Spiderman.

Calling Baron Grind…

What Can Phone Number OSINT Uncover?

The infrastructure of phone numbers is key to what you can get out of them through OSINT. Every number is tied to a telecom system, to a region, and only then to a web of online accounts. That means even before you get into deeper online OSINT, there are three immediate layers of value:

Geographic Origin

Country codes (+1, +44, +91, etc.) are GeoINT in themselves. These one or two nifty numbers instantly place a phone’s owner at a national level. If you can find out carrier data, you can narrow a rough operating region even further. At the very least, you can find out if your target’s in the US or Uzbekistan.

Platform Presence

Many platforms use phone numbers as their backbone identifier. If a number is registered on apps like WhatsApp or Telegram, you may be able to view profile photos, usernames, or activity signals just by knowing the right digits.

Identity Fragments

Even before the real OSINT starts, people litter the world with identity fragments - by reusing their static phone number. Old listings, forgotten profiles, or scraped datasets can quietly connect multiple pieces together.

Some Phone OSINT Tools That Actually Work

You don’t need a complex stack to begin phone OSINT. That’s what makes phone numbers such a universally popular data point. In fact, the most effective tools and methods are often at your fingertips.

Caller ID Platforms

Sync.ME, NumLookup, and That’s Them scan public records and user-contributed data, drawing on that to see if a number’s been identified before. Results can be inconsistent, so treat them as leads not gospel. If multiple sources align, then they’re worth your attention.

Checking the Apps

Here’s an old OSINT trick. Save the number as a contact, then check WhatsApp, Telegram, or Signal. Adding a contact will reveal a profile photo and status - Telegram will even expose a username.

Caller ID Platforms

Truecaller, Hiya, and CallApp use crowdsourced data, so again, cross-reference. Patterns across multiple platforms mean something.

Finding Carrier Data

If you know nothing about the carrier, services like Numverify, Twilio Lookup, or other free HLR lookup tools can help identify the telecom provider and line type (mobile, VoIP, or landline). Cross-check as always.

Getting Started: A Clean Workflow (Don’t Skip Steps)

Investigating a number… That’s easy, right? Think you can improvise? Don’t. A structured approach will always get better results.

Give this workflow a try:

1. Standardize the Format

Always convert to international format. Tools and platforms require international format numbers and inconsistencies will cost you results. What’s more, country codes aren’t data you want to ignore.

2. Location, Location, Location

Use that country code. Combine with any carrier info to ground your investigation geographically; when you’re stratifying your findings later, you’ll be glad you did.

3. Check for Live Accounts

Run the number through message platforms. You’re looking for anything visible on Telegram or WhatsApp: images, usernames, timestamps etc.

4. Look for Repetition

Search the number directly. Then try variations, like with or without spaces. Reuse is what you’re hunting for.

5. Pivot and Expand

Got a hit? Pivot outward. Search that identifier (a username, profile, email or listing). Start building out the wider account network.

…And just like that, you’re doing phone number OSINT.

What Counts As a High-Value Pivot?

You might be wondering which leads are strong enough to take that fifth step. The real value comes from the following data points:

→ Usernames
If you see the same username twice, that’s your bridge into wider platform analysis; especially if the username is conspicuously unusual or unique. There’s unlikely to be two people choosing Baron_V_B_S_V_M_V_R_M_B… (You get the picture).

→ Social Accounts
If a number was required to sign up, some platforms expose profiles directly. Others reveal connections indirectly. Either way, a linked social account is OSINT gold.

→ Breach Data
If the number appears in leaked datasets or on HaveIBeenPwned, it can link to emails, credentials, and historic activity. As always, be careful working with data that comes from an inherently sketchy source.

Feel the Burn: Disposable Numbers & Evasion Tactics

OSINT investigators chasing fraud, spam networks, or illicit activity face up to a unique challenge. Phone number stability is usually the USP here. What if the number you’re looking for is temporary by design?

Burner phone numbers get spun up quickly, used briefly, and abandoned just as fast. The aim is to get a phone number, get what you need from it, and THROW IT ON THE GROUND. The point of virtual numbers, VoIP services, and burner SIMs is to create numbers and accounts without tying them to a long-term, real identity - the very thing that makes phone number OSINT so easy.

So, change of tactics. Look for patterns of behaviour, not long-term reuse. VoIP numbers, for example, might cluster around specific services or regions, or repeatedly appear attached to similar types of accounts or listings. That would signal the same person, exhibiting the same behavior over and over again.

Gaps are a biggie too: no reverse lookup data, no caller ID history, and limited presence across platforms are absences that constitute a signal in themselves.

If a number looks “empty”, don’t assume it’s useless. It may just be designed that way.

Key Takeaways

Phone number OSINT works because numbers are mostly static and stable things. You can change your email, your socials, or even your name, but most people are lazy with their phones. And unlike physical addresses or Social Security numbers, people hand out their phone numbers like candy.

You should know:

• One number won’t tell you everything, but it might tell you where to look next

• Use simple methods before complex ones

• Follow number reuse and patterns

• Build outward: number → account → network

…and when you change your name to Emperor Spiderman Gandalf Wolverine Skywalker Optimus Prime Goku Sonic Xavier Ryu Cloud Superman HeMan Batman Thrash in witness protection, maybe change your number.

Until next time, investigators!

🏁 New CTF Challenge Live - Last Order

A new CTF challenge has been posted on our CTF website. This week’s challenge involves analyzing surveillance footage from a blurred traffic camera frame to identify a suspect’s location. Investigators believe the suspect entered a highly rated restaurant, ordered its most expensive signature pasta dish, and left in a hurry. Your task is to determine the restaurant, its exact address, and the specific pasta dish ordered.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “The Dark Web Hacker” where participants were tasked with finding a hacker’s specific email address linked to a specific hacking forum.

Challenge Solution WU :

Knowing that the username had been reused across multiple forums and appeared in several data breaches, we searched for the username “sarkstic” on breach.vip. This led us to a World of Warcraft forum account on OwnedCore, along with the email address associated with it: dreadfuleyes@yahoo.com

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

This episode covers Issues 105 and 106 of The OSINT Newsletter and explores two very different sides of modern investigations: going deeper into the Dark Web for intelligence, and using AI to automate the repeatable parts of your workflow.

In Episode 18 of The OSINT Podcast, host Jake Creps picks up where Part One left off and takes investigators further into Dark Web intelligence - or DARKINT. He recaps the layered structure of the surface, deep, and dark web, then digs into the beginner toolkit: onion browsers, hidden services, public leak indexes, and onion search engines. Jake walks through a practical methodology for tracing identifiers - emails, usernames, and phone numbers - from breach data on the Dark Web back up to the surface, and explains how to correlate and validate findings without falling for false positives.

He also pulls no punches on the limitations. DARKINT is an adversarial, high-risk environment full of manipulated datasets, unverifiable attribution, and content that can stay with an investigator long after the browser is closed. The episode covers the compliance considerations of handling breached data and the psychological risks of working in this space - and why both deserve serious thought before diving in.

From there, the episode shifts to something brand new: building Claude Skills for OSINT. Jake explains what Claude Skills are - reusable, plain-language instruction sets that turn AI into a reliable part of your investigative workflow - and walks step-by-step through creating one for username search. No code required. He covers picking the right workflow to automate, writing the skill itself, testing it inside Claude Code with Sherlock, and refining it with simple natural-language tweaks.

The episode closes with a look at how to supercharge an OSINT skill: instructing Claude to pivot on its own findings, find new tools when collection hits a wall, and fall back to manual methods when scripts fail. It is a glimpse of what investigative automation actually looks like when AI stops being a novelty and starts doing real work alongside the analyst.

Highlights include:

🧅 DARKINT Toolkit – onion browsers, hidden services, leak indexes, and onion search engines explained for beginners curious about web spelunking.

🔗 Surface-Bound Pivots – a step-by-step methodology for tracing emails, usernames, and phone numbers from breach data back to the surface web.

⚠️ The Monsters Under The Bed – the real limitations of DARKINT, from manipulated datasets and unverifiable attribution to the psychological toll of the work.

🤖 Building Claude Skills – how to turn a repeatable OSINT workflow into a reusable Claude Skill, with a full walkthrough of automating a username search using Sherlock.

🚀 Supercharging Automation – instructing Claude to pivot on its findings, hunt for new tools, and fall back to manual methods when scripts come up short.

Whether the data is hiding in the dark or waiting to be unlocked by the right set of instructions, Episode 18 shows how modern investigators are reaching both.

References

• OSINT Newsletter – Issue 105

• OSINT Newsletter – Issue 106

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ OSINT and the Dark Web: Part Two

Let’s get started. ⬇️

OSINT News

📰 What happens when agentic AI meets intelligence analysis?

Agentic AI, Maltego MCP servers, conflict monitoring, and self-hosted intel platforms are opening up new possibilities for OSINT, but the tools only matter if the analyst knows how to turn information into intelligence.

🎩 H/T: Aaron Roberts

Read on LinkedIn…

📰 Vibe Coding Is Becoming an OSINT Risk

AI is making it easier to build and adopt OSINT tools, but the real risk starts when investigators trust software they do not fully understand to shape analysis, workflows, and operational decisions.

Read on DutchOSINTGuy…

🎩 H/T: Niko Dekens

📰 Turn Off ChatGPT’s New Ad Tracking

ChatGPT’s free tier is now opt-in to ad tracking and data sharing by default, linking user activity to marketing systems unless you actively turn it off in settings.

Read on Tate’s Online Safety Community…

🎩 H/T: Tate Jarrow

OSINT Tools

🔎 BamQam

A new OSINT-style dashboard that aggregates live geopolitical and military data into a map-based intelligence feed, with unclear provenance and trust level.

Web App

🔎 DrishX

A satellite-powered freight intelligence tool that uses open-source orbital imagery to detect and analyze logistics movement patterns like vehicle flow for OSINT-style monitoring and trend analysis.

GitHub

🎩 H/T: Sairaj Balaji

🔎 claude-osint

An OSINT automation framework built on Claude that structures investigative workflows for research and intelligence tasks.

GitHub

🎩 H/T: Sachin Sharma

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Creating Claude Skills for Open Source Intelligence

• Claude Skills allow you to automate a significant portion of your workflow using very specific instructions. In this issue, I’m going to show you how you can fully automate a username search, including pivoting to additional methods based on findings, all with a single request from Claude.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

• The tools you need to know

• Strategies and limitations

• Following data to the surface

• …and how to fight the monsters under the Internet’s bed.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Gathering OSINT from Live Traffic: Datasets and Cameras

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

OSINT and the Dark Web: Part Two

Welcome (back) to the dark side. We have OSINT.

Although it looks dangerous, DARKInt it’s perfectly safe if you know how - and if you read last week’s issue, you probably do. Without further introduction, let’s go even deeper into Dark Web OSINT.

In Part Two, we’ll cover:

• The tools you need to know

• Strategies and limitations

• Following data to the surface

• …and how to fight the monsters under the Internet’s bed.

Don’t forget your flashlight.

Recap: What is the Dark Web?

If the internet is an iceberg, it has three layers: the surface, deep, and dark web.

• Surface Web: The normie ”internet”. Indexed by search engines like Google and Bing.

• Deep Web: The “invisible” 90% of the web you don’t need a specific tool to access. Online banking, private networks, and corporate systems live here.

• Dark Web: The unindexed 1-6% of the web, only accessible via specialised tools. Always anonymised, always encrypted.

What you find in this dark bottom layer - open-source or not - is dark web intelligence. So, think of Dark Web intelligence (or DARKINT) as OSINT’s emo little brother. Got it? Good.

A Beginner’s Guide to DARKInt Tools

To access the Dark Web, specific tools are required. Here’s a conceptual run-down of the best tools for beginners curious about traversing the depths. Of course, this overview is intended for educational purposes only, rather than encouraging active exploration as soon as possible - it’s best to think before you leap.

Browsers Are Like Onions

TOR is the most (in)famous of the bunch. Short for The Onion Router, TOR is too complex to unpack fully here. What’s more, we already did that last week.

Basically, onion browsers work by routing your connection through multiple encrypted layers - a bit like an onion - so no single point can trace your activity. The Dark Web’s sites then use .onion domains; “hidden services,” where both user and host are obscured. Instead of connecting directly, both sides layer up encrypted links via a shared rendezvous point on the TOR network, so nobody knows anybody else’s true IP This creates the built-in anonymity which makes the Dark Web so popular, keeping everything… under wraps (sorry).

Where’s The Leak?

We know one of the most common forms of DARKInt comes in the form of the humble data breach. Public leak indexes are one of the most beginner-friendly entry points into DARKInt, as they point users to large collections of said breached data.

Unlike raw breach dumps (a.k.a. the actual compromised data) leak indexes are designed for search and discovery, and act as directories or lookup tools, rather than hosting any data directly. They’re finding where data exists, and how it connects across leaks. Although datasets are traded, reused or repackaged across multiple Dark Web platforms, indexes can often find specific data whether it’s circulating across the Dark Web or in the wider web bloodstream beyond.

The usual caveats about breached data apply. There’s always a compliance problem when handling potentially stolen data, so treat any data you find as if it were your own.

Search Engines Are Like Onions Too.

These aren’t the Dark Web Google. If TOR is your vehicle into the Dark Web, onion search engines are more like a slightly unreliable sat-nav; this Garmin won’t get you there, but it might point you in the right direction. These tools don’t provide access to anything. Instead, they index and surface .onion sites, helping users discover hidden services they might not know about. Onion search engines:

• Index .onion domains and hidden services

• Enable keyword-based discovery (once you’re already using TOR)

Unlike TOR browsers (which actually connect you to sites) onion search engines sit a layer above like the onion’s outer skin, acting as discovery tools rather than access tools. And because the Dark Web is so transient (sites appear, disappear, or hide deliberately), these engines are best thought of as more treasure hunt than Google search. The coverage on the aforementioned Garmin is patchy, unstable, and often outdated. Still, it works when it doesn’t drive you into a lake - or an active volcano.

Tracing An Account Back to the Surface, Step-By-Step.

1. Use the tools above (indexes, search engines) to identify breaches.

2. Extract identifiers (email, username, phone number) from DARKINT sources.

   • You’ll need a Tor browser to access them.

3. Pivot using emails.

• Identify email accounts, recovery emails, and profiles just as you would as normal.

4. Look for usernames.

• Do the same for usernames - especially look for reuse across social media, forums, or gaming sites.

• Look for variations, and cross-reference matches as in light-mode OSINT.

5. Pivot using phone numbers.

• Investigate links to messaging apps, listings, or leaked records that use breached phone numbers.

6. Correlate findings.

• Always combine multiple data points to strengthen attribution.

Lastly… Validate carefully.

• Watch out for false positives, outdated, or manipulated data - on the Dark Web, these are all over the place

Key Limitations on DARKInt

If these two guides have made the dark, dirty web sound all sunshine and rainbows, now is the time to crush your dreams. There’s no unicorns skipping around down there. DARKInt has limitations, and plenty of them. Let’s meet the monsters under the Internet’s bed.

A High Risk Environment

Imagine a world where everybody hates each other. That’s kinda the Dark Web. DARKInt operates within an anonymised, adversarial ecosystem built to keep its infrastructure volatile, and access inconsistent. Elevated operational security risks are baked-in. Hidden services frequently appear and disappear, and interacting with them can expose investigators to threat just by virtue (or vice) of a click. Tread carefully.

False-Data Scam-O-Rama

Data quality is ‘highly unreliable’ to be polite. Breach dumps are often annoyingly duplicated, hopelessly outdated, trickily manipulated, or deliberately seeded with false facts. Financially motivated actors frequently distribute misleading datasets. At worst, you might end up involved in a particularly icky scam. At best, the overall signal-to-noise ratio can reach a hair-tearing level. Be patient.

Not Everything is Verifiable

So you have that ‘highly unreliable’ data. It might never become reliable. Attribution and validation are inherently limited on the Dark Web, where anonymisation layers and restricted visibility are the whole point. So much activity occurs behind closed doors - in closed networks or private exchanges - that datasets can’t always be corroborated or independently verified (outside of our dreams). Manage your expectations.

Seeing Things You Can’t Unsee

If you work recklessly in DARKInt, you’re playing psychological Russian roulette. You may encounter material that is disturbing, illegal, or just deeply distressing; content that stays with you long after you’ve closed TOR. When people are anonymous, they showcase the worst things humanity can do to each other. Even if you do everything right, you can end up seeing something deeply wrong. Have caution.

Key Takeaways

Our journey through the Web’s dark side is coming to an end. You should now know:

• All DARKINT is OSINT, but not all OSINT is DARKINT

• The tools beginners need to go web spelunking

• How to bring dark data into the light

• … and why the Dark Web isn’t where the unicorns live.

See you next issue, investigators!

🏁 New CTF Challenge Live - Covert Communication

A new CTF challenge has been posted on our CTF website. This week’s challenge involves analyzing a covert communications channel used by a suspected intelligence operative and finding the name of the location.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “The Dark Web DB” required participants to investigate a suspected data breach involving Quick, where a threat actor allegedly published a customer database on the dark web and uncover key details about the publication.

To solve the challenge, we need:

1. Copy & paste the onion link into Wayback Machine.

2. Then we filter the results by date and select 06 March of 2026. We get a result for 06 March 2026 at 08:01:04.

3. We click on it, looking at the forum, on the right corner, we can see a post regarding a french and Belgian database.

4. It says that it was published 10 mins ago, we can also see the username of the threat actor who published it, which is: sarkstic.

5. Knowing that the forum was crawled at 08:01:04 and that the post says 10 mins ago, the post was made at 07:51:04.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

This episode covers Issues 103 and 104 of The OSINT Newsletter and focuses on two distinct but complementary areas: understanding the Dark Web as an intelligence source, and using live traffic data and cameras to build real-time situational awareness.

In Episode 17 of The OSINT Podcast, host Jake Creps opens with a foundational primer on Dark Web intelligence - or DARKINT. He breaks down the difference between the surface, deep, and dark web, explains how onion browsers and hidden services work, and outlines what investigators are likely to encounter when they go looking: breach dumps, criminal forums, paste sites, and shared credentials.

Jake covers the key distinction between OSINT and DARKINT - all DARKINT is OSINT, but not all OSINT is DARKINT - and explains why investigators combine both to build a complete picture of a target. He also addresses the compliance considerations that come with handling data sourced from the shadowy side of the net.

The episode then shifts to something more grounded - literally. Jake walks through how live traffic data can be used to gain situational awareness around a specific location or event. Starting with familiar tools like Google Maps and Waze, he explains how investigators can layer incident data, traffic flow, and police sightings before moving into more technical territory: the MapQuest Traffic API, the unofficial Waze API, and how to fuse multiple data sources into a single, custom solution.

From there, Jake covers live traffic camera feeds - manual methods via Department of Transportation sites, and API-based options like Road511 and Vizzion that allow investigators to build scalable, multi-location monitoring pipelines. The episode closes with a look at an unexpected bonus data source: rideshare apps, and the real-time vehicle location data sitting inside their public-facing interfaces.

Highlights include:

🧅 Dark Web 101 – surface, deep, and dark web explained, how onion browsers and hidden services work, and why Dark Web users are like ogres.

🕵️ DARKINT Data Types – breach dumps, criminal forums, paste sites, and what each means for an OSINT investigation.

🚦 Live Traffic Intelligence – using Google Maps, Waze, MapQuest API, and the unofficial Waze API to monitor incidents, road closures, and traffic flow in areas of interest.

📹 Traffic Camera Feeds – how to aggregate live camera feeds manually and at scale using Road511, Vizzion, and scraping methods.

The best investigators know how to follow the data wherever it leads - even into the dark, or down the road. Episode 17 shows you how to do both.

References

• OSINT Newsletter – Issue 103

• OSINT Newsletter – Issue 104

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ OSINT and the Dark Web: Part One

Let’s get started. ⬇️

OSINT News

📰 3 Basic but Overlooked Intelligence Analysis Techniques

Plot it on a map, lay it out over time, or group it by theme. Simple moves that surface patterns, gaps, and what matters without collecting anything new.

Read on LinkedIn…

🎩 H/T: Paul Prouse

📰 Mining China’s ‘Little Red Book’ for Open Source Gold

A breakdown of how Xiaohongshu can be used for investigations, from diaspora activity to censorship patterns, plus practical tips for search, language, and preserving content before it disappears.

Read on Bellingcat…

🎩 H/T: Chu Yang

📰 Hundreds of Fake Pro-Trump Avatars Emerge on Social Media

An investigation finds networks of AI-generated avatars posting pro-Trump content across major platforms, blending spam, engagement farming, and political messaging at scale.

Read on The New York Times… | No Paywall

🎩 H/T: Tiffany Hsu

OSINT Tools

🔎 CoJournalist

coJournalist lets reporters deploy AI “scouts” to track pages, social accounts, and public records, then distills updates into structured, cite-ready leads.

Web App

🎩 H/T: Tom Vaillan

🔎 Snapchat Bitmoji History

A simple tool that pulls past Bitmoji versions from a Snap profile and displays them in one place, building on earlier research and tooling.

Bookmarklet

🎩 H/T: Micah Hoffman

🔎 ImageWhisperer

ImageWhisperer analyzes uploaded media for AI generation and manipulation signals, producing a single verdict with evidence across multiple detection models.

Web App

🎩 H/T: Henk Van Ess

🏁 New CTF Challenge Live - The Dark Web DB

A new CTF challenge has been posted on our CTF website. This week’s challenge involves identifying a threat actor who published a database allegedly belonging to a French and Belgian fast-food chain “Quick” on the Dark Web. Your objective is to find the actor’s username and determine the exact timestamp of the original publication.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Crowd Control” where participants needed to estimate the number of people present in an auditorium by using a specific AI tool available publicly.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Gathering OSINT from Live Traffic: Datasets and Cameras

• Traffic datasets and live cameras give you situational awareness into areas of interest for an investigation. Whether it’s business continuity, executive protection, global travel, or something niche, this issue breaks down the options available to you in an actionable plan.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

• What the Dark Web is

• The difference between surface, deep and dark web

• The kinds of data you’ll find

• OSINT vs. DARKINT

• …and why Dark Web users are like onions.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ OSINT Methods for Archiving and Searching Video by Keyword

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

While OSINT operates out in the open - it is open source intelligence, after all - some of the most significant data lurks in the dark corners of the internet. So this time, we’re getting shady with it. Dark Web intelligence (or DARKINT) is the hidden side of OSINT. It sounds dangerous; but it’s perfectly safe to step into the gloom if you know how. Let’s begin our two-issue trip into the shadows with an overview of Dark Web OSINT. In Part One, we’ll cover:

• What the Dark Web is

• The difference between surface, deep and dark web

• The kinds of data you’ll find

• OSINT vs. DARKINT

• …and why Dark Web users are like onions.

Let’s go dark.

What is the Dark Web?

The internet looks a little like an iceberg. It’s divided into multiple layers: the surface web at the top, the dark web at the bottom, and the deep web in the middle.

• Surface Web: The normie ”internet”. The stuff you use every day, that is indexed by conventional search engines (Google, Bing etc.), and easily searchable.

• Deep Web: Also known as the “invisible web” or “hidden web’. Unindexed and not easily searchable, but still accessible without a specialised browser. Content on the deep web includes online banking services, private networks and corporate systems. It makes up around 90% of the internet.

• Dark Web: Unindexed, encrypted, and only accessible with specialised tools like onion browsers. The Dark Web makes up somewhere between 1% and 6% of the internet; and unlike its deep cousin, it’s always anonymised. Data found on this layer is known as dark web intelligence (DARKINT).

The important thing to remember about the Dark Web is that it’s not a single place; it’s a collection of anonymous websites hosted on encrypted networks. Some of these networks play host to financial fraudsters, terrorist cells, CSAM, drug dealing and weapons sales.

But - despite the scare stories - not everything on the dark web is dodgy. Although many criminals do ply their wares on the internet’s dark side, it also has legitimate privacy-driven and anti-censorship use cases. For example, even major news outlets mirror their sites on the Dark Web, to give citizens secret access under harsh state censorship.

Onion Browsers and Hidden Services

To access the Dark Web, you’ll need special tools. Enter TOR: short for The Onion Router. Onion browsers like TOR are too complicated to explain in detail here; but they basically work by encrypting your connections through multiple layers - like the skin of an onion. Each layer only knows part of the journey, making it extremely difficult to trace your activities. What makes the Dark Web a-peel-ing (sorry) to its users is anonymity; and onion browsers have this built-in.

Meanwhile, websites on the Dark Web use .onion domains, too, meaning both the user and the host are completely obscured. These sites are officially called ‘hidden services’ - and without them, there’s no Dark Web.

Hosted within the TOR network, hidden services work similarly; both user and host build encrypted connections instead of linking up directly. Each hidden service will send out a descriptor on the TOR network, that’s discoverable to all users that know the .onion address. When users gain access to the site, they actually go to this rendezvous point - so neither side knows each other’s real IP. This process means mutual anonymity for everybody involved.

So in Shrek terms, Dark Web users are the ogres of the internet. They’ve got layers.

DARKINT: What Will You Find on the Dark Web?

From an OSINT perspective, the most important part of the Dark Web will always be the data we meet along the way. But what data types can you expect to find on the shadowy side of the net? Here’s what’s usually lurking down there.

Data Leaks and Breach Dumps

One of the most valuable (and most common) forms of DARKINT is the good old breach dump. Compromised data - leaked logins, for example - proliferates all over the Dark Web. You can find:

• Email and password combinations

• Usernames and aliases

• Phone and mobile numbers

The boon with breach dumps is they often “package” multiple data points together; terrible for the subjects’ anonymity, but perfect for OSINT pros piecing together an identity profile. These datasets can even be traded, reused or repackaged across multiple Dark Web platforms. However, it’s important to bear in mind the compliance problem when handling potentially dirty data.

Forums and Marketplaces

Remember the fraud, drugs and guns we discussed earlier? Those Dark Web forums and marketplaces are central to the hidden net’s ecosystem; although they’re dangerous and damaging for the offline world, they allow OSINT investigators to catch bad guys in the act. Cybercriminal activity can include:

• Discussion of terrorist activities

• Organising financial fraud

• Buying and selling personal data

• “Service” marketplaces (drugs, guns, porn etc)

Even though the Dark Web is anonymised, it can still provide data that unmasks serious criminals. Many investigations have been cracked with DARKINT - exposing heinous offenders including child sexual abusers.

Paste Sites and Shared Credential

Paste sites - like Pastebin - are social media platforms that allow their users to dump large quantities of plain-text data online. They were created as innocent spaces for coders to share snippets of work, but have become increasingly popular with threat actors as a staging ground for dangerous activity.

These are often used to share sensitive information from stolen credit card details, to malware, to exploit code. Although they aren’t often persistent, they can still be full of data that gets widely distributed - data that can also be crucial for OSINT.

OSINT vs DARKINT

All DARKINT is OSINT, but not all OSINT is DARKINT. OSINT includes the publicly accessible, indexed or easily reachable by the normie-net data. Meanwhile, DARKINT is just the hidden, encrypted data that only specialised Dark Web tools can dig up.

The question remains, however: why risk digging into DARKINT at all? Surely - unless you’re fighting cybercrime - the Dark Web is more risk than reward? Well, whilst OSINT tells you what’s going on out in public, DARKINT exposes what netizens intentionally work to hide. In practice, most investigators will combine OSINT and DARKINT to find all the data they need.

Key Takeaways

So, now you’ve taken your first steps into the shadowy side of the internet known as the Dark Web. You should now know:

• The Internet is like an iceberg - 90% is below the surface

• The Dark Web isn’t all dodgy; it does have legitimate uses

• All DARKINT is OSINT, but not all OSINT is DARKINT

• … and DARKINT investigators are like onions - they have layers.

See you next issue, investigators!

⭐ Sponsor: SockPuppet.io

SockPuppet delivers secure, isolated environments with persistent virtual desktops and phones, real carrier-based SMS for OTPs, and residential IP connectivity—selectable from hundreds of locations. All accessible through a simple web interface that scales as your investigations grow.

Visit SockPuppet.io to empower your investigations with technology trusted by intelligence professionals.

🏁 New CTF Challenge Live - Crowd Control

A new CTF challenge has been posted on our CTF website. This week’s challenge involves estimating the number of people in a photograph from the 2024 NATO Summit using a specific tool.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Digital Footprints” where participants needed to identify the domains linked to a specific email address using only OSINT techniques.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

This episode covers Issues 101 and 102 of The OSINT Newsletter and focuses on two practical areas of modern OSINT: mapping a target’s digital footprint using a comprehensive open-source framework, and extracting intelligence from video content at scale.

In Episode 16 of The OSINT Podcast, host Jake Creps opens with a deep dive into TheBigBrother, a GitHub-based OSINT framework that consolidates username enumeration, reverse image searching, network scanning, dark web lookups, EXIF extraction, crypto tracing, and more into a single tool. Jake walks through setup, core modules, and the real investigative value it offers - from identity correlation and social media pivoting to red teaming and privacy audits.

He then moves into one of the more underrated challenges in OSINT: working with video. Jake breaks down how to extract transcripts from YouTube and TikTok using tools like YouTube Transcript API and TokScript, and explains how to scale that process across dozens or hundreds of videos using open-source libraries and lightweight custom tooling.

Once video content is converted to text, the episode shows how to make it searchable - combining local search methods, Obsidian vaults, and LLMs to analyse transcripts at scale and produce actionable intelligence outputs.

Along the way, the episode reinforces a core principle: tools support collection, but intelligence requires analysis. Knowing how to build the pipeline is only half the work - knowing what to do with the output is what separates a collection exercise from actual OSINT.

Highlights include:

🔍 TheBigBrother Deep Dive – a full walkthrough of the framework’s modules including Profiler, Footprint, Net Scan, Dark Web, EXIF, Dorks, and Sky Radar, with practical use cases for each.

🎥 Video Transcript Extraction – how to pull transcripts from YouTube and TikTok one at a time and at scale using YouTube Transcript API, TokScript, and the Summarize library.

📂 Searching at Scale – combining transcribed video content with local search tools, Obsidian, and LLMs to surface patterns and produce intelligence reports.

Whether you’re tracing a username across the internet or digging through hours of video evidence, Episode 16 gives you the tools and workflow to do it efficiently.

References

• OSINT Newsletter – Issue 101

• OSINT Newsletter – Issue 102

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ A deep dive into TheBigBrother, a comprehensive OSINT framework

Let’s get started. ⬇️

OSINT News

📰 Geolocating Taliban in the Afghan Desert

Ben walks you through a recent investigation he did in the Afghan desert. He steps through how he identified a base, tracked a flight, located a soldier drop off point, finding a dune strike location, and more.

Read on LinkedIn… | YouTube

🎩 H/T: Benjamin Strick

📰 How OSINT Verifies Viral Claims During Wartime Chaos

This video shows how to analyze a viral Reddit claim that Iran bombed its own girls’ school by identifying manipulation signals, evaluating online actors and naming patterns, comparing search results, and verifying wartime claims using government sources, fact-checkers, verification outlets, and cross-model AI.

Watch on YouTube…

🎩 H/T: Kirby Plessas

📰 How Wildlife Traffickers Are Using Coded Language to Sell Protected Animals On Facebook

Foeke walks through how to identify coded language on Facebook Marketplace that indicates the sale of protected animals, including screenshots and other evidence collected.

Read on Bellingcat…

🎩 H/T: Foeke Postma

OSINT Tools

🔎 OSINT Rack

OSINT Rack is a collection of OSINT tools categorized by use case, blog posts, courses, books, events, and more.

Web App

🎩 H/T: Mario Santella

🔎 Tor Node Archive

Tod Node Archive gives you insight into the world of Tor Nodes with a search engine, downloadable dataset, and a changelog.

Web App/Dataset

🎩 H/T:

🔎 CrowdCounter

CrowdCounter estimates how many people are in a photo, saving you the time it takes to count manually. Too bad it doesn’t have an API, Henk!

Web App

🎩 H/T: Henk Van Ess

🏁 New CTF Challenge Live - Digital Footprints

A new CTF challenge has been posted on our CTF website. This week’s challenge involves identifying multiple domains linked to a well-known threat actor using only its email address.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Tracing the Source” where participants needed to identify the username of the Telegram channel that published a promotional message and the name of the telegram channel that was promoted in that message, using only OSINT techniques.

Solution WU :

To solve this challenge, we need to use https://deaddrop.theosintconsultants.com/ to locate the original Telegram message.

By enclosing the message in quotation marks for an exact search (e.g., (”نات ابعثولي الخاص...”) and applying a date filter corresponding to the timestamp (From: 2026-04-01 To: 2026-04-01), we were able to pinpoint a search result that displayed:

• The username of the channel that posted the message

• The content of the message

• The username of the promoted channel

This method allowed us to identify the Telegram channel solely using the message content and the timestamp, as required by the challenge.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ OSINT Methods for Archiving and Searching Video by Keyword

• Learn tools, tactics, and techniques for processing information from videos in a way that’s searchable at scale.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

🎁 It’s been a while since a paid subscription of The OSINT Newsletter went on sale. Recently, the newsletter crossed the 32,000 subscriber mark. To celebrate, here’s a 50% off discount.

50% Off

Here’s what you’ll get access to by upgrading now:

• Access to the entire newsletter archive of paid content with over 100 issues of tools, tactics, and techniques.

• Continuously improve your skill set with the latest OSINT methods to discover more, be more efficient, and bring more value to your organization or mission.

Thanks for your support.

Click here to get 50% off The OSINT Newsletter👇

Get Better at OSINT for $40