OSINT methodology, forensic reference material, and practitioner briefings.
Built for investigative journalists, practitioners, and verification desks. Training and consultancy available on request.
Latest publication.
The most recent story from the desks.
Tor network fundamentals for dark web investigators.
Access .onion services, document sessions to chain-of-custody standard and identify deanonymisation vectors.
Reverse image search triage: finding the original source
AI in OSINT
When reverse image search returns a dozen results, an AI prompt ranks
them by provenance and names the forensic query to run first.
12 Aug
›
Website infrastructure analysis: WHOIS, DNS and SSL
Methods
Map the technical ownership, hosting history and certificate chain of any
website using open registrar and infrastructure data.
17 Aug
›
Geolocate, fingerprint and attribute IP infrastructure
OSINT Cards
Map an IP to its ASN, fingerprint open ports via Shodan and Censys, and
pivot on passive DNS to document every lookup step in the case file.
18 Aug
›
Archive recovery: deleted and ephemeral content
Methods
Retrieve deleted web pages, vanished social posts and ephemeral content
using Wayback Machine, cached sources and specialist recovery tools.
24 Aug
›
Social media evidence preservation for investigators
OSINT Cards
Capture, hash and archive platform content with Hunchly and Wayback
Machine before takedown removes it from the record.
25 Aug
›
OSINT Guides.
One topic worked start to finish, from first source to finished file.
Kali Linux for OSINT: setup and toolchain.
Configure theHarvester, Recon-ng, SpiderFoot and Maltego inside one disposable investigation environment, ready to tear down after each case.
SpiderFoot OSINT: automated reconnaissance scanning.
Run a target through more than two hundred data source modules and read the correlation graph SpiderFoot returns, rather than checking each source by hand.
Discord OSINT: resolving user IDs and verifying server activity.
Decode Discord's snowflake IDs to confirm account creation dates and verify server activity before content disappears.
Instagram OSINT: metadata, network and identity checks.
Extract account metadata with Toutatis and archive content with Instaloader, then map the network behind a profile.
OSINT Reference Card Library.
Field-ready tradecraft. Live next to a keyboard, not in a slide deck.
DRK-002
Tor network fundamentals for dark web investigators.
Access .onion services, document sessions to chain-of-custody standard and identify deanonymisation vectors.
LGL-002
Civil and criminal judgment research for investigators.
Extract judicial findings, asset disclosures and named associates from court dockets across an eight-step PACER workflow.
SPC-002
Identifying satellite operators and owners.
Cross-reference ITU frequency filings, Space-Track TLE data and corporate registries to name the licensed operator and beneficial owner behind a satellite.
IDN-002
Cross-platform username tracing to identity attribution.
Enumerate handles across hundreds of platforms with Sherlock, cross-reference breach data and build a convergence dossier to evidentiary standard.
AI in OSINT.
Integrating AI tools and language models into your OSINT workflow.
Phone number carrier mismatch: AI hypothesis analysis.
When the subscriber name does not match, a structured AI prompt ranks the explanations and identifies the discriminating next query.
Writing style analysis across three anonymous forums.
A structured AI prompt scores stylometric convergence across forum handles and flags divergence, with indeterminate as the honest verdict when the signal will not support one.
The email address appears in four breach sets under different names.
A structured prompt that surfaces the consistency signals across a decade of breaches and ranks the attribution candidates by persistence score.
Two companies, one director name, three jurisdictions.
A prompt that normalises registry extracts onto one schema and surfaces the fields doing the discriminating work across OpenCorporates, ICIJ and OCCRP Aleph.
OSINT Methodology Tutorials.
Step-by-step tutorials drawn from working casework.
Dark web access: legal and ethical boundaries for investigators.
Apply CMA, CFAA and GDPR Article 6 to dark web access, build a Tails OS environment, and capture evidence to evidentiary standard.
Mobile location intelligence: advertising IDs and BSSID.
How advertising identifiers and Wi-Fi probe records expose device movement, and the legal constraints that govern their use in investigations.
Financial flows and sanctions evasion: investigator's guide.
Screen entities across sanctions regimes, map beneficial ownership through corporate registries and document the ownership chain to evidentiary standard.
Satellite imagery change detection: Sentinel and Landsat.
Use ESA and USGS multispectral archives to document ground-truth change over time, with a reproducible evidence chain.
The Signal.
A weekly practitioner briefing built around one open-source methodology. Each issue takes a live event as proof the technique matters, then builds the evidentiary file around it.
The Signal, Issue #007.
Federal agencies confirmed PLC intrusions at water utilities in seven US states, with the Iran attribution unconfirmed. Shodan and Censys map the same exposure the attackers exploited, and the record holds a technical pattern and no forensic proof.
The Signal, Issue #006.
Human Rights Watch put five flaring sites on the open record this week. Perenco says 220 flare points are permanently out. Neither claim resolves without a date, and that gap is the story.
The Signal, Issue #005.
ICE would not name the agent who killed Johan Sebastian Duran Guerrero in Biddeford. Six public records, from employment history to a court filing, corroborated his identity in three days, and the same denial has now repeated across three shootings in two weeks.
The Signal, Issue #004.
A 2022 chat leak and two federal court judgments show how Patriot Front actually funds itself. The march was staged for cameras, the ledger was not.
The Signal · Weekly Briefing
One open-source methodology. One live investigation. Every week.
A weekly practitioner briefing built around one open-source methodology. Each issue takes a live event as proof the technique matters, then builds the evidentiary file around it. Free. Read by investigative journalists, newsroom verification leads, and OSINT practitioners.
