• What marketplace listings reveal beyond the item itself

• Where different platforms expose different types of data

• Why low-effort selling often leads to high-value OSINT

• …and whether you can actually sell everything and your grandmother.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Create an OSINT Tool that Constantly Improves

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

Everything Must Go (Including Their OPSEC): OSINT on eCommerce and Marketplace

Selling your junk on an online marketplace is just a quick side quest, right? List the item, grab the cash and move on. Little do people know, this low-stakes fire-sale mindset is what OSINT-ers thank them for. After all, who thinks about OpSec when they’re trying to shift their haunted Thai puppet ASAP? Nobody, that’s who.

In this issue, we’re covering how to make the most of the mercantile mindset for OSINT investigations. You’ll learn:

• What marketplace listings reveal beyond the item itself

• Where different platforms expose different types of data

• Why low-effort selling often leads to high-value OSINT

• …and whether you can actually sell everything and your grandmother.

Why Do OSINT in Online Marketplaces?

Online marketplaces - like eBay, Craigslist or Facebook Marketplace - function fundamentally differently to non-selling social media.

On a transactional platform, there’s no audience to curate for, and no pressure to perform - unlike social platforms. A user has no timeline to maintain, so they’ll go ahead and sell that handmade Minion fire pit regardless of what people think.

When people aren’t thinking about being observed, they become less concerned with observers. Listings get rushed or photos get taken quickly without thought about what they reveal. Being findable might even be key to the sale, i.e., if the item is too large to post, needs verification, etc.

Locations are usually given automatically in a marketplace listing. There’s also plenty of photo evidence to get stuck into. If descriptions get copied, reused, or written without much creativity, it can also be easy to spot a single seller with many accounts.

What Can Be Analyzed?

Listings with photos and descriptions are super valuable for marketplace OSINT, but they’re just face-value. There’s even more to find if you know where to look. Let’s go deeper into what users are really selling when they post that ad for ‘bob’s burgers hamburger landline phone’.

Seller Behavior

How often does someone post? How do they respond to prospective buyers? How urgently do they sell their items? A desperate plea to ‘COME TAKE THESE FAKE ASS TREES BEFORE I HURL THEM OFF MY BALCONY’ can tell you a lot about a user’s state of mind.

If and when patterns emerge, note if they follow across multiple platforms. Which and how many platforms a user frequents (Craigslist vs Etsy, for example) can also tell you a lot, and help you delineate your subjects: casual declutterer vs. semi-professional reseller vs. someone offloading everything before they skip town.

Product Listings

The aforementioned big-hitter. Descriptions, wording, and types of items sold can offer glimpses into your subjects’ interests, lifestyle, and occupation. Selling a SurfJet motorized surfboard? You’re a watersportsman. Looking to find a goat for a rap video? Chances are you work in music. Listing ‘Giant Oatly Carton @ Global Life Field’? Just gave your location away in the title, buddy. And your lactose intolerance.

Repeated phrasing across listings can also prove useful. Most people have a distinct writing style, and some might outright copy and paste. Not only can noticing these repeat offenders link accounts and identify users, but this OSINT tactic is so powerful that it’s caught serial killers.

Shipping Patterns
Collect-in-person listings are an easy GEOInt win, but if you sell it, you’ve usually got to ship it. Mismatches in locations, dispatch times, and delivery options are just as useful here. Postage details can hint at where someone is actually based - not just where they claim to be.

A Beginner’s Guide to Marketplace Platforms

eBay

Condition: Still-shiny, well-organised, fully functional.

Description: The OG marketplace platform. Comes with structured listings, detailed seller histories, and a built-in feedback system that practically does half the OSINT work for you.

Ideal for beginners and professionals alike.

Etsy

Condition: Handcrafted, bespoke, not ‘old’ just ‘preloved’.

Description: A more personal marketplace. Here, sellers blend commerce with crafting an enviable social-media style identity. Users’ ‘shops’ sell products alongside a broader seller persona - so often link to real names, personal brands, personal e-commerce websites or external platforms like Instagram (for the *aesthetic*, obvs).

Ideal for beginners and professionals. Expect to find users who avoid the other boring marketplaces.

Facebook Marketplace

Condition: Local pickup only, no refunds.

Description: Embrace the chaos. Don’t expect to find storefronts here. Listings require real names, real profiles, and zero patience. The pace here’s fast, messy, and… In fact, ignore the items. Check the linked Facebook profiles. That’s where the value is.

Ideal for professionals and more experienced investigators.

Some Investigation Pathways

1. Analyze Listing Patterns
   Look at frequency, item types, and post timing. Are they selling similar things repeatedly? Clearing out many identical items or many items in a certain category? One Amish wax figure is one thing, but 40 in different sizes…?

2. Compare Seller Profiles
   Cross-reference listings, usernames, bios, and linked accounts across platforms. What do you learn?

3. Identify Reused Descriptions or Images
   It’s unlikely more than one user has a killer female alien they made for art class. Still, finding copy-paste text and identical photos is the easiest way to link multiple accounts or listings. Does this second alien also have a small crack on the side of her ankle? (Don’t worry, you can glue it back together.)

Common Red Flags to Watch Out For

Many investigators are using OSINT to spot scams and missold items. The following are quick-and-dirty ways to identify them.

Boilerplate Listings
Once you spot this, you’ll see it everywhere. We mean beyond the point of a single user copy-pasting to increase exposure. Ten or more listings with the same phrasing, same structure, and different items are probably scammy nonsense. If you’re looking for proof of that - game on.

Stock Images
Alarm bells should ring. Either they’re hiding the real item, or they don’t have a real one to sell. The same goes for AI-generated images.

Unusual Pricing Patterns
Too cheap or oddly fluctuating prices are worth investigating. Remember: pricing often reflects intent. Is $4000 too cheap for a geodesic moon dome?

Listing Sold

Nice work. You’ve just cleared out Marketplace OSINT.

Now you should know:

• What seller behaviour reveals

• How to work with product descriptions and images

• How platforms differ

If you’ve checked the listings, compared the profiles, followed the patterns, and questioned what’s actually being shown, you’ll start seeing past the items — and into the OSINT behind them.

As for your grandmother, don’t try to sell her on eBay. People have tried. It’s illegal.

See you next week, investigators!

🏁 New CTF Challenge Live - The Breach

A new CTF challenge has been posted on our CTF website. This week's challenge involves finding the first and most recent time a threat actor's email address appeared in public data breaches using a tool featured in our previous newsletter.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “The Fugitive” where participants were tasked with identifying the name of the psychological cabinet where a fugitive had an appointment before disappearing.

Challenge solution WU:

To solve this challenge, participants must use a tool that redirects them to the Google reviews of the provided email address. For that they can use OSINT Industries or GHunt. Querying that email address and checking the Google reviews left by the fugitive, we can find the cabinet name.

Note: They can also do it manually by extracting the GAIA ID, which will lead to the google reviews account.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Then Jake turns to the machine sort of persistence, tackling the hardest part of building an OSINT tool: keeping it alive as sources and methods shift underneath you. He walks through a discovery pipeline built on GitHub search, Google dorks and browser extension source code, then explains how agentic AI can be used to fold capabilities from those projects into a tool of your own that keeps getting better over time. He closes on the uncomfortable question this raises for open source: what happens when anyone can harvest twenty or thirty projects into a single commercial product for the price of a monthly subscription. Also in this episode: a quick look at Leaker, a command-line tool that queries a dozen breach databases from a single search, plus the latest news and tools from the newsletter.

Highlights

💬 Why forum power users and reply guys are the most valuable posters in OSINT

🕰️ What years of post history reveals that a current profile never will

🔍 Where to look beyond Reddit: niche forums, comment sections and dusty old threads

🧭 A four-step workflow: search, track history, spot behavioural patterns, cross-reference

🔑 Why username reuse and point systems make cross-platform pivots easy

🗝️ A brief look at Leaker, a CLI tool that consolidates searches across 12 breach data providers

🤖 Building an OSINT tool that continuously improves itself using agentic AI

🌱 Using GitHub API, SERP APIs and CRX viewers to build a feed of tools to harvest from

⚖️ The ethical and existential questions this raises for open source projects

🗣️ Nearly 100,000 AI chats that users thought were private turned out to be anything but

🕵️ Bellingcat tracks down the crypto entrepreneur behind a forum trading stolen intimate images

🗺️ New tools: OSINT Mapping Tool, Mail Access and Search Phone

Links

Issue #114: https://osintnewsletter.com/p/114

Issue #115: https://osintnewsletter.com/p/115

Issue #116: https://osintnewsletter.com/p/116

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ OSINT Tool Tuesday: Leaker

⚡ Reply Guys & Power Users: OSINT on Forums and Online Communities

Let’s get started. ⬇️

OSINT News

📰 Another 96,477 “private” chats went public

Nearly 100,000 people thought they were sharing private AI chats with someone, but they actually made them public and all their personal info is still out there.

Read on Digital Digging…

🎩 H/T: Henk Van Ess

📰 Identifying the Crypto Entrepreneur Linked to Popular Forum Trading in ‘Leaked’ Nudes of Women

Investigators tracked down the guy running a huge site where people traded stolen intimate photos of women and found he’s a crypto entrepreneur from New Zealand. Once they contacted him about it, the site went offline.

Read on Bellingcat…

🎩 H/T: Kolina Koltai

OSINT Tools

🔎 OSINT Mapping Tool

OSINT Mapping Tool is a web app for organizing OSINT research where you create nodes for identifiers like social handles and phone numbers, pin them on Google Maps, and connect them to show relationships. Everything stays local in your browser, nothing gets sent anywhere.

GitHub

🎩 H/T: anonymousRAID

🔎 Mail Access

Mail Access is a self-hosted OSINT tool for investigating email addresses. It checks breaches, social networks, DNS records, and the web to map out identities, assign exposure scores, and export findings as PDFs, CSVs, JSON, STIX, or Maltego files.

GitHub

🎩 H/T: Katriel Moses

🔎 Search Phone

Search Phone a Python CLI tool for looking up phone number information using a variety of APIs.

GitHub

🎩 H/T: Hack Underway

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Create an OSINT Tool that Constantly Improves

• Creating OSINT tools is hard because the sources and methods constantly change. It’s not making the tool that’s the hard part, it’s maintaining it. But what if we could make a tool that constantly checks new, similar tools that come out and makes adjustments over time? Let’s find out if we can.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

🚨 This tool has been added to the OSINT Resources for Breached Data Provider OSINT page on The OSINT Newsletter for easy reference later. That list serves as a roadmap for new tutorials in the future. If there are any tools you’d like to see added to the list and covered, please reach out to jake@osint.news with details.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Reply Guys & Power Users: OSINT on Forums and Online Communities

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

Leaker

Leaker is a passive leak enumeration tool that queries 12 different breach databases simultaneously and consolidates the results with a single command. It supports five search types: email addresses, usernames, domain names, keywords, and phone numbers. Results may include exposed emails, usernames, passwords, password hashes, IP addresses, phone numbers, names, database sources, and associated URLs depending on what each source returns.

🎩 H/T: @vflame6 / Maksim Radaev

Leaker is best suited for users who already have API access to breach data providers and want to streamline their workflow.

Note: It doesn’t provide its own breach data; it aggregates results from third-party sources.

In this guide, I’ll show you how to install Leaker, perform your first searches, work with multiple sources and use it effectively during OSINT investigations.

So, without further ado, let’s get started. ⬇️

Setup

Leaker runs entirely from the command line but the installation is one of the most straightforward I’ve seen.

All you need to do, using Go, is to paste the below into your terminal:

go install -v github.com/vflame6/leaker@latest

Once installed, it’s worth checking everything is working correctly by inputting this command:

leaker --version

Your main sticking point with this tool is the need to configure your API keys to access results via multiple sources as only 2 sources (Hudson Rock and Proxy Nova) don’t require you to have them.

To configure your API keys, edit the provider config file at `$HOME/.config/leaker/provider-config.yaml` (auto-generated on first run):

Yaml

leakcheck: YOUR_API_KEY

dehashed: YOUR_API_KEY

Snusbase: YOUR_API_KEY

You can view the list of available sources here:

Usage

Leaker organises searches by the type of identifier you’re investigating.

Email Searches

Email addresses are probably the most common starting point during breach investigations. This is the format you’ll what to input into the command line:

leaker email person@example.com

Leaker will query its configured sources and return any matching records that are discovered.

🗒️ This is usually the quickest way to establish whether an email address appears in known breach datasets.

Username Searches

Usernames often appear across multiple breaches and services. The below is the example command:

leaker username johnsmith

Such searches can reveal associated datasets helping you build a timeline of historical exposure.

Domain Searches

You can search entire domains, which can prove useful in corporate investigations. The format you’d input is as below:

leaker domain example.com

This helps identify breached accounts associated with an organisation and can support attack surface assessments or incident response activities.

Phone Number Searches

Where supported by the selected sources, Leaker can also search telephone numbers. Again, the format to enter into your command line would simply be as below:

leaker phone +441234567890

This can provide another useful pivot during identity-focused investigations.

Keyword Searches

Leaker isn’t just limited to identities; you can search for keywords too by entering a similar command to the below:

leaker keyword osint

This can surface references to organisations, projects or other terms across supported leak sources.

Working With Multiple Targets

One feature that makes Leaker particularly useful is its ability to process lists rather than individual searches.

For example, if you have a text file containing one email address per line:

leaker email emails.txt

The same approach works for usernames, domains and phone numbers, making Leaker ideal when triaging larger datasets or conducting exposure reviews.

Selecting Sources

By default, Leaker queries its standard online providers, but you can also specify exactly which sources to use or even search a local cache database.

To quickly view the available providers at any given time:

leaker --list-sources

You can then select individual sources using the -s option, helping reduce unnecessary queries or focus on a particular provider.

JSON Output

If you’re integrating Leaker into scripts or larger workflows, JSON output is extremely useful. You can enter the following command:

leaker email user@example.com -j

This produces JSONL output that can easily be piped into jq, Python scripts or other automation tools.

Use Cases

Leaker’s main strength is its ability to consolidate results from numerous data sources into one search, making it easier to identify exposed information, correlate identities, and investigate historical data breaches. It fits naturally into a number of OSINT workflows. So, let’s explore those further:

Credential Exposure Discovery
This is arguably the primary use case, as Leaker enables investigators to determine whether email addresses, usernames, domains, phone numbers, or keywords appear in known breach datasets. The results can reveal exposed credentials, password hashes, contact details, and other compromised information, making the tool valuable for breach investigations, identity exposure assessments, and security awareness activities.

Threat Intelligence
Leaker can enrich investigations by identifying compromised accounts linked to threat actors, uncovering infrastructure associated with breached data, correlating aliases across multiple datasets, and identifying additional indicators that may support ongoing investigations. Historical breach data often provides useful context when tracking cybercriminal activity or attribution.

Identity & Persona Research
As Leaker can be leveraged to correlate usernames, email addresses, phone numbers, and other identifiers across multiple breach datasets, this can help build profiles, identify alternate accounts or aliases, establish relationships between digital identities, and support investigations into online personas using historical exposure data.

Corporate Security Assessments
Security teams can use Leaker to identify whether employees, corporate email domains, or organisational assets appear in publicly available breach datasets. This supports external exposure assessments, credential hygiene reviews, incident response investigations, third-party risk assessments, and attack surface management by highlighting credentials or information that may already be available to attackers.

Incident Response & Breach Investigations
During incident response, Leaker can help investigators quickly determine whether compromised accounts or identifiers have previously appeared in known breaches. Understanding historical exposure can provide valuable context, assist with scoping investigations, and help determine whether reused credentials or previously compromised accounts may have contributed to an incident.

Important Note: The presence of data in breach repositories does not necessarily indicate a current compromise so results should always be independently verified.

OPSEC Considerations

Remember that Leaker queries publicly available breach intelligence providers, it doesn’t magically uncover private information.

Always:

• Follow the terms of the services you’re querying.

• Never attempt to access accounts discovered during an investigation.

• Handle breach data responsibly.

• Ensure your investigations remain lawful and proportionate.

Additional Tips

Here are a few ways to get more from Leaker:

• Use JSON output when automating workflows.

• Cache results locally to reduce repeated lookups.

• List available providers before large investigations.

• Use information discovered in one search to perform additional lookups. For example, a username may reveal an email address, which in turn may expose additional usernames, domains, or phone numbers that were not initially known.

• Use Keywords Strategically. Broad searches may return large result sets so refining keywords often produces more relevant results.

• Combine Leaker with tools such as Holehe, Sherlock or Have I Been Pwned for broader identity profiling.

Here are a few ways to get more from Leaker:

• Use JSON output when automating workflows.

• Cache results locally to reduce repeated lookups.

• List available providers before large investigations.

• Use information discovered in one search to perform additional lookups. For example, a username may reveal an email address, which in turn may expose additional usernames, domains, or phone numbers that were not initially known.

• Use Keywords Strategically. Broad searches may return large result sets so refining keywords often produces more relevant results.

• Combine Leaker with tools such as Holehe, Sherlock or Have I Been Pwned for broader identity profiling.

🏁 New CTF Challenge Live - Secret File

A new CTF challenge has been posted on our CTF website. This week’s challenge involves a recovered secret file that appears to hide a location. Your objective is to uncover the hidden coordinates and identify the name of a nearby bar.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Port Recon” where participants were tasked with identifying the country where a webcam was located, as well as the names of the six cruise ships docked at the port.

Challenge solution WU :

To solve this challenge, participants need to perform a reverse image search on the provided image. This search leads to an Instagram post showing the same port, where the location is identified as Corfu.

A simple web search for Corfu reveals that the port is located in Greece. Although the Instagram post is written in Greek, the location information is enough to identify the country.

By examining the same Instagram post, participants can also find the names of the six cruise ships present in the port, allowing them to complete the challenge.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

• What long-term posting history reveals

• Where to find high-value discussions (beyond just Reddit)

• A clean simple workflow

• …and why rollercoasters capture that one user’s imagination.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Turning Physical Media into an OSINT Archive Powered by AI

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

Reply Guys & Power Users: OSINT on Forums and Online Communities

The reply guy who just has to weigh in on every thread. The power user with 30,000 posts and even more opinions. The Boomer with a sign-off more dated than a digital calendar. The obsessive who’s been answering the same question about rollercoaster lugnuts since 2009 and still isn’t tired of it.

Every forum has them. From a real-life perspective, these people are (mostly) insufferable. From an OSINT perspective? These people are MVPs - the most valuable posters.

Give someone a forum and enough time, and they’ll build a record of everything: phases and bad takes included. That’s what makes forums powerful for OSINT. They track how users evolve when only their friends are watching.

This issue will teach you:

• What long-term posting history reveals

• Where to find high-value discussions (beyond just Reddit)

• A clean simple workflow

• …and why rollercoasters capture that one user’s imagination.

What Makes Forums Useful

Forums actually predate the Internet. Long before modern platforms, people were gathering in digital spaces to talk… and talk… and talk. Discussions are usually organised by topic, making it easy to follow context. Plus, small forum-specific details like join dates, post counts, locations, or signatures really add up.

Still - there’s more:

Long-term User History

What divides a forum from a chatroom? Post length is one thing, as is content being at least semi-public, and that post material is at least temporarily archived. The latter part means forums are built for persistence. Users keep the same account for years and years, and can build up thousands of posts tied to one identity.

For OSINT, you can see not just what somebody says now, but how these views and interests rise, fall and evolve over time. Once they were super into frogs, now they’re super into Alex Jones. Looks like a pipeline.

Unfiltered Personal Discussion

Forums tend to feel smaller and more community-driven than mainstream social platforms. As a result, users are often more direct and less curated in what they say.

It’s common to find users drop their filters as they get more comfortable on a site. Some platforms are more unfiltered than others. You might think this will give you better material, but don’t expect what you find on Kiwifarms or 4chan’s /b/ board to be genuinely useful. Or even make sense.

Beginner Platforms for Forum Surfing

Different platforms attract different types of users; all are annoying in their own special ways. Understanding where certain types gather and certain posts are made is key to finding the richest, most consistent data trails. Try:

Reddit

If you don’t already scroll your free time away here, welcome to Reddit. Large, active, and searchable(ish), Reddit is useful for identifying usernames, interests, and initial posting behaviour. Subreddits act like mini-forums, centred around specific topics or communities. These could be big subreddits for games or TV, like r/BaldursGate3 or r/breakingbad; or really niche stuff like r/mousepadreview, or people who pee in the sink.

Bear in mind: r/ for a community, and u/ for a user.

Niche Forums

These are smaller, topic-specific communities where users post more consistently and in greater depth about their Thing. Hobby, profession, or interest, these are spaces with higher-signal content and long-term engagement.

Comment Sections

Comment sections on blog and news sites are often overlooked, but sometimes valuable. These spaces can contain older, less moderated discussions… with older, less moderated users. Comment section posters can be more flip than usual about identity and information sharing, but certain sites - looking at you, Youtube - are less profitable than others.

A Four-Fold Workflow For Making Forums Work For You

Now say that title at double speed. By the time your Fs don’t falter, you’ll have found the forum post you were foreseeing you might find in the first place.

Give the following a try:

Step 1: Search Username or Topic

Start by identifying the username or discussion topic relevant to your investigation. Use search engines and/or platform search functions to locate where OSINT-useful activity is most likely happening.

Step 2: Track History

Once you’ve found that user, review their full post history. Once you find that post, review all the posts that led up to it. Don’t just skim - look across time and mark recurring themes, preoccupations, and activity patterns.

Step 3: Identify Behavioral Patterns

Look for consistency. Writing style, posting times, interests, interactions with other users. Do they build a clearer picture of the individual behind the account? Do they give context to the comment you were searching for?

Step 4: Profit!!!!

OK - four steps were necessary to pull off several jokes in this section, but this final link in the chain is in fact extremely necessary. Always cross-reference your OSINT findings, to avoid weak leads and mistakes.

Key Insights

People Reuse Usernames

Many forums reward repeated use of the same username, through point systems like Reddit karma or Stack Overflow badges. Even up- or down-vote systems encourage sticking with one profile. For ease or kudos, many users link accounts or carry the same handle across multiple platforms - making an OSINT pivot a breeze.

Oversharing Is Normal

Frequent posters tend to reveal more over time. As a user gets cosy in their home community, they can overshare: opinions, experiences, and sometimes even more personal details that can be pieced together.

Dusty Old Posts

Old forums rarely get cleaned up, and older content is often less guarded. The web of the past was a more innocent place. Before privacy awareness increased, users were more open. As a result, historical posts are especially valuable for investigators.

Thread closed. You’ve survived the forum trenches. You’re now - officially - a forum OSINT power user.

You should know:

• What makes forums unique

• How long-term posting history builds value

• Why the same username will come up again and again

…As for the obsessive: she’s been posting about that rollercoaster since 2009, because that’s the year she married it.

🏁 New CTF Challenge Live - Port Recon

A new CTF challenge has been posted on our CTF website. This week’s challenge involves
identifying the location of a cruise port and uncovering the names of the six cruise ships visible in the provided image. Can you find the port and identify all six ships?

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Final Boarding” where participants were tasked with identifying the airport from a photograph, finding its IATA code, determining the nearest boarding gate, and uncovering the name of a lounge.

Challenge solution WU :

To solve this challenge, participants should begin by performing a reverse image search on the photograph. One of the most distinctive elements is the walkway featuring the Revolut branding. Among the search results, they should find an exact match identifying the location as Leonardo da Vinci–Rome Fiumicino Airport in Italy. For example:

Once the airport has been identified, participants can look up its IATA code, which is FCO.

To determine the nearest gate, careful observation of the image is required. The gate number is not directly visible but can be seen reflected in the glass façade at the front of the photograph. The reflection reveals Gate A64, which is the closest gate to the location where the picture was taken.

Finally, the challenge asks for the name of the lounge located directly in front of the camera. Since the photograph was taken facing the gates, participants can inspect the airport terminal using Google Earth or the official terminal maps. By locating the area around Gate A64, they can identify the lounge opposite the camera as ITA Lounge Piazza Venezia.

Source links:

• https://www.google.fr/maps/place/A%C3%A9roport+L%C3%A9onard-de-Vinci+de+Rome+Fiumicino/@41.7978627,12.2524034,3a,75y,334.53h,90t/data=!3m8!1e1!3m6!1sCIHM0ogKEICAgIDEipqlwQE!2e10!3e11!6shttps:%2F%2Flh3.googleusercontent.com%2Fgpms-cs-s%2FABJJf52j4euLZQ9v2_RMmVkODsI3IyPpBgvlGKQfma1HATaq1QAtVRazhLu9RiMyUjAoHU_NAdi8-wQYD5XG14iPmtpvDRWCfVyE2GAlVjREZW-S_VGDiT7ERiDksawDxsIsVomkQIkMOw%3Dw900-h600-k-no-pi0-ya283.52704207011993-ro0-fo100!7i8704!8i4352!4m14!1m7!3m6!1s0x1325f0793898141f:0xafe513b4e358316f!2sA%C3%A9roport+L%C3%A9onard-de-Vinci+de+Rome+Fiumicino!8m2!3d41.8034632!4d12.2519211!16zL20vMDFreTVy!3m5!1s0x1325f0793898141f:0xafe513b4e358316f!8m2!3d41.8034632!4d12.2519211!16zL20vMDFreTVy?entry=ttu&g_ep=EgoyMDI2MDcwNS4wIKXMDSoASAFQAw%3D%3D

• https://earth.google.com/web/@41.79715746,12.25224872,13.3019093a,1747.35995742d,35y,298.08003297h,0t,0r/data=CgRCAggBQgIIAEoNCP___________wEQAA

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

The episode also covers EyeDex, an open directory search engine that indexes publicly exposed files, archives, and datasets scattered across the internet. Jake breaks down keyword and file-extension searches, directory pivoting, date sorting, and infrastructure discovery, plus the operational security habits every investigator should follow when poking around exposed servers.

Rounding things out, Jake puts you in the boardroom to investigate a company from the ground up: mapping directors, tracing subsidiaries and parent companies, and cross-referencing filings to spot patterns, covering where to find the paper trail and the pivot points that take you from a company to the people and places behind it.

🔒 Highlights from this episode:
📰 AI-powered second brains, ship tracking, and Bellingcat’s ML for civilian harm detection
🔎 New tools for Discord, email crawling, and console investigations
📚 Turning a physical media library into a searchable AI archive with Obsidian and Qwen
🗂️ Searching the internet’s exposed open directories with EyeDex
🏢 Uncovering who really runs a company and where the money flows

Links:

• Issue 111

• Issue 112

• Issue 113

• CTF: https://ctf.osintnewsletter.com/

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ OSINT Tool Tuesday: EyeDex

⚡ You’re Hired: OSINT and Company Intelligence

Let’s get started. ⬇️

OSINT News

📰 How to Build an AI Second Brain With Claude and Obsidian That Gets Smarter Every Day

A guide to connecting Claude to Obsidian so it can read, organize, and remember your notes across sessions, creating an AI-powered personal knowledge base that improves over time.

Read on X…

🎩 H/T: Yarchi

📰 How I Track Ships in the Strait of Hormuz

A beginner-friendly OSINT tutorial walking through how to track and identify ships in the Strait of Hormuz using free tools like MarineTraffic, VesselFinder, Equasis, and Copernicus satellite imagery, starting from a news report about vessel congestion near Bandar Abbas.

Watch on YouTube…

🎩 H/T: Benjamin Strick

📰 How to Use AI to Help Find Civilian Harm

Bellingcat developed a machine learning model to automatically rank Telegram posts by their likelihood of containing civilian harm, dramatically cutting the time researchers spent searching through war reporting content so they could focus on verification instead.

Read on Bellingcat…

🎩 H/T: Miguel Ramalho

OSINT Tools

🔎 DiscordUtils

A series of useful tools you can use in your OSINT investigations to interrogate Discord servers and users.

Web App

🔎 Email Crawl

Extract emails intelligently at scale for your OSINT investigations including validation, username extraction, and more.

GitHub

🎩 H/T: D4rk_Intel

🔎 XResolver

A collection of tools you can use to investigate users or activity on Xbox Live and the PlayStation Network. Some of the tools seem to be down but they open your mind to possible data points that you can collect.

Web App

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Turning Physical Media into an OSINT Archive Powered by AI

• In this issue, I’ll explain a few methods you can turn physical media into an OSINT archive and how you can leverage tools like Obsidian and Qwen to build a powerful engine on top of it.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

🚨 This tool has been added to the OSINT Resources for Open Directories page on The OSINT Newsletter for easy reference later. That list serves as a roadmap for new tutorials in the future. If there are any tools you’d like to see added to the list and covered, please reach out to jake@osint.news with details.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ You’re Hired: OSINT and Company Intelligence

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

EyeDex

EyeDex is an open directory search engine that indexes publicly accessible web directories and allows users to search across petabytes of exposed files hosted on open servers around the world. It acts as a search layer over open directories, making it easier to locate documents, images, videos, archives, datasets, logs, software, and other files that would otherwise be difficult to discover manually.

🎩 H/T: eyedex

EyeDex allows investigators to search using keywords, file names, file extensions, file groups, indexed server paths, and directory structures.

The platform is especially useful for:

• Discovering forgotten or abandoned public data.

• Locating leaked or exposed files.

• Identifying publicly accessible infrastructure.

• Finding archived datasets and documents.

• Pivoting into additional OSINT investigations.

In this guide, I’ll walk you through how EyeDex works, how to search effectively, practical use cases, and additional search techniques to help uncover further results.

Setup

Unlike many OSINT tools, EyeDex does not require installation or API access. It’s entirely web-based, so simply open up the EyeDex Search Interface and you’re good to go. (Command-line beginners can collectively breathe a sigh of relief!)

Understanding Open Directories

Before using EyeDex effectively, it helps to understand what “open directories” actually are.

An open directory is a publicly accessible web server directory listing where indexing or browsing has been enabled accidentally or intentionally. These often expose PDFs, ZIP archives, videos, source code, backups, configuration files, images, logs, and datasets.

In many cases, these directories were never intended to be publicly searchable. EyeDex indexes these locations and makes them searchable from a central interface.

Note: As always, just because a file is publicly accessible doesn’t mean you should download, distribute, or misuse it. Always operate legally and ethically.

Usage

Now that we’ve covered the basics, let’s dive into how to actually use EyeDex during investigations.

Basic Search

The best place to start is by searching for keywords. You could try a company name, username, project codename, email domain or file name to name but a few.

Example: osint

This may uncover exposed PDFs, archived backups, spreadsheets, internal documentation etc.

As you can see, search results typically include file name, server, location, file size, modification group, and file category e.g. ‘video’ or ‘text’.

🗒️ This is the best starting point for broad reconnaissance.

File Extension Searches

One of EyeDex’s most powerful features is searching by file extension e.g. pdf, sql, txt, log, json, csv etc. You can also combine keywords with extensions.

Example: Manual pdf

This is of course a very wide search query but you can see how it pulls up more recent pdf manuals. Using this feature can help narrow investigations toward specific file types.

🗒️ Extremely useful for identifying accidental data exposure.

File Group Filtering

EyeDex allows filtering by file groups/categories including documents, archives, pictures, text and video. This makes it easier to quickly pivot toward the type of content you’re investigating.

Example workflow:

• Search a company name.

• Filter by “Documents”.

• Review exposed PDFs and spreadsheets.

Server Pivoting

One underrated feature of EyeDex is the ability to pivot into entire exposed directory structures. Once you identify a useful result, you can inspect adjacent folders, browse sibling directories, identify naming conventions, and uncover additional hidden files.

This often reveals:

• staging environments

• old backups

• developer files

• forgotten exports

• archived media

🗒️ Many investigations expand significantly through directory pivoting rather than the initial keyword search itself.

Date Sorting

EyeDex allows sorting by date (and time), helping investigators identify recently modified files, fresh uploads, newly exposed data, and active infrastructure.

It may be a simple feature but this is especially useful during breach monitoring, leak investigations, threat intelligence monitoring, and ransomware tracking.

Infrastructure Discovery

Because search results expose server paths and hostnames, EyeDex can also support infrastructure investigations.

Results may reveal subdomains, internal naming conventions, CDN structures, storage buckets, legacy infrastructure, and mirrored servers.

These become valuable pivot points into:

• DNS investigations

• Shodan searches

• Certificate analysis

• Passive DNS

• Attack surface mapping

Use Cases

EyeDex is essentially a public file discovery and exposed infrastructure reconnaissance tool.

A key feature is its ability to support structured exploration of results and build a clearer picture from scattered publicly available information.

So where exactly is this tool useful in OSINT?

Data Exposure Discovery

This is arguably the primary use case as EyeDex can help investigators locate exposed backups, exported databases, internal documents, logs, and misconfigured storage. This can support breach investigations, attack surface monitoring, corporate reconnaissance, and vulnerability research.

Threat Intelligence

Threat researchers can use EyeDex to identify leaked datasets, locate malware samples, discover exposed infrastructure, uncover staging servers, and track threat actor file hosting. Open directories are frequently used for malware hosting, phishing kits, leaked credential storage, and pirated tooling.

Note: Always exercise caution when interacting with downloadable content.

Research & Archiving

EyeDex is also widely used by archivists and researchers looking for old software, datasets, scanned books, historical archives, and niche media collections. The open directory community has long used similar indexing techniques for archival discovery.

Corporate Reconnaissance

Security teams and investigators can use EyeDex to identify exposed internal documents, forgotten staging environments, publicly accessible backups, and leaked configuration files. This makes the tool valuable for red teaming, attack surface management, and external exposure assessments.

Operational Security Considerations

When using open directory search engines:

• Never execute unknown files directly.

• Avoid downloading executables from untrusted sources.

• Use isolated analysis environments/sandboxes.

• Verify hashes when possible.

• Treat exposed files as potentially malicious.

The wider OSINT and open directory community frequently warns about operational security risks associated with random downloads from exposed servers so in big, bold letters, EXERCISE CAUTION.

Additional Tips

Here are a few practical ways investigators improve EyeDex searches:

Search by extension:

pdf

sql

csv

Combine keywords:

company confidential

Search for backups:

backup zip

bak

Search usernames:

jdoe

Search infrastructure terms:

vpn config

Search exposed logs:

access.log

error.log

Search by media type:

Use file group filters to narrow results quickly.

🏁 New CTF Challenge Live - Monaco Suspect

A new CTF challenge has been posted on our CTF website. This week’s challenge involves geolocating the exact location of the Monaco explosion suspect using only a single CCTV image provided as evidence.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Disguised Fuel Convoy” where participants were tasked with locating a blurry video showing Russian occupying forces driving a disguised fuel convoy transporting fuel to Crimea.

Challenge solution WU :

Looking at the video and making regular pauses, we can notice several visual clues.
First of all a crosswalk, if we look closely we can notice the presence of a communication tower and a memorial-style sign.
At the end of the video we can hear the man recording, say that it’s in Kerch (city).

Using overpass turbo and applying filters to search for gas stations near a crosswalk and a communication tower we get a few results.

Comparing all of them with what we see in the video, only one of them matches perfectly when taking a look at sat imagery. The crosswalk is present and matches the video, the memorial-style sign is present too. (45.3397564 / 36.4044172)

Finally the gas station is also present and looking at OpenStreetMap in overpass turbo we can see that the name of the gas station is ATAN, and that the name of the nearest bus station is Дачи.

Overpass Turbo Query:

[out:json][timeout:180];

// Kerch (Kertch)
{{geocodeArea:Kerch}}->.a;

// stations essence
nwr“amenity”=”fuel”->.fuel;

// passages piétons proches des stations
node”highway”=”crossing”->.cross;

// antennes proches des stations
(
node”man_made”=”tower”;
node”tower:type”=”communication”;
)->.ant;

// sortie
(
.fuel;
.cross;
.ant;
);

out center;

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

• What you can uncover from company data

• Where to dig (without finding trouble)

• A clean investigative workflow

• …and how to win, bigly.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Using Generative AI for Sock Puppet Creation and Identification

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

You’re Hired: OSINT and Company Intelligence

Welcome to the boardroom - but you’re not here for the pitch.

You’re going to be playing (if you’re British) Sir Alan Sugar, or (if you’re American) He Who Will Not Be Named. That’s because we’re talking about the business end of OSINT. For this week’s task, you’ll be doing open-source company intelligence.

Lucky for you, you’re not here to judge questionable branding, nonsensical messaging or claims that your new apprentice “tastes success in his spit when he wakes up.” You’re here to find out: Who actually runs this thing? Where does the money flow? What’s going on behind the scenes that the owner would rather keep hidden?

Get it right, and you’ll be raking in the data. Get it wrong, and your investigation will feel a bit like an episode of The Apprentice after all - where you’re the one getting fired.

This issue will teach you:

• What you can uncover from company data

• Where to dig (without finding trouble)

• A clean investigative workflow

• …and how to win, bigly.

What Can a Company Reveal?

Let’s stick to talking about The Apprentice. Think of a company like a task team. It’s one unit on the surface, but underneath, there’s power dynamics, complicated relationships and a whole lot of questionable decisions.

Company Structure

Who’s officially in charge? Companies might claim that it’s one party, but only the OSINT tells the whole truth. Directors, shareholders and incorporation data are your friends.

Leadership Teams

The names listed in filings are real people with histories, often across multiple companies. And some of them are about to look very busy. If somebody’s listed across a vast number of companies, or where they shouldn’t be, you might have your hands on gold dust.

Corporate Relationships

There are many types of companies, and many ways they can connect. Sometimes the ‘company’ you’re looking for is a fragment of something bigger. Some companies turn out to be subsidiaries or shell layers, turning your investigation on its head.

Company OSINT Tools That Actually Work

There aren’t really ‘tools’ in the traditional sense - more like places to look. Still, anything’s a tool if it’s useful enough.

Company Registries

Start with official filings (e.g. Companies House in the UK, SEC filings in the US, or equivalent national registries). Here’s where to find director lists, registered addresses and filing histories.

Financial & Aggregation Sites

Platforms like OpenCorporates and Sayari pull together records across jurisdictions to help you zoom out. Useful when companies start hopping countries or operating through multiple entities. Ask: Who owns what, across borders? Who keeps showing up? Why would they move this way?

Corporate Websites

Yes, really. Of course they’re curated, but “About Us” pages, leadership bios, press releases etcetera are still useful. Especially for confirming roles and timelines against official filings.

A Clean Workflow for Running Your Investigation Like a Winning Task

Time to get structured. It’s your job (pun intended) to investigate a company. Let’s follow an OSINT workflow from beginning to end.

1. Identify Official Registration

Looking for a company? Lock in the legal entity first. You need an exact name (even if it’s not the one you thought), registration number, and jurisdiction. Get these wrong and you’ll be investigating the wrong ‘company’ altogether. Remember Four Seasons Total Landscaping?

2. Map Leadership Roles

On The Apprentice, everyone says they’re a “born leader.” Let’s find out who’s actually in charge. Pull every listed director and office, then start connecting them. Who appears across multiple companies? Who’s moving between roles? What does this suggest in terms of your investigation?

3. Find Subsidiaries or Parent Companies

Trace ownership up and down, as well as side to side. Investigating vertically as well as horizontally can show the loudest brand isn’t always the one with control. Unexpected shell, parent or subsidiary activity is a relatively common find with bigger corps at this stage.

4. Cross-Reference Filings

Compare everything. Names, addresses, timelines, jurisdictions, employee handsomeness.. If multiple entities share the same details, you’ve got a pattern — and hopefully a breakthrough. Visualisation tools like Maltego can really help here

Common Pivot Points

Company → People

Who’s the boss? Directors make great pivots. LinkedIn profiles and previous ventures are great ways to take the investigation personally.

Company → Addresses

Where are they? Shared offices can link entire clusters of companies. Especially useful for spotting shell setups or service-provider hubs.

Company → Partner Organisations

Who are they working with? Suppliers, parent firms or collaborators can expand your map fast.

Final Boardroom Discussions

Your team just won that one. You’re the boss of company OSINT.

Now you should know:

• What you can uncover from company data

• Why you should start with the precise legal entity

• How directors are your bridge to people

• Clear ways to get to the good stuff

If you’ve checked the filings, mapped the players, followed the structure, and tested the story against what’s actually recorded, you’ll get exactly what you need. Here’s to investigations that smell like Success.

Here’s what you’ve been waiting to hear: You’re hired.

See you next week, investigators!

🏁 New CTF Challenge Live - Disguised Fuel Convoy

A new CTF challenge has been posted on our CTF website. This week’s challenge involves identifying a location from a low quality Telegram video and using visual clues to determine the nearby gas station name.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Red Notice” where participants were tasked with investigating the company details of a financial actor who is wanted by INTERPOL under a Red Notice.

Challenge Solution WU :

Searching for the full name, we get a result from pappers.fr. Looking at the public records, we can see the date of registration of the first company that was first is still active until this day, just under that we also find the company name.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

This episode, Jake Creps walks through why public records and government databases deserve more respect than they get, then turns to how generative AI is reshaping the sock puppet game, both for building them and for spotting them.

Highlights:

📁 The Case for Boring OSINT - Why property records, court filings, business registrations, and licensing databases are some of the most reliable anchors in an investigation, and a simple three-step workflow (jurisdiction, search, cross-reference) for getting the most out of them.

🏁 CTF Corner - A look back at “The Scammer” challenge, tracing a phone number’s country and carrier, plus a preview of the newest live challenge: geolocating an intercepted image.

🤖 AI-Generated Sock Puppets - An update on how generative AI has changed sock puppet creation and detection since Jake’s original guide, covering the two paths to building a persona, why degraded image quality can now work in your favor, and how to keep a fabricated identity’s “voice” consistent over time (🔒 paid subscribers).

🕵️ OSINT Tools Roundup - Three new tools from this issue: a threat actor username checker with a clean true/false API, a Venmo OSINT tool for public profile and transaction lookups, and a 2-in-1 username/email scanner covering 240+ platforms.

If you’ve ever rolled your eyes at a government database, this one’s for you, right up until it isn’t.

Links:

• Issue 109: https://osintnewsletter.com/p/109

• Issue 110: https://osintnewsletter.com/p/110

• CTF: https://ctf.osintnewsletter.com/

🚨 It’s becoming increasingly difficult to find OSINT News that isn’t completely AI generated. I’m okay with AI generated summaries or blurbs but entire articles written by AI are trash. I’m unsure if the OSINT News section will persist; it may be reduced to 2 topics instead of 3. Thank you to the writers who remain authentic and produce original content.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Why Boring is Better: OSINT on Public Records & Government Databases

Let’s get started. ⬇️

OSINT News

📰 OSINT Field Notes #9: Nothing Was Really Hidden

The newsletter shows how OSINT researchers use public data and metadata to uncover hidden information tied to conflict, propaganda, and surveillance.

🎩 H/T: Benjamin Strick

Read on OSINT Field Notes…

📰 Heading Off: New Technique Helps Track Grain Smuggling Expansion to Libya

The investigation uses OSINT, satellite imagery, and AIS data to track a suspected Russian ship moving stolen Ukrainian grain from Crimea to Libya, revealing sanctions evasion despite GPS spoofing.

🎩 H/T: Bellingcat Investigation Team

Read on Bellingcat…

OSINT Tools

🔎 Threat Actor Username Search

This tool allows you to check if a username is associated with a threat actor. It’s not a username search, like you’re used to with Sherlock, it’s a true/false result. They also have an API. I love this idea.

Web App

🎩 H/T: CTI Updates

🔎 Venmo OSINT Tool

Venmo OSINT is a tool for searching public Venmo profiles and transactions, with lookup, search, and export features.

GitHub

🎩 H/T: Dennis Keefe

🔎 User Scanner

A 2-in-1 OSINT tool for email and username intelligence that scans 240+ platforms to map digital footprints, check account registrations, extract profile data, and export results, with bulk scanning, proxy rotation, and breach intelligence integration.

GitHub

🎩 H/T: kaifcodec

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Using Generative AI for Sock Puppet Creation and Identification

• Generative AI has come a long way when it comes to making photo-realistic content. In this issue, I’ll show you some methods you can use to create sock puppet accounts that appear more legitimate, giving you more options in your investigations; alternatively, it’ll give you the tools to identify sock puppet accounts created using similar methods.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

• Which data is easiest to find this way

• Why jurisdictions matter if you want to stay on track

• How the right workflow can make any OSINT fun

• …and why real life isn’t the X-Files.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Codifying Open Source Intelligence Methodology with AI

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

Why Boring is Better: OSINT on Public Records & Government Databases

Public records have a reputation problem. Namely, they’re boring.

A government database doesn’t have the fast-moving, high-noise chaos factor of social media. No avatars, hot takes, or late night posting sprees about that jerk Stephen Colbert. Instead, you’re working with PDFs, registries and forms that look like they were last accessed in 2002. It’s enough to bore an investigator to sleep.

Sure, this isn’t OSINT that screams “start here” - but that’s precisely the point. Public records are unchanging and largely unnoticed, and that makes them some of the most reliable anchors out there. You can spend hours chasing a username that leads nowhere, or watch an account or post vanish mid-investigation when OP decides it’s too cringe to bear. But once a public record’s recorded, it sticks, and it won’t have moved in years - no matter how toe-curling.

Sometimes, with OSINT, boring is better.

This issue will cover:

• What you can get from public records and government databases

• Where to start without getting lost in endless registries

• A fun, repeatable OSINT workflow for even the dullest investigations

• …and why Trump’s tweets are actually relevant here.

Just resting your eyes, right? Let’s get started.

What Counts as a Public Record?

Think less X-Files, more just… Files.

Put simply: public records are any documents created, filed, or maintained by government bodies as part of official processes. They’re usually verifiable, real-world data that maps activity in the real world, such as:

Property Records

The least exciting documents that answer the most useful question: where someone actually lives (or lived). Property records show the ownership of a house, land or business, alongside purchase history, co-owners, and addresses.

Court Records

If something serious went down, it probably ended up here. Court records cover disputes, and charges, adding the context, timelines, and connections you definitely won’t find on someone’s carefully curated online presence. In Florida, for example, arrests are a matter of public record under specific rules - blessing the world with Florida Man.

Business Registrations

Follow the companies, find the employees (or bosses). Business records list directors, shareholders, and addresses for premises. They’re perfect for mapping who’s connected to what - especially for financial investigations, or if you’re looking to verify the wild claims on a subject’s LinkedIn.

Licensing Databases

Speaking of verification, these can prove if someone is (or isn’t) what they claim to be. Licensing records cut through inflated bios with something much less exciting: the truth.

Depending on the jurisdiction, they can confirm occupations, qualifications, certifications, and sometimes disciplinary actions in sectors like healthcare, law, construction, or transport.

Beginner Tools for Digging Government Dirt

Don’t try to play The Lone Gunmen straight off the bat. Start simple, with official sources.

The beginner-friendly following will get you direct access to structured, government-held data for OSINT investigations that get results. No Mulder and Scully shenanigans required.

Government Open-Data Portals

Pros: Great for quick wins without advanced tooling.

Cons: Easy to get lost.

The official hubs of “we’ll just leave this here”. Governments publish datasets on everything. Property, crime, spending, infrastructure - they all get dumped here in searchable, downloadable, and surprisingly underused form.

County/State Record Search Tools

Pros: Solid and often the fastest way to anchor an investigation in reality.

Cons: Interfaces from hell.

If this type of OSINT could get any less glamorous, it just did. On a local level, registries for property, courts, or business filings usually let you search by name, address, or company. Interfaces can be clunky (and ugly as sin), but the data can be beautiful.

A Boredom-Busting Investigation Workflow

Let’s demonstrate why OSINT looks good in beige. Follow these steps for a high hit-rate:

1. Identify the Jurisdiction

   Start by figuring out where the records you need live. Rules governing database access can vary quite randomly by country, state, or even county. Get the jurisdiction wrong and you’ll either get locked out, or waste time combing through the wrong (potentially frustrating) system. Get it right and your search becomes far faster, and far less painful.

2. Search

   Once you’ve got the jurisdiction, search. Search names, companies, or addresses directly in official databases. Search, search, search. Don’t overthink it. It’s that easy.

3. Cross-Reference

   One record is a clue, but four that match is a jackpot. Always cross-check names, addresses, dates, and associates across different databases to validate what you’re seeing; this is important, real-world data, so mistakes can cost you big.

That’s it. You should have found what you’re looking for… and you’re still awake!

What You Can Learn From Public Record OSINT

Public records can help you find the following:

Ownership Ties

If you find out who owns what, and who they own it with, you can identify a subject’s partners in both business and life. It’s common to discover hidden relationships like family ties that aren’t visible elsewhere online through ownership records.

Business Relationships

Company filings can help trace networks of influence. Look for repeat partnerships, for example, or the same names in operation across multiple businesses. Structures are the thing to look for here.

Legal History

If there’s disputes, criminal charges, civil cases, financial issues… These can act as great behavioural context, showing patterns over time that help to strengthen your overall investigation.

Key Takeaways

See? Public records and government databases aren’t that painful. Sure, it’s all very static. This OSINT just sits still, being true. While everything else moves (and generates the excitement that comes with it), records don’t - but that’s exactly why they’re priceless.

You should now know:

• Which data is easiest to find this way

• Why jurisdictions matter if you want to stay on track

• How the right workflow can make any OSINT fun

• …and why real life isn’t the X-Files.

Still wondering why Trump’s tweets were relevant in this article? The answer: they’re a matter of public record. The US National Archives has all of them on a database, free to browse. Yes, all of them. Even covfefe. What OSINT value one could gain from an AI President dancing with the Cracker Barrel Man is unclear, but it’s there.

Maybe we need Mulder and Scully on it after all.

🏁 New CTF Challenge Live - Secret Meeting

A new CTF challenge has been posted on our CTF website. This week’s challenge involves geolocating an image that has been intercepted by a counter intelligence agency.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “The Scammer” where participants were tasked with conducting an investigation on a phone number linked to a suspected scammer, in order to find the country and the phone operator associated to it.

Searching for the country code +91, we can see that it belongs to India.
Using https://www.emobiletracker.com/trace-process.php, we can see that the operator is Reliance Jio.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Tools, tactics, and fresh investigations expanding the open-source intelligence toolkit.

Some of the best OSINT pivots start with the things people forget about. A phone number that has quietly followed someone across a decade of accounts. A methodology buried in a blog post that could be running in the background of every future investigation.

This episode covers Issues 107 and 108 of The OSINT Newsletter and explores two sides of how modern investigators get more out of what they already have: squeezing real intelligence out of the most overlooked data point in the toolkit, and turning the methodology in your head (and other people’s heads) into something an AI agent can run on your behalf.

In Episode 19 of The OSINT Podcast, host Jake Creps starts with Issue 107 and one of the most underrated data points in the toolkit: the phone number. He walks through what intelligence actually comes from a number, where to check first without overcomplicating it, and a clean five-step workflow from standardising the format through to pivoting outward into the wider account network. He covers the platforms worth checking (WhatsApp, Telegram, Signal, Truecaller, Sync.ME), the carrier and HLR lookups that ground a number geographically, and the high-value pivots, usernames, social accounts, and breach data, that turn a single number into a network. He closes with how to handle disposable numbers and burner tactics, where the absence of data is itself a signal.

Highlights include:

📞 What a Phone Number Actually Tells You – geographic origin, platform presence, and identity fragments hiding in plain sight.

🧭 The Five-Step Workflow – from standardising the format to pivoting outward, a clean methodology for running phone number OSINT without skipping steps.

🔥 Burner Logic – why disposable numbers are not a dead end, and how patterns of behaviour and gaps in data become signals in their own right.

🤖 Codifying Methodology – discovering methods worth codifying with a Google Dork, turning them into local markdown, and chaining skills together into a continuous discovery engine.

🔗 A Worked Investigation – running /username through Sherlock, pivoting into /person-search on nxthacker99, and producing a full subject profile assessment with named intelligence gaps.

Whether the investigation starts with a single phone number or a methodology lifted from someone else’s blog post, Episode 19 is about getting more out of the OSINT you already have in front of you.

References

• OSINT Newsletter – Issue 107

• OSINT Newsletter – Issue 108

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Call Data: OSINT on Phone Numbers

Let’s get started. ⬇️

OSINT News

📰 How To Investigate A Person Of Interest In 2026

An advanced guide on person search built for the year 2026. It includes tools, tactics, and techniques using available methodology. You can use this guide to build a Claude skill and augment it with your own methods.

Read on Medium…

🎩 H/T: Precious Vincent

📰 Inside Modern OSINT: Detecting Disinformation, Tools of the Trade, and the Ethics That Shape It

An OSINT guide on tracking coordinated disinformation through timing patterns, account behavior, and cross-platform signals, using verification tools like image search, geolocation, and archives, while considering privacy risks and ethical challenges in open-source investigation.

Read on Impact Grid…

🎩 H/T: Zoya Baig

📰 Signals in the Noise: Open Source Intelligence (OSINT) for AI Loss of Control Detection

An advanced OSINT/CTI framework for detecting AI loss of control. It maps threat models, observable traces like user transcripts and inference choke points, plus monitoring techniques using available methodology.

Read the paper…

OSINT Tools

🔎 OpenOSINT

OpenOSINT is an open-source OSINT framework for collecting, organizing, and analyzing publicly available data to support investigations, combining automation tools and modular workflows for reconnaissance, data gathering, and information analysis.

GitHub

🎩 H/T: Tommaso Bertocchi

🔎 Open Graph Intel (OGI)

OGI is an OSINT-focused tool for visualizing and analyzing connections in data, helping map relationships between entities, sources, and signals to support investigative workflows and structured analysis of information networks.

Web App

🎩 H/T: khashashin

🔎 Anthropic Courses

Anthropic’s learning hub is a training platform providing structured courses on using Claude, AI workflows, and developer topics, with lessons, quizzes, progress tracking, and certificates for completion.

Anthropic Academy

🏁 New CTF Challenge Live - The Scammer

A new CTF challenge has been posted on our CTF website. This week’s challenge involves

conducting an investigation on a phone number linked to a suspected scammer.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Last Order” where participants were tasked with finding a restaurant’s location, and the dish that a suspect had ordered.

Challenge Solution WU :

Using a reverse image search on the provided cctv image, we find a match showing a restaurant called Amor Gastronomia in London on TheFork.

By checking the restaurant’s official website, the address is listed in the footer as Halloway Road 139.

Finally, reviewing the restaurant’s London menu, the most expensive signature pasta dish appears to be TAGLIOLINI AL TARTUFO.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Codifying Open Source Intelligence Methodology with AI

• There are dozens if not hundreds of methods for open source intelligence collection, analysis, and dissemination. Everyone has a different process, too. In this issue, I’m going to show you how you can create a repository of methodology that you can use to instruct your AI of choice to automate.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year. I’ll start with How To Investigate A Person Of Interest In 2026 from the OSINT news section.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

• What intelligence comes from a phone number

• Where to check first (without overcomplicating it)

• A clean workflow for investigations

• …and why it’s not worth changing your name to Spiderman.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Creating Claude Skills for Open Source Intelligence

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

Call Data: OSINT on Phone Numbers

Phone numbers sit in a strange place in OSINT. They’re near-ubiquitous and tied to everything, but as a result very easy to overlook. Unlike usernames (which can change) or email addresses (easy to create), numbers tend to stick. They follow people across platforms, accounts, years of activity, and even States. Surprisingly few people want the hassle of learning a new number, even when they get a new phone.

You might create a new Gmail, and change your username (or legal name) to Baron Venom Balrog Sabretooth Vader Megatron Vegeta Robotnik Magneto Bison Sephiroth Lex Luthor Skeletor Joker Grind, but your phone number is mostly static. This persistence makes phone numbers one of the most reliable anchors you can work with for OSINT.

Sometimes OSINT is just a number. This issue will teach you:

• What intelligence comes from a phone number

• Where to check first (without overcomplicating it)

• A clean workflow for investigations

• …and why it’s not worth changing your name to Spiderman.

Calling Baron Grind…

What Can Phone Number OSINT Uncover?

The infrastructure of phone numbers is key to what you can get out of them through OSINT. Every number is tied to a telecom system, to a region, and only then to a web of online accounts. That means even before you get into deeper online OSINT, there are three immediate layers of value:

Geographic Origin

Country codes (+1, +44, +91, etc.) are GeoINT in themselves. These one or two nifty numbers instantly place a phone’s owner at a national level. If you can find out carrier data, you can narrow a rough operating region even further. At the very least, you can find out if your target’s in the US or Uzbekistan.

Platform Presence

Many platforms use phone numbers as their backbone identifier. If a number is registered on apps like WhatsApp or Telegram, you may be able to view profile photos, usernames, or activity signals just by knowing the right digits.

Identity Fragments

Even before the real OSINT starts, people litter the world with identity fragments - by reusing their static phone number. Old listings, forgotten profiles, or scraped datasets can quietly connect multiple pieces together.

Some Phone OSINT Tools That Actually Work

You don’t need a complex stack to begin phone OSINT. That’s what makes phone numbers such a universally popular data point. In fact, the most effective tools and methods are often at your fingertips.

Caller ID Platforms

Sync.ME, NumLookup, and That’s Them scan public records and user-contributed data, drawing on that to see if a number’s been identified before. Results can be inconsistent, so treat them as leads not gospel. If multiple sources align, then they’re worth your attention.

Checking the Apps

Here’s an old OSINT trick. Save the number as a contact, then check WhatsApp, Telegram, or Signal. Adding a contact will reveal a profile photo and status - Telegram will even expose a username.

Caller ID Platforms

Truecaller, Hiya, and CallApp use crowdsourced data, so again, cross-reference. Patterns across multiple platforms mean something.

Finding Carrier Data

If you know nothing about the carrier, services like Numverify, Twilio Lookup, or other free HLR lookup tools can help identify the telecom provider and line type (mobile, VoIP, or landline). Cross-check as always.

Getting Started: A Clean Workflow (Don’t Skip Steps)

Investigating a number… That’s easy, right? Think you can improvise? Don’t. A structured approach will always get better results.

Give this workflow a try:

1. Standardize the Format

Always convert to international format. Tools and platforms require international format numbers and inconsistencies will cost you results. What’s more, country codes aren’t data you want to ignore.

2. Location, Location, Location

Use that country code. Combine with any carrier info to ground your investigation geographically; when you’re stratifying your findings later, you’ll be glad you did.

3. Check for Live Accounts

Run the number through message platforms. You’re looking for anything visible on Telegram or WhatsApp: images, usernames, timestamps etc.

4. Look for Repetition

Search the number directly. Then try variations, like with or without spaces. Reuse is what you’re hunting for.

5. Pivot and Expand

Got a hit? Pivot outward. Search that identifier (a username, profile, email or listing). Start building out the wider account network.

…And just like that, you’re doing phone number OSINT.

What Counts As a High-Value Pivot?

You might be wondering which leads are strong enough to take that fifth step. The real value comes from the following data points:

→ Usernames
If you see the same username twice, that’s your bridge into wider platform analysis; especially if the username is conspicuously unusual or unique. There’s unlikely to be two people choosing Baron_V_B_S_V_M_V_R_M_B… (You get the picture).

→ Social Accounts
If a number was required to sign up, some platforms expose profiles directly. Others reveal connections indirectly. Either way, a linked social account is OSINT gold.

→ Breach Data
If the number appears in leaked datasets or on HaveIBeenPwned, it can link to emails, credentials, and historic activity. As always, be careful working with data that comes from an inherently sketchy source.

Feel the Burn: Disposable Numbers & Evasion Tactics

OSINT investigators chasing fraud, spam networks, or illicit activity face up to a unique challenge. Phone number stability is usually the USP here. What if the number you’re looking for is temporary by design?

Burner phone numbers get spun up quickly, used briefly, and abandoned just as fast. The aim is to get a phone number, get what you need from it, and THROW IT ON THE GROUND. The point of virtual numbers, VoIP services, and burner SIMs is to create numbers and accounts without tying them to a long-term, real identity - the very thing that makes phone number OSINT so easy.

So, change of tactics. Look for patterns of behaviour, not long-term reuse. VoIP numbers, for example, might cluster around specific services or regions, or repeatedly appear attached to similar types of accounts or listings. That would signal the same person, exhibiting the same behavior over and over again.

Gaps are a biggie too: no reverse lookup data, no caller ID history, and limited presence across platforms are absences that constitute a signal in themselves.

If a number looks “empty”, don’t assume it’s useless. It may just be designed that way.

Key Takeaways

Phone number OSINT works because numbers are mostly static and stable things. You can change your email, your socials, or even your name, but most people are lazy with their phones. And unlike physical addresses or Social Security numbers, people hand out their phone numbers like candy.

You should know:

• One number won’t tell you everything, but it might tell you where to look next

• Use simple methods before complex ones

• Follow number reuse and patterns

• Build outward: number → account → network

…and when you change your name to Emperor Spiderman Gandalf Wolverine Skywalker Optimus Prime Goku Sonic Xavier Ryu Cloud Superman HeMan Batman Thrash in witness protection, maybe change your number.

Until next time, investigators!

🏁 New CTF Challenge Live - Last Order

A new CTF challenge has been posted on our CTF website. This week’s challenge involves analyzing surveillance footage from a blurred traffic camera frame to identify a suspect’s location. Investigators believe the suspect entered a highly rated restaurant, ordered its most expensive signature pasta dish, and left in a hurry. Your task is to determine the restaurant, its exact address, and the specific pasta dish ordered.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “The Dark Web Hacker” where participants were tasked with finding a hacker’s specific email address linked to a specific hacking forum.

Challenge Solution WU :

Knowing that the username had been reused across multiple forums and appeared in several data breaches, we searched for the username “sarkstic” on breach.vip. This led us to a World of Warcraft forum account on OwnedCore, along with the email address associated with it: dreadfuleyes@yahoo.com

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

This episode covers Issues 105 and 106 of The OSINT Newsletter and explores two very different sides of modern investigations: going deeper into the Dark Web for intelligence, and using AI to automate the repeatable parts of your workflow.

In Episode 18 of The OSINT Podcast, host Jake Creps picks up where Part One left off and takes investigators further into Dark Web intelligence - or DARKINT. He recaps the layered structure of the surface, deep, and dark web, then digs into the beginner toolkit: onion browsers, hidden services, public leak indexes, and onion search engines. Jake walks through a practical methodology for tracing identifiers - emails, usernames, and phone numbers - from breach data on the Dark Web back up to the surface, and explains how to correlate and validate findings without falling for false positives.

He also pulls no punches on the limitations. DARKINT is an adversarial, high-risk environment full of manipulated datasets, unverifiable attribution, and content that can stay with an investigator long after the browser is closed. The episode covers the compliance considerations of handling breached data and the psychological risks of working in this space - and why both deserve serious thought before diving in.

From there, the episode shifts to something brand new: building Claude Skills for OSINT. Jake explains what Claude Skills are - reusable, plain-language instruction sets that turn AI into a reliable part of your investigative workflow - and walks step-by-step through creating one for username search. No code required. He covers picking the right workflow to automate, writing the skill itself, testing it inside Claude Code with Sherlock, and refining it with simple natural-language tweaks.

The episode closes with a look at how to supercharge an OSINT skill: instructing Claude to pivot on its own findings, find new tools when collection hits a wall, and fall back to manual methods when scripts fail. It is a glimpse of what investigative automation actually looks like when AI stops being a novelty and starts doing real work alongside the analyst.

Highlights include:

🧅 DARKINT Toolkit – onion browsers, hidden services, leak indexes, and onion search engines explained for beginners curious about web spelunking.

🔗 Surface-Bound Pivots – a step-by-step methodology for tracing emails, usernames, and phone numbers from breach data back to the surface web.

⚠️ The Monsters Under The Bed – the real limitations of DARKINT, from manipulated datasets and unverifiable attribution to the psychological toll of the work.

🤖 Building Claude Skills – how to turn a repeatable OSINT workflow into a reusable Claude Skill, with a full walkthrough of automating a username search using Sherlock.

🚀 Supercharging Automation – instructing Claude to pivot on its findings, hunt for new tools, and fall back to manual methods when scripts come up short.

Whether the data is hiding in the dark or waiting to be unlocked by the right set of instructions, Episode 18 shows how modern investigators are reaching both.

References

• OSINT Newsletter – Issue 105

• OSINT Newsletter – Issue 106

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ OSINT and the Dark Web: Part Two

Let’s get started. ⬇️

OSINT News

📰 What happens when agentic AI meets intelligence analysis?

Agentic AI, Maltego MCP servers, conflict monitoring, and self-hosted intel platforms are opening up new possibilities for OSINT, but the tools only matter if the analyst knows how to turn information into intelligence.

🎩 H/T: Aaron Roberts

Read on LinkedIn…

📰 Vibe Coding Is Becoming an OSINT Risk

AI is making it easier to build and adopt OSINT tools, but the real risk starts when investigators trust software they do not fully understand to shape analysis, workflows, and operational decisions.

Read on DutchOSINTGuy…

🎩 H/T: Niko Dekens

📰 Turn Off ChatGPT’s New Ad Tracking

ChatGPT’s free tier is now opt-in to ad tracking and data sharing by default, linking user activity to marketing systems unless you actively turn it off in settings.

Read on Tate’s Online Safety Community…

🎩 H/T: Tate Jarrow

OSINT Tools

🔎 BamQam

A new OSINT-style dashboard that aggregates live geopolitical and military data into a map-based intelligence feed, with unclear provenance and trust level.

Web App

🔎 DrishX

A satellite-powered freight intelligence tool that uses open-source orbital imagery to detect and analyze logistics movement patterns like vehicle flow for OSINT-style monitoring and trend analysis.

GitHub

🎩 H/T: Sairaj Balaji

🔎 claude-osint

An OSINT automation framework built on Claude that structures investigative workflows for research and intelligence tasks.

GitHub

🎩 H/T: Sachin Sharma

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Creating Claude Skills for Open Source Intelligence

• Claude Skills allow you to automate a significant portion of your workflow using very specific instructions. In this issue, I’m going to show you how you can fully automate a username search, including pivoting to additional methods based on findings, all with a single request from Claude.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more

• The tools you need to know

• Strategies and limitations

• Following data to the surface

• …and how to fight the monsters under the Internet’s bed.

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ Gathering OSINT from Live Traffic: Datasets and Cameras

🎙️ If you prefer to listen, here’s a link to the podcast instead.

Let’s get started. ⬇️

OSINT and the Dark Web: Part Two

Welcome (back) to the dark side. We have OSINT.

Although it looks dangerous, DARKInt it’s perfectly safe if you know how - and if you read last week’s issue, you probably do. Without further introduction, let’s go even deeper into Dark Web OSINT.

In Part Two, we’ll cover:

• The tools you need to know

• Strategies and limitations

• Following data to the surface

• …and how to fight the monsters under the Internet’s bed.

Don’t forget your flashlight.

Recap: What is the Dark Web?

If the internet is an iceberg, it has three layers: the surface, deep, and dark web.

• Surface Web: The normie ”internet”. Indexed by search engines like Google and Bing.

• Deep Web: The “invisible” 90% of the web you don’t need a specific tool to access. Online banking, private networks, and corporate systems live here.

• Dark Web: The unindexed 1-6% of the web, only accessible via specialised tools. Always anonymised, always encrypted.

What you find in this dark bottom layer - open-source or not - is dark web intelligence. So, think of Dark Web intelligence (or DARKINT) as OSINT’s emo little brother. Got it? Good.

A Beginner’s Guide to DARKInt Tools

To access the Dark Web, specific tools are required. Here’s a conceptual run-down of the best tools for beginners curious about traversing the depths. Of course, this overview is intended for educational purposes only, rather than encouraging active exploration as soon as possible - it’s best to think before you leap.

Browsers Are Like Onions

TOR is the most (in)famous of the bunch. Short for The Onion Router, TOR is too complex to unpack fully here. What’s more, we already did that last week.

Basically, onion browsers work by routing your connection through multiple encrypted layers - a bit like an onion - so no single point can trace your activity. The Dark Web’s sites then use .onion domains; “hidden services,” where both user and host are obscured. Instead of connecting directly, both sides layer up encrypted links via a shared rendezvous point on the TOR network, so nobody knows anybody else’s true IP This creates the built-in anonymity which makes the Dark Web so popular, keeping everything… under wraps (sorry).

Where’s The Leak?

We know one of the most common forms of DARKInt comes in the form of the humble data breach. Public leak indexes are one of the most beginner-friendly entry points into DARKInt, as they point users to large collections of said breached data.

Unlike raw breach dumps (a.k.a. the actual compromised data) leak indexes are designed for search and discovery, and act as directories or lookup tools, rather than hosting any data directly. They’re finding where data exists, and how it connects across leaks. Although datasets are traded, reused or repackaged across multiple Dark Web platforms, indexes can often find specific data whether it’s circulating across the Dark Web or in the wider web bloodstream beyond.

The usual caveats about breached data apply. There’s always a compliance problem when handling potentially stolen data, so treat any data you find as if it were your own.

Search Engines Are Like Onions Too.

These aren’t the Dark Web Google. If TOR is your vehicle into the Dark Web, onion search engines are more like a slightly unreliable sat-nav; this Garmin won’t get you there, but it might point you in the right direction. These tools don’t provide access to anything. Instead, they index and surface .onion sites, helping users discover hidden services they might not know about. Onion search engines:

• Index .onion domains and hidden services

• Enable keyword-based discovery (once you’re already using TOR)

Unlike TOR browsers (which actually connect you to sites) onion search engines sit a layer above like the onion’s outer skin, acting as discovery tools rather than access tools. And because the Dark Web is so transient (sites appear, disappear, or hide deliberately), these engines are best thought of as more treasure hunt than Google search. The coverage on the aforementioned Garmin is patchy, unstable, and often outdated. Still, it works when it doesn’t drive you into a lake - or an active volcano.

Tracing An Account Back to the Surface, Step-By-Step.

1. Use the tools above (indexes, search engines) to identify breaches.

2. Extract identifiers (email, username, phone number) from DARKINT sources.

   • You’ll need a Tor browser to access them.

3. Pivot using emails.

• Identify email accounts, recovery emails, and profiles just as you would as normal.

4. Look for usernames.

• Do the same for usernames - especially look for reuse across social media, forums, or gaming sites.

• Look for variations, and cross-reference matches as in light-mode OSINT.

5. Pivot using phone numbers.

• Investigate links to messaging apps, listings, or leaked records that use breached phone numbers.

6. Correlate findings.

• Always combine multiple data points to strengthen attribution.

Lastly… Validate carefully.

• Watch out for false positives, outdated, or manipulated data - on the Dark Web, these are all over the place

Key Limitations on DARKInt

If these two guides have made the dark, dirty web sound all sunshine and rainbows, now is the time to crush your dreams. There’s no unicorns skipping around down there. DARKInt has limitations, and plenty of them. Let’s meet the monsters under the Internet’s bed.

A High Risk Environment

Imagine a world where everybody hates each other. That’s kinda the Dark Web. DARKInt operates within an anonymised, adversarial ecosystem built to keep its infrastructure volatile, and access inconsistent. Elevated operational security risks are baked-in. Hidden services frequently appear and disappear, and interacting with them can expose investigators to threat just by virtue (or vice) of a click. Tread carefully.

False-Data Scam-O-Rama

Data quality is ‘highly unreliable’ to be polite. Breach dumps are often annoyingly duplicated, hopelessly outdated, trickily manipulated, or deliberately seeded with false facts. Financially motivated actors frequently distribute misleading datasets. At worst, you might end up involved in a particularly icky scam. At best, the overall signal-to-noise ratio can reach a hair-tearing level. Be patient.

Not Everything is Verifiable

So you have that ‘highly unreliable’ data. It might never become reliable. Attribution and validation are inherently limited on the Dark Web, where anonymisation layers and restricted visibility are the whole point. So much activity occurs behind closed doors - in closed networks or private exchanges - that datasets can’t always be corroborated or independently verified (outside of our dreams). Manage your expectations.

Seeing Things You Can’t Unsee

If you work recklessly in DARKInt, you’re playing psychological Russian roulette. You may encounter material that is disturbing, illegal, or just deeply distressing; content that stays with you long after you’ve closed TOR. When people are anonymous, they showcase the worst things humanity can do to each other. Even if you do everything right, you can end up seeing something deeply wrong. Have caution.

Key Takeaways

Our journey through the Web’s dark side is coming to an end. You should now know:

• All DARKINT is OSINT, but not all OSINT is DARKINT

• The tools beginners need to go web spelunking

• How to bring dark data into the light

• … and why the Dark Web isn’t where the unicorns live.

See you next issue, investigators!

🏁 New CTF Challenge Live - Covert Communication

A new CTF challenge has been posted on our CTF website. This week’s challenge involves analyzing a covert communications channel used by a suspected intelligence operative and finding the name of the location.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “The Dark Web DB” required participants to investigate a suspected data breach involving Quick, where a threat actor allegedly published a customer database on the dark web and uncover key details about the publication.

To solve the challenge, we need:

1. Copy & paste the onion link into Wayback Machine.

2. Then we filter the results by date and select 06 March of 2026. We get a result for 06 March 2026 at 08:01:04.

3. We click on it, looking at the forum, on the right corner, we can see a post regarding a french and Belgian database.

4. It says that it was published 10 mins ago, we can also see the username of the threat actor who published it, which is: sarkstic.

5. Knowing that the forum was crawled at 08:01:04 and that the post says 10 mins ago, the post was made at 07:51:04.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry. There’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

This episode covers Issues 103 and 104 of The OSINT Newsletter and focuses on two distinct but complementary areas: understanding the Dark Web as an intelligence source, and using live traffic data and cameras to build real-time situational awareness.

In Episode 17 of The OSINT Podcast, host Jake Creps opens with a foundational primer on Dark Web intelligence - or DARKINT. He breaks down the difference between the surface, deep, and dark web, explains how onion browsers and hidden services work, and outlines what investigators are likely to encounter when they go looking: breach dumps, criminal forums, paste sites, and shared credentials.

Jake covers the key distinction between OSINT and DARKINT - all DARKINT is OSINT, but not all OSINT is DARKINT - and explains why investigators combine both to build a complete picture of a target. He also addresses the compliance considerations that come with handling data sourced from the shadowy side of the net.

The episode then shifts to something more grounded - literally. Jake walks through how live traffic data can be used to gain situational awareness around a specific location or event. Starting with familiar tools like Google Maps and Waze, he explains how investigators can layer incident data, traffic flow, and police sightings before moving into more technical territory: the MapQuest Traffic API, the unofficial Waze API, and how to fuse multiple data sources into a single, custom solution.

From there, Jake covers live traffic camera feeds - manual methods via Department of Transportation sites, and API-based options like Road511 and Vizzion that allow investigators to build scalable, multi-location monitoring pipelines. The episode closes with a look at an unexpected bonus data source: rideshare apps, and the real-time vehicle location data sitting inside their public-facing interfaces.

Highlights include:

🧅 Dark Web 101 – surface, deep, and dark web explained, how onion browsers and hidden services work, and why Dark Web users are like ogres.

🕵️ DARKINT Data Types – breach dumps, criminal forums, paste sites, and what each means for an OSINT investigation.

🚦 Live Traffic Intelligence – using Google Maps, Waze, MapQuest API, and the unofficial Waze API to monitor incidents, road closures, and traffic flow in areas of interest.

📹 Traffic Camera Feeds – how to aggregate live camera feeds manually and at scale using Road511, Vizzion, and scraping methods.

The best investigators know how to follow the data wherever it leads - even into the dark, or down the road. Episode 17 shows you how to do both.

References

• OSINT Newsletter – Issue 103

• OSINT Newsletter – Issue 104

🪃 If you missed the last newsletter, here’s a link to catch up.

⚡ OSINT and the Dark Web: Part One

Let’s get started. ⬇️

OSINT News

📰 3 Basic but Overlooked Intelligence Analysis Techniques

Plot it on a map, lay it out over time, or group it by theme. Simple moves that surface patterns, gaps, and what matters without collecting anything new.

Read on LinkedIn…

🎩 H/T: Paul Prouse

📰 Mining China’s ‘Little Red Book’ for Open Source Gold

A breakdown of how Xiaohongshu can be used for investigations, from diaspora activity to censorship patterns, plus practical tips for search, language, and preserving content before it disappears.

Read on Bellingcat…

🎩 H/T: Chu Yang

📰 Hundreds of Fake Pro-Trump Avatars Emerge on Social Media

An investigation finds networks of AI-generated avatars posting pro-Trump content across major platforms, blending spam, engagement farming, and political messaging at scale.

Read on The New York Times… | No Paywall

🎩 H/T: Tiffany Hsu

OSINT Tools

🔎 CoJournalist

coJournalist lets reporters deploy AI “scouts” to track pages, social accounts, and public records, then distills updates into structured, cite-ready leads.

Web App

🎩 H/T: Tom Vaillan

🔎 Snapchat Bitmoji History

A simple tool that pulls past Bitmoji versions from a Snap profile and displays them in one place, building on earlier research and tooling.

Bookmarklet

🎩 H/T: Micah Hoffman

🔎 ImageWhisperer

ImageWhisperer analyzes uploaded media for AI generation and manipulation signals, producing a single verdict with evidence across multiple detection models.

Web App

🎩 H/T: Henk Van Ess

🏁 New CTF Challenge Live - The Dark Web DB

A new CTF challenge has been posted on our CTF website. This week’s challenge involves identifying a threat actor who published a database allegedly belonging to a French and Belgian fast-food chain “Quick” on the Dark Web. Your objective is to find the actor’s username and determine the exact timestamp of the original publication.

Start competing in our Capture the Flag (CTF)

🪃 If you missed the last CTF, here’s a link to catch up.

Last week’s CTF challenge featured a challenge titled “Crowd Control” where participants needed to estimate the number of people present in an auditorium by using a specific AI tool available publicly.

✅ That’s it for the free version of The OSINT Newsletter. Consider upgrading to a paid subscription to support this publication and independent research.

By upgrading to paid, you’ll get access to the following:

⚡ Gathering OSINT from Live Traffic: Datasets and Cameras

• Traffic datasets and live cameras give you situational awareness into areas of interest for an investigation. Whether it’s business continuity, executive protection, global travel, or something niche, this issue breaks down the options available to you in an actionable plan.

👀 All paid posts in the archive. Go back and see what you’ve missed!

🚀 If you don’t have a paid subscription already, don’t worry there’s a 7-day free trial. If you like what you’re reading, upgrade your subscription. If you can’t, I totally understand. Be on the lookout for promotions throughout the year.

🚨 The OSINT Newsletter offers a free premium subscription to all members of law enforcement. To upgrade your subscription, please reach out to LEA@osint.news from your official law enforcement email address.

Read more