D4RK's Substack

OSINT CTF Challenge: Operation Wing Trace

D4RK_INTEL — Tue, 28 Jul 2026 20:58:34 GMT

Classification: TRAINING EXERCISE // OSINT-CTF-2026-014

Category: Aircraft OSINT / Corporate Attribution

Difficulty: Intermediate

Time Limit: 4 hours

Phase 1: Aircraft Identification

Scenario

A whistleblower has provided a single photograph of a private jet parked at a remote airstrip. The aircraft is suspected of being used to transport assets linked to a sanctions evasion network. The tail number in the photograph has been intentionally blurred.

Your task is to identify the aircraft, trace its registered owner, and investigate the company behind it using only open source intelligence.

Evidence

One photograph of a private jet. The image and tail number is darkened and unreadable.

https://drive.google.com/file/d/1zKps1qAbCdtN16eX93s2VlEyGPD1zqZT/view?usp=sharing

Tasks:

Restore the image. Identify the aircraft. Provide answers to the following.

Serial Number
Manufacturer Name
Model
Type Aircraft
MFR Year
Type of Registration
Engine Type
Mode S Code
Registered Owner Name
Registered Owner Street Address
Registered Owner County
Registered Owner Country
Engine Manufacturer
Engine Model
Certificate Number

Phase 2: Corporate Attribution

Scenario

The registered owner of the aircraft is a corporate entity. This company may be part of a larger network involved in the sanctions evasion operation. Your task is to trace the ownership.

Tasks:

Using the registered owner name from Phase 1, identify the following:

Company Registration Number
Company Type
Jurisdiction
Registered Address
Agent Name
One Officer Name (Director, Secretary, or equivalent)

Phase 3: Flight Activity Analysis

Scenario

The aircraft has been tracked making multiple flights in recent weeks. Intelligence suggests it is being used to move assets between remote locations to avoid detection. One particular flight may reveal the operational pattern behind the sanctions evasion network.

Tasks:

Using your flight tracking OSINT skill, answer the following:

What was the departure airport for the flight on 28 July 2026?
What was the destination airport for the flight on 28 July 2026?
What was the flight number or callsign used?
What was the scheduled departure time (STD)?
What was the actual departure time (ATD)?
What was the flight duration?
What was the status of the flight?
At the barometric altitude (8,350 FT), what was the time and ground speed of the aircraft?

Submission Format (Updated)

Submit a single PDF document containing:

Phase 1 findings with source URLs and screenshots.
Phase 2 findings with source URLs and screenshots.
Phase 3 findings with source URLs and screenshots.
A brief methodology section explaining your approach.
A map showing the flight route from Phase 3 with annotated departure and destination points.

Submission Deadline

All report are to be submitted to the designated training email address - cybershieldmentor@gmail.com

Disclaimer

This challenge is designed for educational and training purposes only. The aircraft and company referenced are used solely as instructional examples within a controlled training environment. All information must be obtained from publicly available sources.

The Professional OSINT Practitioner

D4RK_INTEL — Sun, 19 Jul 2026 16:08:46 GMT

This is not a theoretical course. It is a practical, hands-on deep dive into the mindset and methodologies of a professional OSINT investigator. Every module is designed to answer not just the “what,” but the “how” and the “why,” with a strict focus on legal, ethical, and operational security (OPSEC) considerations. The goal is to transform a student from a curious beginner into a capable, analytical investigator.

Volume 2: Technical Intelligence, Network Analysis, & Advanced Attribution

Prerequisites Completed (Volume 1) Module 0 to Module 4: Operational Security, IMINT, Username/Email Attribution, and SOCMINT Deep Dives.

Advanced Syllabus Index

Module 5: Communication, Business, Historical Intelligence & People OSINT

Lecture 5.1: Phone Number OSINT

Lecture 5.2: Wayback Machine & The Internet Archive Workflows

Lecture 5.3: Corporate Org Charts & Business Intelligence

Module 6: Website OSINT & Technical Intelligence

Lecture 6.1: Domain Reconnaissance — WHOIS, DNS, and Registration History

Lecture 6.2: Subdomain Discovery & Enumeration

Lecture 6.3: Technology Stack Fingerprinting

Lecture 6.4: Directory Enumeration & Exposed Files

Lecture 6.5: SSL/TLS Certificate Analysis

Lecture 6.7: Automated Email Discovery with EmailCrawl

Lecture 6.8: Advanced Document Discovery — Extracting Hidden Files from Target Websites

Module 7: Advanced Investigative Tradecraft

Lecture 7.1: Sock Puppet Management & Anti-Suspension Tactics

Lecture 7.2: Structured Analytic Techniques for OSINT

Lecture 7.3: The Art of Pivoting

Module 8: Dark Web Intelligence & .onion Investigation

Lecture 8.1: Understanding the Dark Web — How It Actually Works
Lecture 8.2: Setting Up a Safe Investigation Environment
Lecture 8.3: Navigating the Dark Web — Finding .onion Sites
Lecture 8.4: Investigating .onion Sites — What to Document
Lecture 8.5: Extracting Intelligence from Dark Web Content
Lecture 8.6: Cryptocurrency Tracing Basics
Lecture 8.7: OSINT Tools for the Dark Web
Lecture 8.8: Legal and Ethical Boundaries
Lecture 8.9: Practical Investigation Workflow Summary
Lecture 8.10: Practical Investigation — From Dark Web Marketplace to Real-World Attribution

Module 9: Image Forensics & Hidden Data Recovery

Lecture 9.1: Introduction to Image Forensics — What Images Hide
Lecture 9.2: Photopea for Investigators — Image Manipulation & Analysis
Lecture 9.3: Darkening and Restoration — Revealing Hidden Details
Lecture 9.4: Hiding and Recovering Secret Text with Darkening Techniques
Lecture 9.5: CyberChef for OSINT — Encoding & Decoding Basics
Lecture 9.6: Caesar Cipher — Manual and Automated Decoding
Lecture 9.7: Base64, Hex, and Binary — Decoding Common Encodings
Lecture 9.8: Steganography — Finding Hidden Files Inside Images

Module 10: Transportation OSINT — Tracing Cars, Vessels, and Aircraft

Lecture 10.1: Vehicle Identification — Make, Model, and Year from a Photo
Lecture 10.2: License Plate Lookup — Country-Specific Databases
Lecture 10.3: VIN Decoding — What a Vehicle Identification Number Reveals
Lecture 10.4: Marine Traffic Tracking — Following Ships in Real Time
Lecture 10.5: Aircraft Tracking — Following Planes by Tail Number
Lecture 10.6: Aircraft Registration Lookup
Lecture 10.7: Satellite Imagery for Vehicle Tracking
Lecture 10.8: Building Movement Patterns from Vehicle Data

Module 11: Geospatial Intelligence (GEOINT) — Mapping the World from Open Sources

Lecture 11.1: Commercial Satellite Imagery — Your Eyes in the Sky
Lecture 11.2: Historical Imagery and Change Detection
Lecture 11.3: QGIS for OSINT — Professional Geospatial Analysis
Lecture 11.4: Coordinate Systems — Making Sense of the Numbers
Lecture 11.5: Sun Positioning and Shadow Analysis — How to Use SunCalc
Lecture 11.6: OpenStreetMap for Investigations
Lecture 11.7: Overpass Turbo for OSINT — Extracting Contact Data and Business Intelligence
Lecture 11.8: 3D Terrain Analysis

Module 12: HUMINT-OSINT Hybrid — Trawling Forums and Online Communities

Lecture 12.1: Why Forums Are the Deepest OSINT Source
Lecture 12.2: Finding Niche Forums and Online Communities
Lecture 12.3: Forum Reconnaissance — Profiles, Posting History, Signatures
Lecture 12.4: Writing Style Analysis for Attribution
Lecture 12.5: Tracking Users Across Multiple Forums
Lecture 12.6: Extracting Emails and Contact Details from Forums
Lecture 12.7: Recovering Deleted Forum Content with Wayback Machine
Lecture 12.8: Dark Web Forums — Safe Access and Intelligence Gathering

Module 13: OSINT for Fraud & Scam Investigation

Lecture 13.1: Understanding Fraud and Scam Types — What You Are Investigating
Lecture 13.2: Investigating Phishing Emails — Tracing the Sender
Lecture 13.3: Tracing Fake Social Media Accounts
Lecture 13.4: Investigating Romance Scams
Lecture 13.5: Investigating Fake Online Stores and E-Commerce Fraud
Lecture 13.6: Cryptocurrency Scam Tracing
Lecture 13.7: Business Email Compromise (BEC) Investigation
Lecture 13.8: Documenting Evidence for Law Enforcement
Practical Exercise: The Complete Scam Investigation

Module 14: Python for OSINT Automation — Building Your Own Tools

Lecture 14.1: The Automation Development Framework

Lecture 13.2: Setting Up Your Kali Linux Development Environment
Lecture 14.3: Using AI as Your Coding Assistant

Scripting Lab 1: Multi-Engine Dork Orchestrator
Scripting Lab 2: Bulk EXIF Extractor & Geolocation Plotter
Scripting Lab 3: Intelligent Permutation & Availability Engine
Scripting Lab 4: Username-to-User ID Cross-Reference Tool

Scripting Lab 5: Reddit Historical Monitoring Bot
Lecture 14.4: Building Your Personal Automation Toolkit

Module 15: Intelligence Report Writing & Entity Graph Visualization

Lecture 15.1: Structuring the Intelligence Report

Lecture 15.2: Writing for Your Audience — Client, Legal, or Internal

Lecture 15.3: Evidence Documentation & Source Citation Standards

Lecture 15.4: Entity Graph Visualization — Tools & Methodology

Lecture 15.5: Building the Final Intelligence Package

Capstone Course: The Integrated Investigation

Case File: Michael Hall & HALL OR NOTHING MANAGEMENT LIMITED
Full-Spectrum Intelligence Report
Final Submission & Grading Criteria

Appendices

Appendix A: Glossary of OSINT Terms
Appendix B: Complete Tools Index

Module 5: Communication, Business, Historical Intelligence & People OSINT

This module shifts your focus from platforms to pivot points. A phone number. A business record. A historical snapshot of a website. A person’s name. These are the raw materials of investigation. You do not always start with a social media handle. Sometimes all you have is a phone number on a leaked receipt, a company name on a job posting, or a person’s name mentioned in a report. This module teaches you how to turn those fragments into full intelligence profiles.

Lecture 5.1: Phone Number OSINT

A phone number is one of the most valuable starting points in any investigation. It is tied to a physical device. It is linked to messaging apps. It appears in data breaches, public records, and social media databases. If you know how to work a phone number properly, you can extract a name, a location, a profile picture, and a list of connected accounts without ever making a call.

This lecture walks you through the complete phone number investigation workflow. No theory without practice. Every technique is something you can do right now.

Part 1: The Number’s Address — Understanding the Numbering Plan

Before you plug a phone number into any tool, stop. Look at the number itself. A phone number is structured. It contains a country code, an area code or mobile prefix, and a subscriber number. Reading this structure tells you where in the world the number lives before you run a single search.

Every phone number on the planet follows the E.164 international numbering plan. The format is:

+[Country Code] [National Destination Code] [Subscriber Number]

Take this number as an example: +234 802 345 67**

Break it down.

The +234 is the country code. That is Nigeria. You now know the country. That is your geographic anchor. Everything else you find about this number should be consistent with Nigeria. If a tool tells you the carrier is in Germany, something is wrong.

The 802 is the mobile prefix. In Nigeria, prefixes like 802, 803, 809, and others are assigned to specific mobile networks. 802 typically belongs to Airtel Nigeria. You now know the carrier without looking it up.

The remaining digits are the subscriber number. These are unique to the individual line.

Now take another example: +1 212 555 0199

The +1 is the country code for the United States, Canada, and several Caribbean nations. That narrows you to North America.

The 212 is the area code. That is Manhattan, New York City. You now have a city-level location.

The 555 prefix is reserved for fictional numbers in US media. This specific number is a fake. You just identified a dummy number by reading its structure.

This is the skill. Before tools, use your eyes. The number itself tells a story. Learn the major country codes. Learn the mobile prefixes for the regions you investigate most often. The more you can determine without touching a keyboard, the faster and more accurate your investigation becomes.

Part 2: Carrier and Line Type Lookup

Once you have identified the country and general region from the number structure, your next step is to confirm the carrier and determine the line type. Is this a mobile number, a landline, or a VoIP number? The answer changes how you investigate.

Tool: FreeCarrierLookup.com

Go to freecarrierlookup.com. Enter the full phone number with country code. The tool returns:

The carrier name.
The line type (mobile, landline, VoIP).
The original carrier, even if the number has been ported.

A mobile number is tied to a physical SIM card and a device. This is what you want. A VoIP number from a service like Google Voice or TextNow is essentially disposable. It can be created in minutes and abandoned just as fast. Knowing this upfront saves you from spending hours investigating a burner.

Tool: PhoneValidator.com

phonevalidator.com - is another free lookup tool. It provides similar carrier and line type data, plus it sometimes returns the city and state associated with the area code. Use it as a second source to confirm what FreeCarrierLookup told you. Never trust a single tool. Always validate.

Part 3: True People Search and Spydialer — Name Discovery

Now you want to put a name to the number. In the United States, two free tools dominate this space.

True People Search

Go to truepeoplesearch.com. Enter the phone number. If the number is in their database, the tool returns:

First and last name.
Current and previous addresses.
Email addresses associated with the number.
Possible relatives or associates.

This is aggregated from public records, marketing databases, and consumer data. It is not guaranteed to be accurate, but it is a strong starting point. If you get a name, cross-reference it immediately against social media platforms to confirm the association.

Spydialer

Go to spydialer.com. Enter the phone number. Spydialer works differently. It does not pull from consumer databases. It checks the number’s voicemail greeting without actually ringing the phone.

Here is how it works. Spydialer calls the number, waits for the voicemail system to pick up, and records the greeting. If the voicemail message says “You have reached John Smith. Please leave a message,” Spydialer captures that audio and transcribes the name. You never spoke to the target. The target’s phone never rang. You just extracted their name from their own voicemail greeting.

This is passive. It is legal. It works because people voluntarily record their name on their voicemail. Spydialer simply listens to what they chose to make public.

Use Spydialer for US numbers. For international numbers, the tool is less effective because voicemail systems vary by country. But for US targets, it is one of the most reliable name discovery tools available.

Part 4: Messenger App Querying — The Most Powerful Technique

This is the technique I told you about at the start. It is simple. It is passive. It works across WhatsApp, Signal, and Telegram. And it produces results faster than any database lookup.

The concept is straightforward. Messaging apps allow you to see certain information about a user if you have their phone number saved in your contacts. You do not need to message them. You do not need to call them. You just add them and look.

WhatsApp

Open WhatsApp on your sock puppet device. Save the target phone number to your device contacts with the full international format (including the + and country code). Give the contact a fake name in your address book. Open WhatsApp. Wait a few seconds for the app to sync. If the number is registered on WhatsApp, the contact appears in your WhatsApp contact list.

Now, tap on the contact. You will see:

Profile Picture: The image the user set as their WhatsApp avatar. This is often the same photo they use on Instagram, Facebook, or LinkedIn. Save it. Run it through perceptual hash matching.
Status: A short text status that may contain location, mood, or activity hints.
Last Seen: A timestamp showing when the user last opened WhatsApp. This reveals their active hours.
About: A longer bio section. Users often list their job title, location, or other social media handles here.

You have just extracted a profile picture, an activity timestamp, and biographical information from nothing but a phone number. No message was sent. No notification was triggered. The target has no idea you are looking at them.

Signal

The process is identical. Save the number. Open Signal. If the number is registered, the contact appears. Signal shows the profile picture and display name. Signal does not show a “last seen” status by default unless the user has enabled it, but the profile picture alone is worth the effort.

Telegram

You already know this from the Telegram lecture. Save the number. Open Telegram. If the number is registered, the account appears in your contacts with the display name, username, and profile picture. Now you have the Telegram @handle, which you can use for all the Telegram OSINT techniques covered in Lecture 4.8.

Why This Technique Is So Powerful

A phone number is private, right? People guard their phone numbers. But they voluntarily link them to messaging apps. And those apps display profile pictures, bios, and activity timestamps to anyone who has the number saved. The target thinks their number is hidden. They do not realize their WhatsApp profile picture is visible to every contact who adds them, including the investigator who just saved their number to a sock puppet device.

This is not a hack. It is not a bypass. It is the intended functionality of these apps. You are simply using the features as designed. The ethical boundary is clear. You look. You document. You do not message. You do not call. You do not interact.

Part 5: Phone Number to Social Media Discovery

A phone number is often used to register accounts on Facebook, Instagram, Twitter, and other platforms. Most platforms allow you to search for contacts by syncing your phone’s address book. This is the reverse of the messenger technique. Instead of checking individual apps, you use the platform’s contact sync feature to find every account linked to that number at once.

Facebook Contact Sync

On your sock puppet Facebook account, go to Settings. Find the “Find Friends” or “Upload Contacts” option. Upload a contact file containing only the target phone number. Facebook processes the file and returns any account associated with that number. If a match is found, you see the profile name, profile picture, and a link to the account.

This is more aggressive than the WhatsApp technique because you are uploading data to Facebook. Understand the risk. Use a properly maintained sock puppet. Never use your real account.

Instagram Contact Sync

Instagram offers a similar feature. Go to your sock puppet Instagram profile. Navigate to “Discover People” or “Connect Contacts.” Sync your device contacts, which includes the target number. Instagram shows you any account linked to that number.

The Workflow

Save the target number to your sock puppet device.
Check WhatsApp, Signal, and Telegram for profile pictures and bios.
Sync contacts on Facebook and Instagram to find linked accounts.
Document every account found. Cross-reference usernames and profile pictures across platforms.
Never message. Never call. Never interact.

Part 6: Phone Number to Email Discovery

Phone numbers and email addresses are often linked in data breaches, consumer databases, and public records. Several tools allow you to search a phone number and find associated email addresses.

That’s Them

Go to thatsthem.com. Enter the phone number. The tool returns associated names, email addresses, and physical addresses from public records and marketing databases. Free to use with a daily limit.

FastPeopleSearch

Go to fastpeoplesearch.com. Enter the phone number. The tool returns name, address history, and sometimes associated email addresses. This is another consumer data aggregator. Use it as a second source.

Sync.me / Truecaller.com

sync.me / truecaller.com is a caller ID and spam blocking app that also works as a reverse phone lookup. Search the number on their website or through the app. It returns the name and sometimes the profile picture associated with the number from their user-contributed database.

Email Extraction Workflow

Run the phone number through That’s Them, FastPeopleSearch, and Sync.me, truecaller.com.
Collect any email addresses returned.
Plug those emails into your Module 3 email intelligence workflow.
Search the emails on breach databases like HaveIBeenPwned, DeHashed, and IntelX.
Cross-reference the emails against social media platforms.

A single phone number can lead to an email address, which leads to a Facebook profile, which leads to a LinkedIn account, which gives you their full employment history. This is the chain. Pull one link, and the rest follows.

Part 7: International Phone Number Resources

Not all phone numbers are US-based. Different countries have different lookup tools. Here is a quick reference for major regions.

Europe

118712.fr — France.
dasoertliche.de — Germany.
paginebianche.it — Italy.
bt.com — United Kingdom.

Asia

jpnumber.com — Japan.
truecaller.com — India (and global, but strongest in India).

Global

numlookup.com — Free reverse lookup for many countries.
truecaller.com — Global caller ID and spam detection. Requires an account.
sync.me — Global, user-contributed database.

Part 8: Practical Investigation Workflow Summary

Read the number. Identify the country code and area code without any tools.
Run a carrier and line type lookup using FreeCarrierLookup and PhoneValidator.
If the number is US-based, search True People Search and Spydialer for a name.
Save the number to your sock puppet device.
Check WhatsApp, Signal, and Telegram for profile pictures, bios, and activity timestamps.
Sync contacts on Facebook and Instagram to find linked accounts.
Run the number through That’s Them, FastPeopleSearch, and Sync.me, Truecaller for email addresses.
Plug any discovered emails into your email intelligence workflow.
Cross-reference every name, username, email, and profile picture across all platforms.
Document everything. Screenshots, timestamps, tool outputs, and your analysis.

Part 9: Quick Reference

Objective______________Tool/Method

Country and area identification: Manual E.164 analysis
Carrier and line: typefreecarrierlookup.com, phonevalidator.com
Name discovery (US):truepeoplesearch.com, spydialer.com
Voicemail name extraction:spydialer.com
WhatsApp profile: Save number → check WhatsApp
Signal profile: Save number → check Signal
Telegram profile: Save number → check Telegram
Social media account discovery: Facebook and Instagram contact sync
Email discovery:thatsthem.com, fastpeoplesearch.com, sync.me
International lookups:numlookup.com, truecaller.com, country-specific directories

This is phone number OSINT. Not just searching a database. Reading the number. Confirming the carrier. Extracting the name from the voicemail they recorded themselves. Pulling their profile picture from the messaging apps they voluntarily linked. Building the chain from a single ten-digit string to a full identity profile.

Master this, and a phone number stops being a dead end. It becomes one of your most productive starting points.

Lecture 5.2: Wayback Machine & The Internet Archive

The internet forgets nothing. It just buries things. Websites change. Pages get deleted. Social media profiles get wiped. Companies remove controversial statements. Executives scrub their bios. Products with embarrassing specifications disappear from official pages. But before any of that happened, the Internet Archive was watching.

The Wayback Machine at archive.org has been taking snapshots of the web since 1996. It has captured over 800 billion pages. For an investigator, this is not a history tool. It is a time machine. It lets you visit a website as it existed on any date a snapshot was taken. You can read deleted blog posts. You can find old employee directories. You can recover social media profiles that were deleted years ago. You can compare a page from 2018 to the same page in 2022 and see exactly what changed, what was removed, and what someone tried to hide.

This lecture is about using the Wayback Machine like a professional. Not just pasting a URL and hoping for the best. Systematic collection, wildcard discovery, change detection, and evidence preservation.

Part 1: The Basics — Viewing a Single Page

You have a URL. You want to see what it looked like in the past. The most direct method is the Wayback Machine’s main interface.

Go to archive.org/web/. Paste the URL into the search bar and press Enter. The Wayback Machine displays a calendar with colored circles. Blue circles mean a successful snapshot exists. Green circles mean a redirect was captured. The darker the circle, the more snapshots exist on that date.

Click a date. The page loads exactly as it appeared at that moment. The images, the text, the links. Everything is preserved.

But this is the surface. You are not here for surface-level browsing.

Part 2: The Wildcard Operator — Downloading Entire Directories

This is the technique that separates amateurs from professionals. The Wayback Machine allows you to use the * wildcard to download every file in a directory, every snapshot of every file, across all time.

The format is:

https://web.archive.org/web/*/example.com/staff/*

Let me break this down.

https://web.archive.org/web/ is the base URL for the Wayback Machine.
The first * means “every date.” It tells the Wayback Machine to return snapshots from all available dates, not just one.
example.com/staff/ is the directory you are targeting.
The second * means “every file in that directory.”

When you open this URL, the Wayback Machine returns a list of every file it ever captured in that directory, sorted by filename. You will see old staff profile pages, deleted bios, removed documents, and anything else that was once publicly accessible in that folder.

Here is a practical example. Say you are investigating a company called Acme Corp. You want to find old employee profiles. You navigate to:

https://web.archive.org/web/*/acmecorp.com/about/team/*

The Wayback Machine returns every snapshot of every file in the /about/team/ directory. You see entries like:

acmecorp.com/about/team/john-doe.html 2018-03-15
acmecorp.com/about/team/jane-smith.html 2019-11-02
acmecorp.com/about/team/former-executive.html 2017-06-20

Click on any of these. The page loads as it existed on that date. You are now reading the bio of an executive who left the company three years ago and whose profile was deleted from the live site. The Wayback Machine kept it.

Part 3: Targeting Specific File Types

The wildcard technique becomes surgical when you target specific file extensions. Companies accidentally leave PDFs, Excel spreadsheets, Word documents, and other files in publicly accessible directories. The Wayback Machine captures them.

To find every PDF ever hosted on a domain:

https://web.archive.org/web/*/example.com/*.pdf

To find every Excel spreadsheet in a specific directory:

https://web.archive.org/web/*/example.com/internal/*.xlsx

To find every Word document:

https://web.archive.org/web/*/example.com/*.doc

To find every CSV file:

https://web.archive.org/web/*/example.com/*.csv

I have used this technique to find internal strategy documents, financial spreadsheets, employee directories, and training manuals. Files that were never meant to be public but were placed in directories with no access control. The company removed them years ago. The Wayback Machine did not.

Part 4: Investigating Social Media Profiles

Social media profiles change constantly. Bios get updated. Profile pictures get swapped. Posts get deleted. The Wayback Machine captures public social media pages just like any other website. This is how you recover what someone tried to erase.

Twitter/X Profiles

Paste the profile URL into the Wayback Machine:

https://web.archive.org/web/*/x.com/username

Or the old Twitter domain:

https://web.archive.org/web/*/twitter.com/username

The calendar shows every date a snapshot was taken. Click through different dates. You will see old display names, old bios, old profile pictures, and the tweets that were visible on that date. If the target deleted controversial tweets, they may still be visible in older snapshots.

LinkedIn Profiles

LinkedIn blocks some Wayback Machine snapshots, but public profiles are often captured:

https://web.archive.org/web/*/linkedin.com/in/username

If a target removed a previous job from their profile, the old version may still list it. If they changed their headline or summary, the old version shows what they used to claim.

Instagram Profiles

Instagram is harder to archive due to its dynamic loading, but public profile pages are sometimes captured:

https://web.archive.org/web/*/instagram.com/username

Focus on older snapshots. The bio, profile picture, and follower count may be different. These changes tell a story.

Facebook Profiles

Facebook actively blocks archival of logged-in pages, but public pages and public profiles occasionally get captured:

https://web.archive.org/web/*/facebook.com/username

Do not expect full timelines. But bios, profile pictures, and public posts sometimes survive.

YouTube Channels

YouTube channel pages are archived regularly:

https://web.archive.org/web/*/youtube.com/@handle

https://web.archive.org/web/*/youtube.com/channel/UCxxxxxxxxxxxxxxxx

Old snapshots show previous channel names, old banner images, and video titles that have since been changed or deleted.

Part 5: Change Detection — Comparing Pages Side by Side

This is the technique that turns the Wayback Machine from a history viewer into an investigative tool. You do not just look at one snapshot. You compare two snapshots from different dates and document exactly what changed.

Here is the practical workflow

Step 1: Identify the Target Page

Pick a page that is likely to change over time. An executive team page. A product description page. A company’s “About Us” page. A privacy policy. A terms of service.

Step 2: Pick Two Dates

Choose a date from the past and a more recent date. For example, compare the page as it existed in 2018 to the page as it existed in 2022. The wider the gap, the more changes you are likely to find.

Step 3: Open Both Snapshots Side by Side

Open two browser windows. Load the 2018 snapshot in one. Load the 2022 snapshot in the other. Place them next to each other on your screen.

Step 4: Go Line by Line

Read both pages. Compare the text. Look for:

Removed personnel. An executive bio that existed in 2018 but is gone in 2022. That person left the company. When did they leave? Why?
Changed job titles. A person listed as “VP of Engineering” in 2018 is now “Advisor” in 2022. They were demoted or moved to a non-operational role. That is intelligence.
Removed product descriptions. A product page in 2020 listed specific technical specifications. The 2023 version removed those specs. The company is hiding something about the product’s capabilities.
Changed contact information. The 2019 page lists a phone number and email address. The 2022 page lists different ones. Both are now pivot points.
Deleted statements. A company’s “Our Values” page in 2021 mentioned a commitment to a specific cause. The 2024 version removed all references. The company quietly changed its public stance.

Step 5: Document Every Change

Screenshot both versions. Highlight the differences. Write a brief note explaining what changed and what it implies. This is your evidence package.

Part 6: The Save Page Now Feature — Preserving Evidence in Real Time

The Wayback Machine is not just for looking at the past. You can force it to capture a page right now. This is critical for evidence preservation.

Go to archive.org/web/. Look for the “Save Page Now“ section. Paste the URL you want to capture. Click “Save Page.” The Wayback Machine takes an immediate snapshot and gives you a permanent link to that snapshot.

Use this when:

You find a page that might be deleted soon.
A target posts something controversial that they are likely to remove.
You need a timestamped record of a page as it exists at this exact moment.
You are building an evidence file and need a permanent, verifiable copy of the source.

The snapshot link is permanent. Even if the original page is deleted, your snapshot remains.

Part 7: Using the Wayback Machine CDX API for Bulk Discovery

The browser interface is fine for single pages. For large-scale discovery, you use the CDX API. This is a machine-readable interface that returns a list of all snapshots matching your query.

The base URL is:

https://web.archive.org/cdx/search/cdx?url=example.com&output=text

This returns a plain text list of every snapshot of every page on example.com. Each line contains the timestamp, the URL, and the HTTP status code.

To filter by file type:

https://web.archive.org/cdx/search/cdx?url=example.com&matchType=prefix&filter=mimetype:application/pdf&output=text

This returns only PDF files.

To filter by year:

https://web.archive.org/cdx/search/cdx?url=example.com&from=2020&to=2021&output=text

This returns only snapshots taken in 2020 and 2021.

To download the results for analysis:

curl “https://web.archive.org/cdx/search/cdx?url=example.com&output=text” > wayback_results.txt

You now have a complete inventory of every page the Wayback Machine ever captured from that domain. Use this to discover directories, files, and pages you would never find through the browser interface.

Part 8: Investigating Deleted Websites

Sometimes the entire website is gone. The domain expired. The company shut down. The content was removed. The Wayback Machine may still have it.

Paste the domain into the Wayback Machine search bar. If snapshots exist, the calendar appears. Browse the site as it existed when it was live.

To find every page ever captured from a defunct domain, use the wildcard:

https://web.archive.org/web/*/defunctsite.com/*

This returns a list of every page, every image, every file the Wayback Machine captured before the site disappeared. You can reconstruct the entire website from these snapshots.

Part 9: Browser Extensions for Faster Access

Wayback Machine (Official Extension)

The Internet Archive provides an official browser extension for Chrome and Firefox. Install it. When you encounter a page that is down or you want to check its history, click the extension icon. It shows you if snapshots exist and lets you load them with one click.

Chrome: https://chromewebstore.google.com/detail/wayback-machine/fpnmgdkabkmnadcjpehmlllkndpkmiak

Firefox: https://addons.mozilla.org/en-US/firefox/addon/wayback-machine_new/

Go Full Page (Screenshot Capture)

When preserving evidence from a Wayback Machine snapshot, you need a full-page screenshot. The Go Full Page extension captures the entire scrollable page as a single image.

Chrome: https://chromewebstore.google.com/detail/gofullpage-full-page-scre/fdpohaocaechififmbbbbbknoalclacl

Part 10: Practical Investigation Workflow Summary

Start with a URL. Paste it into archive.org/web/.
Browse the calendar. Identify key dates when significant changes likely occurred.
Use the wildcard operator to discover hidden directories and files: */example.com/staff/*.
Target specific file types: *.pdf, *.xlsx, *.doc, *.csv.
For social media profiles, check snapshots across multiple dates to find deleted bios, old profile pictures, and removed posts.
Perform change detection. Compare two snapshots side by side. Document what was added, removed, or altered.
Use the CDX API for bulk discovery across entire domains.
Use “Save Page Now” to preserve any page that might disappear.
Screenshot everything. Save the snapshot URLs. Build your evidence file.

Part 11: Quick Reference

Objective_____________Method

View a single page:archive.org/web/ → paste URL
Discover all files in a directory:*/example.com/directory/*
Find specific file types:*/example.com/*.pdf
Compare pages over time: Open two snapshots side by side
Preserve a page now:archive.org/web/ → Save Page Now
Bulk snapshot discoveryCDX API: web.archive.org/cdx/search/cdx?url=...
Twitter/X profile history:*/x.com/username
LinkedIn profile history:*/linkedin.com/in/username
YouTube channel history:*/youtube.com/@handle
Reconstruct defunct websites:*/defunctsite.com/*
Quick access browser extension: Wayback Machine official extension

This is the Wayback Machine. Not a history book. An investigative tool. Use the wildcard to discover what was hidden. Compare snapshots to document what was changed. Preserve what is about to disappear. Master this, and you can investigate any website, any social media profile, any online presence across time. The internet remembers. Now you do too.

Lecture 5.3: Business Intelligence for the Investigator

Companies hide things. Not always illegally. Sometimes they just structure themselves in ways that make it hard to see who really owns what, who supplies whom, and where the money flows. Your job as an investigator is to cut through that structure and find the truth.

Business intelligence is not about reading annual reports and nodding along. It is about pulling the right records from the right registries, tracing ownership chains through multiple jurisdictions, and mapping supply networks from raw trade data. When you finish this lecture, you will be able to look at any company and tell a story about who really controls it, who it does business with, and what it might be trying to hide.

Part 1: Corporate Registries — The Foundation

Every legitimate company is registered somewhere. That registration creates a public record. The record contains names, addresses, dates, and ownership structures. Your first task is always the same: find the company’s official registration and pull everything you can.

UK Companies House

Companies House is the UK’s corporate registry, and it is one of the most transparent in the world. It is free to use. No account required. The data is deep.

Go to find-and-update.company-information.service.gov.uk. Search for the company by name or registration number. The company profile page gives you:

Registered office address.
Company status (active, dissolved, in liquidation).
Incorporation date.
Last accounts filed.
Next accounts due.
Nature of business (SIC code).
List of officers (directors and company secretary).
Persons with Significant Control (PSCs).

The PSC register is the goldmine. A Person with Significant Control is anyone who owns more than 25% of the company’s shares or voting rights, or who otherwise exercises significant influence. This is UK law. Companies must declare their real owners.

Click on each PSC. You will see:

Full name.
Date of birth (month and year).
Nationality.
Correspondence address.
Nature of control (ownership of shares, voting rights, etc.).

This is the real owner. Not a nominee director. Not a shell. The person who ultimately benefits from the company’s existence.

Now, click on each director. You will see their full name, date of birth (month and year), role, and sometimes a service address. Cross-reference these names against other companies. A director who appears in five different companies, some of which are dissolved, is building a pattern.

Click the “Filing History” tab. This contains every document the company has filed since incorporation. Annual returns. Changes of address. Appointment and resignation of directors. Share allotments. Mortgage charges. These documents tell the story of the company’s evolution. Read them chronologically. You are building a timeline.

US SEC EDGAR

In the United States, publicly traded companies file with the Securities and Exchange Commission. EDGAR is the database.

Go to sec.gov/edgar/search. Search by company name or ticker symbol. The results include:

10-K (annual report) — Comprehensive overview of the business, risks, and financials.
10-Q (quarterly report) — Quarterly financial updates.
8-K (current report) — Material events like acquisitions, bankruptcies, or leadership changes.
Proxy statements — Executive compensation, board member details, and shareholder voting.
Insider trading filings (Forms 3, 4, 5) — When executives buy or sell company stock.

The 10-K is your starting point. It contains a detailed description of the business, its revenue streams, its risk factors, its legal proceedings, its properties, and its subsidiaries. The “Risk Factors” section is particularly valuable. The company is legally required to disclose what could go wrong. Read it. They are telling you their vulnerabilities.

The proxy statement lists the board of directors, their backgrounds, their compensation, and their relationships with the company. This is how you map the power structure.

Insider trading filings tell you whether executives are buying or selling. A CEO selling a large block of shares before bad news becomes public is a signal. The filings are public. Connect the dates.

OpenCorporates

OpenCorporates at opencorporates.com is a global aggregator. It pulls data from over 140 jurisdictions into one searchable database.

Search by company name, officer name, or address. The results show:

Company name and registration number.
Jurisdiction.
Current status.
Directors and officers.
Sometimes the ultimate beneficial owners.

The real power of OpenCorporates is the address search. Enter an address, and it returns every company registered at that location. If you find fifty companies registered at the same small office in Delaware, you have found a corporate service provider that creates shell companies. That is a lead.

The officer search is equally powerful. Enter a name, and OpenCorporates returns every company that person is associated with across all jurisdictions. A single director search can reveal a hidden network of connected entities.

Part 2: Tracing Beneficial Ownership Through Layers

Companies hide ownership by layering. Company A is owned by Company B, which is owned by Company C, which is owned by a trust in a jurisdiction that does not require public disclosure. Your job is to follow the chain as far as it goes and identify where it goes dark.

Start with the company you are investigating. Pull its registration. Identify the declared owners. If the owner is another company, pull that company’s registration. Repeat. Each layer takes you deeper.

Here is the practical workflow.

Pull the target company’s registration from its home jurisdiction.
Identify the shareholders or PSCs.
If a shareholder is another company, search that company in its home jurisdiction.
Repeat until you reach either a natural person or a jurisdiction that does not disclose ownership (like Panama, British Virgin Islands, or Cayman Islands).
When the chain goes dark, document the last known entity and the jurisdiction where the trail ends. This is your transparency boundary. The fact that ownership disappears into a secrecy jurisdiction is intelligence in itself.

Tools that help with this:

OpenCorporates — Cross-jurisdictional officer and company search.
ICIJ Offshore Leaks Database — offshoreleaks.icij.org — Data from the Panama Papers, Paradise Papers, and other leaks. Search by name, company, or address.
OCCRP Aleph — aleph.occrp.org — A search engine for investigative data, including corporate registries, sanctions lists, and leaked records.

Part 3: Supply Chain Mapping — Who Really Does Business With Whom

Companies claim to have ethical supply chains. They claim to source from approved vendors. They claim to have no business with sanctioned entities. Import and export records tell you the truth.

When goods cross international borders, customs agencies record the shipment. The bill of lading contains the shipper, the consignee, the product description, the quantity, the weight, and the date. These records are aggregated by commercial services, and many offer free access to partial data.

ImportYeti

Go to importyeti.com. Search for a company name. ImportYeti returns US import records associated with that company, including:

Supplier names and locations.
Product descriptions.
Shipment quantities and weights.
Port of entry.
Date of shipment.

This is how you find a company’s real suppliers. Not the ones they list on their website. The ones they actually buy from. Search a company you are investigating. Look at the supplier list. Cross-reference those suppliers against sanctions lists, blacklists, and adverse media.

Panjiva (Free Tier)

Panjiva at panjiva.com is a more detailed trade data platform owned by S&P Global. The free tier allows limited searches. Enter a company name. Panjiva returns shipment records with buyer and seller names, product descriptions, and shipping routes.

Sayari (Commercial, Free Trial Available)

Sayari at sayari.com is a commercial supply chain intelligence platform. It maps corporate ownership and trade relationships globally. If you have access through your organization, use it. If not, the free trial may be sufficient for a single investigation.

The Supply Chain Workflow

Search the target company on ImportYeti.
Document every supplier and customer listed in the shipment records.
Search each supplier on OpenCorporates to identify their ownership.
Cross-reference supplier names against sanctions lists using sanctionssearch.ofac.treas.gov (US OFAC) and sanctionsmap.eu (EU).
Look for discrepancies. A company that claims to source from ethical suppliers but imports from a blacklisted factory is exposed by the trade data

Part 4: Beyond Registries — Finding What They Did Not Declare

Corporate registries show what the company chose to file. Investigations show what they did not. Use the techniques from previous modules to build a fuller picture.

Wayback Machine

Paste the company’s website into the Wayback Machine. Look at old versions of the “About Us” page, the “Team” page, and the “Products” page. Find executives who were listed in 2018 but disappeared in 2022. Find products that were once advertised but are now removed. Find contact details that were changed. Every edit is a decision. Every removal is something they did not want you to see.

Social Media Cross-Referencing

Take the names of directors and PSCs. Search them on LinkedIn, Twitter, Facebook, and Instagram. A director who lists “CEO at XYZ Corp” on LinkedIn but is not listed as a director on Companies House is a red flag. A PSC who posts about a luxury lifestyle on Instagram while their company files for bankruptcy is a signal.

Phone Number and Email OSINT

Take the phone numbers and email addresses listed on the corporate registry filings. Run them through the techniques from Lecture 5.1. Find the personal accounts linked to those numbers. A corporate phone number that traces back to a personal WhatsApp profile picture tells you more than any filing.

News and Adverse Media

Search the company name and director names on Google News. Use the site:news.google.com dork. Search for lawsuits, regulatory actions, protests, and scandals. One negative article does not damn a company. Five articles from different sources over three years about the same type of problem is a pattern.

Part 5: Practical Investigation Workflow Summary

Search the company on its home jurisdiction’s corporate registry. Pull all filings.
Identify the directors and Persons with Significant Control.
Search every director and PSC on OpenCorporates to find all associated companies.
Trace the ownership chain through multiple jurisdictions until you reach a natural person or a secrecy wall.
Check the ICIJ Offshore Leaks database and OCCRP Aleph for connections to leaked records.
Search the company on ImportYeti to map its real suppliers and customers.
Cross-reference suppliers against OFAC and EU sanctions lists.
Run the company’s website through the Wayback Machine. Compare old and new versions.
Search director and PSC names on LinkedIn, Twitter, Facebook, and Instagram.
Run phone numbers and emails from filings through Phone OSINT and Email OSINT workflows.
Search for adverse media on Google News.
Compile a report with a risk rating based on your findings.

Part 6: Quick Reference

Objective_____________Tool/Resource

UK company search:find-and-update.company-information.service.gov.uk
US public company filings:sec.gov/edgar/search
Global company search:opencorporates.com
Offshore leaks database:offshoreleaks.icij.org
Investigative data search:aleph.occrp.org
US import/export records:importyeti.com
Trade data platform:panjiva.com
OFAC sanctions check:sanctionssearch.ofac.treas.gov
EU sanctions check:sanctionsmap.eu
Website history:archive.org/web/
Adverse media:news.google.com

This is business intelligence investigation. Not just reading filings. Tracing ownership. Mapping supply chains. Recovering deleted history. Building a complete picture from fragmented public data. Master this, and you can investigate any company on Earth.

Module 6: Website OSINT & Technical Intelligence

A website is not just pages and text. It is a stack of technology, a history of ownership, a network of subdomains, and often a trail of exposed files and forgotten directories. Investigating a website means peeling back every layer until you understand who built it, how it runs, and what it accidentally left in the open.

This module is about technical reconnaissance. You will learn to pull domain records, map subdomains, fingerprint the technology behind a site, discover hidden directories, analyze SSL certificates, crawl for hidden content, and extract email addresses at scale. Every lecture is hands-on. Every tool has a purpose.

Lecture 6.1: Domain Reconnaissance — WHOIS, DNS, and Registration History

Before you touch the website itself, you investigate the domain. The domain tells you who registered it, when, through which service, and what servers handle its traffic. This is foundational intelligence.

WHOIS Lookup

WHOIS is a protocol that queries domain registration databases. When someone registers a domain, they must provide contact information. That information is stored in the WHOIS record.

Start with a simple WHOIS lookup. The command line gives you the raw data:

whois example.com

This returns the registrar name, registration date, expiration date, name servers, and sometimes the registrant’s name, organization, email, phone number, and physical address.

Many domains now use privacy protection services that redact the registrant’s personal details. You will see “REDACTED FOR PRIVACY” or the registrar’s own proxy address. Do not stop there. The privacy shield only hides the current record. Historical WHOIS data often predates the privacy implementation or was captured before the owner enabled it.

WHOIS History

Use whois.domaintools.com or whoisology.com to pull historical WHOIS records. A domain registered in 2010 may have had public contact details for the first five years before the owner learned about privacy protection. The historical record shows you those early details.

I have found personal email addresses, home addresses, and phone numbers in WHOIS records from 2015 that were redacted by 2018. People change their domains less often than you think. An old email address from a WHOIS record is a permanent pivot point.

DNS Records

DNS records tell you how the domain is configured. The dig command pulls them:

dig example.com ANY

Key record types:

A Record: Maps the domain to an IPv4 address. This is the server’s IP.
AAAA Record: Maps to an IPv6 address.
MX Record: Mail exchange server. Tells you where email for this domain is handled.
NS Record: Name server. Tells you which DNS provider manages the domain.
TXT Record: Text data. Often contains SPF records (email sending policies), DMARC policies, and sometimes verification tokens that reveal which services the domain uses.
CNAME Record: Canonical name. Points one domain to another. Useful for finding related domains.

The MX record is particularly valuable. If a domain uses Google Workspace for email, the MX record points to Google’s servers. That tells you their login portal is at a standard Google URL. If they use Microsoft 365, it points to Microsoft. If they self-host, the MX record may reveal their internal mail server hostname and IP.

Reverse IP Lookup

Once you have the server’s IP address from the A record, find every other domain hosted on that same IP. This is a reverse IP lookup.

Use viewdns.info/reverseip/ or yougetsignal.com/tools/web-sites-on-web-server/. Enter the IP address. The tool returns all domains sharing that server.

If your target domain shares an IP with five other domains, investigate those domains too. They may be related projects, test environments, or personal sites owned by the same individual. One of them may have a less careful configuration and leak information the target domain protects.

Practical Workflow

Run whois example.com. Document registrar, dates, and name servers.
Check historical WHOIS on whois.domaintools.com. Look for unredacted records.
Run dig example.com ANY. Document A, MX, NS, and TXT records.
Run a reverse IP lookup on the A record IP. Investigate all co-hosted domains.
Cross-reference any discovered emails, names, or phone numbers against other modules.

Lecture 6.2: Subdomain Discovery & Enumeration

A domain is rarely just a single website. Organizations set up subdomains for different services. mail.example.com for email. dev.example.com for development. staging.example.com for testing. admin.example.com for internal tools. Many of these are not meant to be public. Some are exposed anyway.

Certificate Transparency Logs

When a TLS/SSL certificate is issued for a domain, the certificate authority logs it in a public transparency database. This database contains every subdomain that has ever had a certificate issued.

Go to crt.sh. Enter the domain name. The site returns every subdomain that has appeared in a certificate. You will see current subdomains, old subdomains that no longer exist, and internal subdomains the organization never intended to be public.

Example output for — example.com:

example.com
www.example.com
mail.example.com
dev.example.com
staging.example.com
admin.example.com
vpn.example.com

Every one of these is a new target for reconnaissance.

Subdomain Enumeration Tools

Sublist3r automates subdomain discovery by querying multiple sources including search engines, certificate transparency logs, and DNS databases.

Install and run:

git clone https://github.com/aboul3la/Sublist3r.git

cd Sublist3r

python sublist3r.py -d example.com

Amass is a more advanced tool from OWASP. It maps the entire attack surface of a domain by combining DNS enumeration, certificate transparency, web archives, and active scanning.

amass enum -d example.com

Amass produces a comprehensive list of subdomains and can output the results in formats suitable for further analysis.

Subfinder is a fast, lightweight subdomain discovery tool that focuses on passive sources.

subfinder -d example.com

Google Dorks for Subdomain Discovery

You can also use Google to find subdomains that have been indexed:

site:*.example.com -www

This returns all indexed subdomains except the main www site. Combine with keyword filters to find specific services:

site:*.example.com inurl:admin

site:*.example.com inurl:login

site:*.example.com inurl:dev

Practical Workflow

Search the domain on crt.sh. Document every subdomain found.
Run Sublist3r, Amass, or Subfinder for automated discovery.
Use Google dorks to find indexed subdomains.
For each discovered subdomain, visit it. Document what service runs there.
Prioritize dev, staging, admin, and internal subdomains. These are most likely to be misconfigured.

Lecture 6.3: Technology Stack Fingerprinting

Every website is built on a stack of technologies. The web server, the programming language, the content management system, the JavaScript frameworks, the analytics tools, the hosting provider. Identifying this stack tells you what vulnerabilities may exist and how the site is maintained.

Wappalyzer

Wappalyzer is a browser extension that fingerprints the technology stack of any website you visit. Install it on your investigation browser. Visit the target site. Click the Wappalyzer icon. It displays:

Web server (Apache, Nginx, IIS)
CMS (WordPress, Drupal, Joomla)
JavaScript frameworks (React, Angular, Vue)
Analytics (Google Analytics, Hotjar)
CDN (Cloudflare, Fastly)
Hosting provide

This takes five seconds and gives you a complete technical profile.

BuiltWith

BuiltWith is a web-based tool that goes deeper than Wappalyzer. Enter a domain. BuiltWith returns the technology stack, technology history (showing when tools were added or removed), and a list of other sites using the same technologies.

The technology history is the unique value here. You can see that a site switched from WordPress to Shopify in 2022, or that they stopped using a particular analytics tool. Changes in technology stack indicate organizational changes.

WhatWeb

WhatWeb is a command-line tool for bulk technology fingerprinting. Install it:

git clone https://github.com/urbanadventurer/WhatWeb.git

cd WhatWeb

./whatweb example.com

The output is a single line of identified technologies. WhatWeb can scan multiple domains in sequence, which is useful when you have a list of subdomains to profile.

Practical Workflow

Install Wappalyzer. Visit the target site. Document the technology stack.
Run the domain through BuiltWith. Document the technology history.
For bulk analysis across subdomains, use WhatWeb.
Cross-reference identified technologies against known vulnerability databases. An outdated WordPress version or an exposed phpMyAdmin instance is a red flag.
Document everything. The technology stack tells you how the site is built and maintained. That context informs every other step of your investigation.

Lecture 6.4: Directory Enumeration & Exposed Files

Web servers sometimes have directory listing enabled. This means you can browse the server’s file structure like a folder on your desktop. Even without directory listing, predictable directory names often exist and can be discovered through brute-force enumeration.

Manual Directory Discovery

Start with common paths. Append these to the target domain and see what loads:

example.com/robots.txt

/robots.txt
/sitemap.xml
/admin/
/login/
/backup/
/uploads/
/.git/
/.env
/wp-admin/
/phpmyadmin/
/server-status/

robots.txt is especially valuable. It tells search engines what not to crawl. Those disallowed paths are often the most sensitive directories on the site. Read them carefully.

Gobuster

Gobuster is a directory and file brute-forcing tool. It takes a wordlist of common directory names and tests each one against the target domain.

Install:

sudo apt install gobuster

Run:

gobuster dir -u https://example.com -w /usr/share/wordlists/dirb/common.txt

Gobuster returns every directory that exists on the server, including hidden ones. Common wordlists include common.txt, big.txt, and specialized lists for specific CMS platforms.

Dirb

Dirb is a simpler alternative to Gobuster. It does the same job with less configuration:

dirb https://example.com

ffuf

ffuf (Fuzz Faster U Fool) is a high-speed web fuzzer that can enumerate directories, files, parameters, and subdomains.

ffuf -u https://example.com/FUZZ -w /usr/share/wordlists/dirb/common.txt

The FUZZ keyword is replaced by each entry in the wordlist. ffuf is fast and highly configurable.

Finding Exposed Files

Use Google dorks to find exposed files that search engines have already indexed:

site:example.com filetype:pdf

site:example.com filetype:xlsx

site:example.com filetype:sql

site:example.com filetype:env

site:example.com filetype:log

site:example.com filetype:bak

These queries find PDF documents, spreadsheets, database backups, environment configuration files, server logs, and backup files that are publicly accessible.

Practical Workflow

Manually check common paths like /robots.txt, /admin/, /.env, and /backup/.
Run Gobuster or ffuf with a comprehensive wordlist.
Use Google dorks to find indexed exposed files.
For any discovered files, download them. Analyze them. A .env file may contain database credentials. A .sql file may contain an entire database dump. A .log file may contain internal IP addresses and server paths.
Document every exposed resource. These are security failures, and they are intelligence gold.

Lecture 6.5: SSL/TLS Certificate Analysis

SSL/TLS certificates encrypt traffic between the user and the server. But the certificates themselves are public. They contain domain names, organization details, and issuance dates. Analyzing certificates reveals related domains and organizational information.

Viewing a Certificate

Click the padlock icon in your browser’s address bar. View the certificate details. You will see:

Issued to (domain name).
Issued by (certificate authority).
Validity period.
Subject Alternative Names (SANs) — other domains covered by the same certificate.

The SAN list is the most valuable field. A single certificate may cover example.com, www.example.com, mail.example.com, and internal.example.com. All of these are now known subdomains.

crt.sh

As covered in Lecture 6.2, crt.sh searches certificate transparency logs. Enter a domain. The site returns every certificate ever issued for that domain and its subdomains. This is passive and comprehensive.

SSLScan

SSLScan tests a server’s SSL/TLS configuration and reports supported protocols, cipher suites, and certificate details.

sslscan example.com

The output shows whether the server supports outdated protocols like SSLv3 or TLS 1.0, which are vulnerable to known attacks. This is useful for vulnerability assessment, but as an OSINT investigator, you are documenting it as a finding about the organization’s security posture.

Practical Workflow

View the certificate in your browser. Document the SAN list.
Search the domain on crt.sh. Document all historical certificates and their SANs.
Run sslscan for a technical profile of the server’s SSL configuration.
Cross-reference any new subdomains discovered through certificate analysis against the other lectures in this module.

Lecture 6.7: Automated Email Discovery with EmailCrawl

Finding email addresses manually across a website is slow. You can scan the page source of each page, check the contact section, and look through the footer. But on a large site with hundreds of pages, you will miss things. EMAIL-CRAWL automates this.

What EMAIL-CRAWL Is

EMAIL-CRAWL is an open-source Python tool that spiders a target domain, crawls every page it finds, and extracts every email address embedded in the HTML. It is designed specifically for OSINT reconnaissance and email intelligence gathering.

GitHub repository: https://github.com/techenthusiast167/EMAIL-CRAWL

Installation & Dependencies

Step 1: Download the script directly using wget with the 'Raw' link

wget -O EmailCrawl.py https[:]//gist.github.com/techenthusiast167/ed827569e6c464b042bbdd2a53847675

Step 2: Open the script in nano for verification

nano EmailCrawl.py

Step 3: Install the required Python dependencies

pip3 install requests beautifulsoup4 colorama tldextract tabulate lxml

EMAIL-CRAWL uses requests and beautifulsoup4 for HTTP requests and HTML parsing, along with a crawling engine to move through the site. The requirements file handles all dependencies.

Basic Usage

Run EMAIL-CRAWL against a target domain:

python emailcrawl.py example.com

EMAIL-CRAWL starts at the homepage, follows every internal link it finds, and extracts any email address from each page. The output is a deduplicated list of every email address discovered across the entire site arranged in tabular format for easy analysis.

Example output:

Controlling the Crawl Depth

Large sites can take time to crawl fully. You control the scope with two flags:

python emailcrawl.py example.com --max-pages 100 --max-depth 2

--max-pages 100 limits the crawl to 100 pages maximum. Once the tool hits this number, it stops. This prevents endless crawling on massive sites.
--max-depth 2 controls how deep the crawler goes. Depth 0 is the starting page. Depth 1 is pages linked from the starting page. Depth 2 is pages linked from those pages.

For most investigations, a max depth of 2 and a page limit of 100 is sufficient to cover the main sections of a site without getting lost in archives, blog pagination, or infinite loops.

Output to File

Save the results for your investigation records:

python3 EmailCrawl.py https://target-company.com --output ./intel/results.json

The --output flag specifies the file path where results are saved. In this example, the tool writes all discovered emails to results.json inside the intel directory. The output is structured JSON, which means you can parse it programmatically, import it into other tools, or read it directly.

Each entry contains the email address and the page where it was found, giving you full traceability back to the source.

What You Do With the Emails

Every email address EMAIL-CRAWL extracts becomes a pivot point. Plug each one into your email investigation workflow from Module 3. Run them through Google dorks. Search them on breach databases. Check if they are linked to social media accounts. A single corporate email address can lead to LinkedIn profiles, GitHub accounts, and personal websites.

If EMAIL-CRAWL finds john.doe@target.com, and you already know from LinkedIn that John Doe is the CTO, you have just confirmed his corporate email address. That is a direct contact path and an attribution anchor.

Practical Workflow

Clone and install EMAIL-CRAWL from GitHub.
Run it against the target domain with --max-pages 100 --max-depth 2.
Filter for corporate domain emails.
Plug each email into your email intelligence workflow from Module 3.
Cross-reference discovered emails against LinkedIn, breach databases, and social media.
Document the emails, their sources, and any associated intelligence.

Full Documentation

For complete usage instructions, all available flags, advanced configuration options, and output formats, refer to the official repository documentation:https://github.com/techenthusiast167/EMAIL-CRAWL

The README covers everything from installation to advanced crawling strategies. If you need to customize the crawl behavior beyond what was covered here, the documentation is your first stop.

Lecture 6.8: Advanced Document Discovery — Extracting Hidden Files from Target Websites

Sometimes the most valuable intelligence on a website is not on the pages. It is in the files the owner forgot about. Backups. Internal PDFs. Spreadsheets. Configuration files. Database dumps. These files sit in directories with no links pointing to them. You cannot find them by browsing. You find them by thinking like an attacker and using the same techniques security professionals use to map exposed surfaces.

This lecture covers ethical, passive techniques to discover and extract publicly accessible documents from websites. Everything covered here works on files that are openly available. You are not bypassing authentication. You are not exploiting vulnerabilities. You are finding what was left in the open.

Part 1: Common File Types That Leak Intelligence

Before you start searching, know what you are looking for. Certain file types are more likely to contain valuable data.

File Type_____________What It Might Contain

.pdf > Internal reports, strategy documents, training manuals, board minutes
.xlsx / .xls> Financial data, employee lists, project plans, client databases
.docx / .doc> Contracts, policies, internal memos, executive correspondence
.csv > Exported databases, contact lists, transaction records
.sql > Database dumps with user data, credentials, and table structures
.env > Environment configuration files with API keys and database passwords
.log> Server logs with internal IPs, error messages, and user activity
.bak / .backup> Backup files of websites, databases, or configuration
.json> API responses, configuration files, structured data exports
.xml> Sitemaps, configuration files, data exports
.txt> Notes, credentials, internal documentation
.pem / .key> Private keys and certificates

Each of these is a potential intelligence goldmine. Your job is to find them.

Part 2: Google Dorking for File Discovery

Start passive. Google has already indexed millions of exposed files. Use dorks to find them.

Find Specific File Types on a Domain

site:target.com filetype:pdf

site:target.com filetype:xlsx

site:target.com filetype:sql

site:target.com filetype:env

site:target.com filetype:log

site:target.com filetype:bak

Find Files with Specific Keywords

site:target.com filetype:pdf “confidential”

site:target.com filetype:xlsx “password”

site:target.com filetype:sql “CREATE TABLE”

site:target.com filetype:env “DATABASE_URL”

site:target.com filetype:docx “internal”

Find Backup Files

site:target.com inurl:backup

site:target.com intitle:”index of” “backup”

site:target.com ext:bak

Find Directory Listings with Exposed Files

site:target.com intitle:”index of” “parent directory”

site:target.com intitle:”index of” “.pdf”

site:target.com intitle:”index of” “.sql”

These dorks return files that are publicly accessible. Google found them. You can access them. Download and analyze.

Keep in mind, what Google missed might be present on Yandex. Different search engines crawl different parts of the web. Google dominates the Western internet. Yandex indexes more deeply into Eastern European and Russian content. Bing often catches what both miss. Endeavor to run the same dorks across Google, Yandex, and Bing for effective intelligence gathering. A PDF invisible to Google may be the first result on Yandex. Do not leave intelligence on the table because you only searched one engine.

Part 3: How to Discover File Paths Before Downloading

You cannot download what you cannot find. Before you run any download command, you need to know the file exists and where it lives. Here are the techniques to discover hidden file paths.

Method 1: Search Engines (Passive Discovery)

The fastest way to find exposed files is to let search engines do the work. Each result is a direct URL to a file already indexed. You did not guess it. The search engine found it for you. Run dorks across Google, Yandex, and Bing. Collect every URL found.

Method 2: robots.txt Mining

The robots.txt file tells search engines what not to crawl. These disallowed paths are often the most sensitive areas of the site. The owner is literally telling you where the good stuff lives.

curl -s https://target.com/robots.txt

If the output shows:

Disallow: /internal-docs/
Disallow: /wp-content/uploads/private/
Disallow: /backup/

You now have three directory paths to investigate. Every disallowed path is a directory worth probing. The owner does not want these indexed. That means they contain something worth hiding.

Method 3: Sitemap.xml Enumeration

The sitemap lists every page the owner wants search engines to find. Sometimes it includes files they did not realize were listed.

curl -s https://target.com/sitemap.xml | grep -i “.pdf”

curl -s https://target.com/sitemap.xml | grep -i “.xlsx”

curl -s https://target.com/sitemap.xml | grep -i “.sql”

Any matching URLs are direct file paths. The owner published them. You just extracted them.

Method 4: Directory Listing Discovery

Some servers leave directory listing enabled. When you visit a directory URL, instead of a web page, you see a list of every file in that folder.

Find these with Google:

site:target.com intitle:”index of” “parent directory”

Or probe common upload directories directly in your browser:

https://target.com/uploads/

https://target.com/wp-content/uploads/

https://target.com/files/

https://target.com/documents/

https://target.com/backup/

https://target.com/media/

If any of these display a file list instead of a 403 or 404 error, you have found an open directory. Every filename in that list is a direct download path.

Method 5: Curl Header Probing

Once you suspect a file exists, confirm it without downloading.

You think there might be a backup file at:

https://target.com/backup/database.sql

Probe it:

curl -I https://target.com/backup/database.sql

If the response is 200 OK, the file exists. You now have a confirmed path. If the response is 404 Not Found, it is not there. Move on to the next candidate.

Method 6: Wordlist-Based File Discovery

This technique lets you probe a website for common files without manually typing each URL. You create a list of filenames, then run a script that checks each one automatically.

Step 1: Create the Wordlist File

Open your terminal. Create a new file called common_files.txt:

nano common_files.txt

Paste the following list into the file:

backup.zip
database.sql
backup.sql
dump.sql
export.csv
report.pdf
users.xlsx
config.json
.env
archive.tar.gz
old_site.zip
internal-report.pdf
wp-config.php
phpinfo.php
adminer.php
server-status
.git/config
.DS_Store

Save and exit. In nano, press Ctrl + X, then Y, then Enter .

Step 2: Write the Bash Loop Script

Create a new script file:

nano probe_files.sh

Paste the following:

#!/bin/bash


# Check if a directory URL was provided
if [ -z “$1” ]; then
    echo “Usage: bash probe_files.sh https://target.com/uploads/”
    echo “Make sure the URL ends with a forward slash.”
    exit 1
fi

TARGET_DIR=”$1”
WORDLIST=”common_files.txt”

# Check if wordlist exists
if [ ! -f “$WORDLIST” ]; then
    echo “[-] Wordlist file ‘$WORDLIST’ not found.”
    echo “Create it with common filenames, one per line.”
    exit 1
fi

echo “[*] Probing files in: $TARGET_DIR”
echo “[*] Wordlist: $WORDLIST”
echo “”

while read file; do
    # Skip empty lines and comments
    [[ -z “$file” || “$file” =~ ^# ]] && continue
    
    response=$(curl -s -o /dev/null -w “%{http_code}” “${TARGET_DIR}${file}”)
    
    if [ “$response” = “200” ]; then
        echo “[FOUND] ${TARGET_DIR}${file} — Status: $response”
    elif [ “$response” = “301” ] || [ “$response” = “302” ]; then
        echo “[REDIRECT] ${TARGET_DIR}${file} — Status: $response”
    elif [ “$response” = “403” ]; then
        echo “[FORBIDDEN] ${TARGET_DIR}${file} — Exists but access denied”
    else
        echo “[NOT FOUND] ${TARGET_DIR}${file} — Status: $response”
    fi
done < “$WORDLIST”

echo “”
echo “[*] Probing complete.”

Save and exit (Ctrl + X, Y, Enter).

Step 3: Make the Script Executable

chmod +x probe_files.sh

Step 4: Run the Script

bash probe_files.sh https://target.com/uploads/

Make sure the URL ends with a forward slash. The script appends each filename from your wordlist to this base URL and checks if it exists.

Step 5: Read the Output

The script shows the status of each probed file:

[*] Probing files in: https://target.com/uploads/
[*] Wordlist: common_files.txt

[NOT FOUND] https://target.com/uploads/backup.zip - Status: 404
[FOUND] https://target.com/uploads/database.sql - Status: 200
[NOT FOUND] https://target.com/uploads/backup.sql - Status: 404
[NOT FOUND] https://target.com/uploads/dump.sql - Status: 404
[FOUND] https://target.com/uploads/export.csv - Status: 200
[FOUND] https://target.com/uploads/report.pdf - Status: 200
[FORBIDDEN] https://target.com/uploads/.env - Exists but access denied
[NOT FOUND] https://target.com/uploads/archive.tar.gz - Status: 404
[*] Probing complete.

Every [FOUND] result is a confirmed file path. You discovered it through methodical probing. Now download it with curl -O.

Step 6: Download the Discovered Files

For each [FOUND] URL, run:

curl -O https://target.com/uploads/database.sql

curl -O https://target.com/uploads/export.csv

curl -O https://target.com/uploads/report.pdf

You now have local copies for analysis.

Step 7: Customizing Your Wordlist

Add more filenames to common_files.txt based on your target.

If you are investigating a WordPress site, add WordPress-specific files:

wp-config.php.bak
wp-config.php.old
wp-content/debug.log

If investigating a company, add company-specific guesses:

employee-list.xlsx
salary-2024.pdf
board-minutes.docx

The better your wordlist matches the target, the more files you will discover. Build your wordlists over time. Save them. Reuse them across investigations.

Method 7: Wayback Machine Discovery

The Wayback Machine archives files, not just pages. If a file was once publicly accessible, it might be archived.

Search for file paths on the Wayback Machine:

https://web.archive.org/web/*/target.com/uploads/*

https://web.archive.org/web/*/target.com/*.pdf

If a snapshot exists, the Wayback Machine gives you the direct URL the file once lived at. The original file may still be there. Probe it with curl -I. If it returns 200, download it.

Part 4: Curl for Header and File Probing

Curl is a command-line tool that fetches data from URLs. It is more surgical than a browser. You can probe for files, check headers, and download documents without ever clicking a link.

Check if a File Exists Without Downloading It

curl -I https://target.com/backup/database.sql

The -I flag fetches only the HTTP headers. If the server returns 200 OK, the file exists. Document it.

Probe Common Backup and Config Files

curl -I https://target.com/.env

curl -I https://target.com/backup.zip

curl -I https://target.com/database.sql

curl -I https://target.com/admin/backup.tar.gz

curl -I https://target.com/robots.txt

curl -I https://target.com/sitemap.xml

Each 200 OK response tells you a file exists and is publicly accessible.

Download a File for Analysis

curl -O https://target.com/wp-content/uploads/2023/01/internal-report.pdf

The -O flag saves the file with its original filename. You can now open it, analyze it, and extract metadata.

Download and Pipe Directly to Analysis

curl -s https://target.com/document.pdf | strings | grep -i “password”

This downloads the file, extracts readable strings, and searches for the word “password” all in one command. You never save the file. You just extract the intelligence.

Part 5: Recursive Download with Wget

Wget is a command-line downloader that can mirror entire directory structures. When you find an open directory, Wget downloads everything in it.

Mirror an Open Directory

wget -r -np -R “index.html*” https://target.com/uploads/

Breakdown:

-r — Recursive. Follows links within the directory.
-np — No parent. Stays within the specified directory.
-R "index.html*" — Rejects index.html files. You want the documents, not the directory listing page.

Wget downloads every file in that directory. PDFs, spreadsheets, backups, everything. You now have a local copy for analysis.

Mirror with a Delay (Polite Scraping)

wget -r -np -w 2 --limit-rate=200k https://target.com/uploads/

-w 2 — Waits 2 seconds between requests. Polite. Reduces server load.
--limit-rate=200k — Limits download speed to 200KB/s. Less aggressive.

Be polite. You are an investigator, not an attacker. Aggressive downloading can crash the target server and turns your ethical investigation into a denial-of-service attack.

Download Only Specific File Types

wget -r -np -A “*.pdf,*.xlsx,*.docx,*.sql” https://target.com/uploads/

The -A flag accepts only the specified file types. Everything else is ignored. This is surgical extraction.

Part 6: Extracting Metadata from Discovered Documents

Once you have downloaded documents, extract their metadata. The same EXIF techniques from Module 2 apply here.

Extract PDF Metadata

exiftool document.pdf

Look for:

Author name (often a real employee name).
Software used (reveals internal tools).
Creation and modification dates.
Embedded usernames or file paths.

Extract Office Document Metadata

exiftool report.docx

Word and Excel documents embed author names, company names, and sometimes internal network paths. A document authored by “John Doe” with the company “Acme Corp” and the file path \\internal-server\shared\finance\ tells you who wrote it, where they work, and what their internal network structure looks like.

Part 7: Extracting Images from Target Websites for Analysis

Images on a website carry intelligence. Employee photos. Office locations. Product prototypes. Event photographs. Screenshots of internal tools. Every image is a potential source of metadata, geolocation data, and visual evidence.

This section covers how to discover, download, and analyze images from a target website ethically.

What Images Can Reveal

Image Type___________Potential Intelligence

Staff photos: Employee identities, dress code, office environment
Office photos: Interior layout, security measures, building location
Event photos: Attendees, partnerships, dates and venues
Product photos: Unreleased products, manufacturing details, prototypes
Screenshots: Internal software, usernames, project names
Document scans: Full documents accidentally published as images
Logo files: Brand assets, company identity
Background images: Office views that can be geolocated

Manual Extraction via Page Source

Before reaching for automated tools, learn to pull images directly from the page source. This works on any page, requires no tools, and often surfaces images that automated crawlers miss.

Step 1: Open the Page Source

Navigate to the target page. Right-click anywhere on the background. Select “View Page Source.” A new tab opens with the raw HTML.

Step 2: Search for Image Files

Press Ctrl + F to open the search bar. Search for common image extensions one at a time:

.jpg
.jpeg
.png
.gif
.svg
.webp
.ico

Each search jumps to a line containing that extension. You will see image URLs embedded in src, data-src, srcset, and content attributes.

Step 3: Extract the Full URLs

When you find a match, copy the full image URL. It will look something like:

Open the URL in a new browser tab. If the image loads, right-click and save it to your investigation folder.

Step 4: Search for Hidden Image Paths

Some images are referenced in JavaScript, CSS, or JSON blobs. Search for these patterns:

background-image
url(
og:image
twitter:image
favicon

These often point to images not visible in standard img tags but still publicly accessible.

Step 5: Check the Page with Inspect Element

Right-click on any image on the page. Select “Inspect” or “Inspect Element.” The developer tools panel opens, highlighting the exact HTML that renders that image. Look for the src attribute. Copy the full URL. This method catches images loaded dynamically by JavaScript that may not appear in the static page source.

Step 6: Bulk Download from Manual Extraction

Once you have pulled image URLs from the page source, you do not need to open each one individually. Feed them all into a downloader at once.

Extract all image URLs from the page source and download them in one command.

curl -s https://target.com | grep -oP ‘(https?://[^”]*\.(jpg|jpeg|png|gif|svg|webp))’ | sort -u | while read url; do curl -O “$url”; done

Breakdown:

curl -s https://target.com — Fetches the page source silently.
grep -oP '(https?://[^"]*\.(jpg|jpeg|png|gif|svg|webp))' — Extracts every image URL ending in common extensions.
sort -u — Removes duplicates.
while read url; do curl -O "$url"; done — Downloads each unique image to the current folder.

This is fast. One command. Every image on the page lands in your working directory.

Automated Image Extraction with WebRecon

Manual extraction works for small pages. For comprehensive collection across an entire website, use WebRecon, a purpose-built OSINT image reconnaissance tool.

GitHub Repository: https://github.com/techenthusiast167/WebRecon

WebRecon crawls a target website, extracts every image it finds, and organizes everything into a structured intelligence package. No complex setup. No API keys. Point it at a URL and it handles the rest.

What WebRecon Produces

When you run WebRecon against a target, it generates a complete output folder containing:

Output__________Description

raw/ >Full-resolution original images as they appear on the target site
thumbnails/> Smaller thumbnail versions for quick visual browsing
gallery.html> An interactive HTML gallery with all images arranged neatly, filterable by filename, and displaying metadata alongside each image
image_summary.csv> A spreadsheet containing every image URL, filename, alt text, file type, dimensions, and source page
metadata.json>tructured JSON file with all extracted metadata for programmatic analysis or import into other tools

How to Use WebRecon

Step 1: Direct Download using Wget

wget -O WebRecon.py https://gist.githubusercontent.com/techenthusiast167/dfdaff3b49df63a86e7860376288b7d3/raw/64ae31387c8e79cb39a7d0ace8f706a4cc6c06af/webrecon.py

Step 2: Install Dependencies

pip install requests beautifulsoup4 colorama tabulate tldextract dnspython python-whois pillow networkx pyvis lxml html5lib pysocks urllib3

Step 3: Run WebRecon

python3 webrecon.py https://target.com

WebRecon begins crawling the target site. It discovers images embedded in img tags, srcset attributes, CSS backgrounds, meta tags, and lazy-loaded elements. All images are downloaded and organized into the output folder.

Step 4: Open the Gallery

Navigate to the output folder and open gallery.html in your browser. You will see every image displayed with its filename, source URL, alt text, and file type. Use the filter bar to search images by keyword. Click any image to open the full-resolution version.

Step 5: Analyze the CSV

Open image_summary.csv in any spreadsheet application. Sort by filename, file type, or source page. Identify patterns. All staff photos in one directory. All product images in another. The CSV gives you a bird’s-eye view of every image asset on the target site.

Step 6: Use the JSON Metadata

Load metadata.json into any analysis tool or script. The structured format allows you to automate further processing. Feed image URLs into reverse image search scripts. Cross-reference filenames against known patterns.

Reverse Image Search for Attribution

Every image extracted can be traced back to its source or found elsewhere on the internet using reverse image search. This is how you discover if a staff photo appears on LinkedIn, if a product image matches a competitor’s catalog, or if a background photo has been used elsewhere with location tags.

Take any image from the raw/ folder or one you manually extracted. Upload it to:

Google Lens: https://lens.google.com — Best for general search and object identification.
Yandex Images: https://yandex.com/images — Superior for facial matching and Eastern European sources.
TinEye: https://tineye.com — Best for tracking when and where an image first appeared.
Bing Images: https://www.bing.com/images — Often catches results missed by Google.

If the image appears on a LinkedIn profile, you have a name. If it appears on a news article, you have context and a date. If it appears on a different domain, you have a connection between the two sites. Reverse image search turns a photograph into an attribution bridge.

Other WebRecon Capabilities

WebRecon is a full-spectrum website reconnaissance tool built for OSINT investigators. It handles crawling, email harvesting, social media discovery, image extraction, technology detection, DNS enumeration, document discovery, relationship graphing, and reporting.

For full documentation, usage examples, and configuration options, refer to the repository: https://github.com/techenthusiast167/WebRecon

Part 8: Practical Workflow Summary

Phase 1: Passive Discovery

Google dork the domain. Run site:target.com filetype:pdf and all other file type dorks. Repeat every dork on Yandex and Bing. Different engines index different files. Do not leave intelligence on the table.
Check robots.txt. Pull curl -s https://target.com/robots.txt. Note every disallowed directory. The owner is telling you where the sensitive files live. Probe each one.
Pull sitemap.xml. Run curl -s https://target.com/sitemap.xml | grep -i ".pdf" and repeat for .xlsx, .sql, .docx, and other extensions. Files listed here were published by the owner.
Check the Wayback Machine. Search https://web.archive.org/web/*/target.com/*.pdf. Historical snapshots reveal file paths no longer on the live site.

Phase 2: Active Probing

5. Visit common directories in your browser. Try /uploads/, /wp-content/uploads/, /files/, /documents/, /backup/, /media/, /assets/. Look for directory listings. If you see a file list instead of a 403 or 404, you found an open directory.

6. Probe suspected file paths with curl -I. Confirm existence without downloading. 200 OK means the file is there. 404 means move on.

Phase 3: Download

7. Mirror open directories with wget. Run wget -r -np -R "index.html*" to download everything inside. Add -w 2 to be polite. Add -A to filter by file type.

8. Download discovered files with curl -O. For individual confirmed files, pull them directly.

9. Extract images. Start manual. View the page source and search for .jpg, .png, .gif, .svg, .webp. Extract key images directly. Use Inspect Element on images that appear on the page but not in the static source. For bulk download, extract all image URLs with curl -s https://target.com | grep -oP '(https?://[^"]*\.(jpg|jpeg|png|gif|svg|webp))' | sort -u > image_urls.txt and download.

10. For full coverage, run WebRecon. python3 webrecon.py https://target.com. Open gallery.html for visual browsing. Review image_summary.csv for structured data. Use metadata.json for programmatic analysis.

Phase 4: Analysis

11. Extract metadata from every document. Run exiftool on PDFs, Office documents, and images. Pull author names, software versions, creation dates, GPS coordinates, and internal file paths.

12. Run reverse image search on key images. Use Google Lens, Yandex, TinEye, and Bing. Find where else they appear. Cross-reference with LinkedIn, news articles, and other domains.

13. Document everything. File names, full URLs, metadata fields, dates of access, and your analysis. If it is not documented, it did not happen.

Ethical Reminder

Every technique in this lecture targets publicly accessible files. You are not bypassing logins. You are not exploiting vulnerabilities. You are not accessing anything the server does not willingly serve to anyone who asks.

If a file is protected by authentication, you stop. If a directory returns 403 Forbidden, you move on. Aggressive scanning can crash a server. Use delays between requests. Limit your download speed.

This is reconnaissance, not intrusion. Stay on the right side of that line. Your reputation and your freedom depend on it.

Module 7: Advanced Investigative Tradecraft

Most OSINT courses stop at tools and techniques. They teach you how to find data. They do not teach you how to think about what you found, how to protect the identity you use to find it, or how to move from one piece of data to the next without getting lost.

This module fills those gaps. You will learn how to build and maintain sock puppets that survive scrutiny. You will learn structured analytic techniques that force you to challenge your own conclusions. And you will learn how to pivot, the single most important skill in any investigation. Knowing how to move from one data point to the next, in the right order, without chasing noise, is what separates productive investigators from people who just collect bookmarks.

Lecture 7.1: Sock Puppet Management & Anti-Suspension Tactics

Module 0 taught you to create a sock puppet. That was the start. Creation is easy. Maintenance is hard. A sock puppet that gets suspended on day three is worse than no sock puppet at all because you lost the time you invested and potentially exposed your investigation.

This lecture is about keeping your persona alive, credible, and undetected for the duration of your investigation and beyond.

Part 1: Building a Believable Backstory

A sock puppet is not a username and a profile picture. It is a person. People have histories. They have interests. They have friends. They have opinions. The more complete your persona, the less likely a platform is to flag it as fake.

Start with the basics — Name, location, occupation. Keep these close to reality. If you have never been to Berlin, do not make your persona a Berlin native. You will slip up. A platform may ask for location verification. Someone may message you in German. Keep the persona within your own knowledge base.

Give the persona a plausible birth year — Not too young. Platforms flag accounts claiming to be 18 with zero digital history. Not too old. A 65-year-old joining TikTok for the first time is unusual. Aim for 25–40. Old enough to have a history. Young enough to be platform-native.

Give the persona interests — Three to five hobbies that align with the investigation’s needs. If you are investigating motorcycle forums, your persona should like motorcycles. If you are investigating corporate fraud, your persona should work in finance or compliance. The interests are your reason for being in the spaces you need to access.

Write this backstory down. Keep it in a text file inside your investigation VM. You will forget details over time. The file is your memory.

Part 2: Aging the Account

A brand-new account with zero friends, zero posts, and a profile picture uploaded ten minutes ago is a red flag. Platforms use account age and activity patterns to detect bots and fake profiles. You must age your sock puppet before you use it for any sensitive work.

Create the account — Upload a profile picture. Fill out the bio. Add a few interests. Then leave it alone for at least two weeks. Preferably a month. During this time, log in occasionally. Scroll the feed. Like a few posts from public figures or brands. Do not add friends yet. Do not join groups. Do not message anyone. Just exist.

After the aging period, start building activity slowly — Post once or twice a week. Nothing controversial. Nothing investigative. Share a news article with a neutral comment. Post a photo of a coffee cup with no location tag. Comment on a public post with something generic and friendly. The goal is to create a normal-looking activity history.

Add friends gradually — Five in the first week after aging. Ten the next. Do not add fifty people in one day. That is bot behavior. Accept friend requests from real accounts. Let the network build naturally.

Part 3: Anti-Suspension Tactics

Platforms suspend accounts that trigger their automated detection systems. You need to know what triggers them.

IP Consistency

Your sock puppet lives in a specific location. Its IP address should reflect that. If you created the account while connected through a VPN in Manchester, always log into that account through a Manchester IP. If you switch to a New York IP tomorrow, the platform sees a user who teleported across the Atlantic. That triggers a security check.

Use a dedicated VPN server for each sock puppet. Document which server belongs to which persona. Never mix them.

Browser Fingerprint Consistency

Your browser fingerprint is a combination of your screen resolution, installed fonts, timezone, language settings, browser version, and dozens of other data points. Platforms use this to identify you across sessions.

If you created the sock puppet in Firefox with a specific set of privacy extensions and a 1920x1080 screen resolution, always use that same configuration for that persona. The Brave browser’s fingerprinting protection helps, but consistency matters more than protection. A consistent fingerprint is a normal fingerprint.

Activity Patterns

Real people do not log in at 3 AM every day for exactly twelve minutes, perform the same actions, and log out. They check their phone throughout the day. Sometimes they spend an hour scrolling. Sometimes they check for thirty seconds and close the app. Vary your activity. Log in at different times. Stay logged in for different durations. Do different things.

Avoiding Platform Triggers

Do not send friend requests to strangers at high volume. Do not post the same message in multiple groups. Do not use temporary email addresses for account creation. Do not use phone numbers from free SMS verification services. These are all known bot patterns.

If a platform asks for phone verification, provide it from a real number. Burner phones are an operational expense. Accept it. A $30 prepaid phone saves a sock puppet you spent a month building.

Part 4: When to Retire a Sock Puppet

No sock puppet lasts forever. Eventually, it will be compromised, suspended, or simply outlive its usefulness. Know when to retire it.

Signs it is time to retire:

The platform has requested identity verification you cannot provide.
The account has received unusual attention from other users suggesting someone is investigating you back.
The account has been flagged or restricted by the platform.
The investigation it was built for is complete and the persona is no longer needed.
You suspect your canary tokens have been triggered, indicating someone has accessed files or links associated with the puppet.

When retiring, do not delete the account abruptly. That looks suspicious. Wind it down. Post less. Engage less. Let it go dormant. If you need to return to the same investigative space later, you do not want a trail of deleted accounts connected to your operational IP range.

Part 5: Tools for Sock Puppet Management

Burner phones: Prepaid SIM cards from local retailers. Cash purchase. No ID required.
Dedicated VPN servers: One per persona. Document the mapping.
Password manager: Store credentials inside your investigation VM. Never on your host machine.
Canary tokens: Embed these in documents or links associated with your persona. If someone accesses them, you receive an alert. This tells you someone is investigating you.
This Person Does Not Exist: thispersondoesnotexist.com generates AI-created faces for profile pictures. Reverse image search returns nothing. The face is not real. It cannot be traced to a real person.

Lecture 7.2: Structured Analytic Techniques for OSINT

Collecting data is easy. Making sense of it is hard. Structured analytic techniques are frameworks developed by the intelligence community to reduce bias, challenge assumptions, and evaluate evidence systematically. They turn a pile of findings into a defensible conclusion.

Part 1: Analysis of Competing Hypotheses (ACH)

ACH is a method for evaluating multiple possible explanations against the evidence you have collected. Instead of picking the explanation you like and looking for evidence to support it, ACH forces you to list all possible explanations and test each one against every piece of evidence.

Here is the process

Step 1: Define the Question

Be specific — “Who is behind the anonymous account @Allen123?” Not “What is going on with this account?” Precision matters.

Step 2: List All Possible Hypotheses

Write down every possible answer — Do not filter yet. Include options you think are unlikely. Include options you do not want to be true. The goal is to exhaust the possibilities.

Example:

H1: The account is operated by a lone individual with no affiliation.
H2: The account is operated by a competitor conducting corporate espionage.
H3: The account is operated by a state-sponsored actor.
H4: The account is operated by an insider at the target company.
H5: The account is a bot or automated persona with no human operator.

Step 3: List All Evidence

Write down every piece of evidence you have collected. Only include verified evidence. Not assumptions. Not guesses. Things you can source.

Example:

E1: Account created March 2025.
E2: Posts exclusively during 9 AM–5 PM GMT.
E3: Profile picture hashes to a LinkedIn photo of a known competitor employee.
E4: Writing style uses British English spelling.
E5: Account has never posted from a mobile device (only web client).

Step 4: Create a Matrix

Put hypotheses across the top. Put evidence down the side. For each cell, rate whether the evidence is consistent ©, inconsistent (I), or neutral (N) with that hypothesis.

Step 5: Refine and Eliminate

Look at the matrix. H2 (Competitor) has the fewest inconsistencies. H1 has an inconsistency on E3. H5 has an inconsistency on E2 (bots do not keep office hours). The evidence points toward H2. You do not conclude H2 is correct. You conclude H2 is the most consistent with the available evidence. That is an important distinction.

Step 6: Identify Gaps

What evidence would disprove your leading hypothesis? If H2 is correct, you would expect the account to post about competitor products. If it does not, that weakens H2. Identify the missing evidence. Go find it.

ACH does not give you certainty. It gives you clarity about what the evidence actually supports and where your gaps are.

Part 2: Key Assumption Check

Every investigation rests on assumptions. Some are explicit. Most are not. A Key Assumption Check forces you to list your assumptions and test whether they are valid.

Step 1: List Your Assumptions

Write down everything you are assuming about the investigation. Be honest.

Example:

“The target is operating from the country their IP address suggests.”
“The target’s LinkedIn profile accurately reflects their employment.”
“The email address found on the website belongs to the target.”
“The profile picture is actually a photo of the target.”
“The target is a single individual, not a group.”

Step 2: Rate Each Assumption

For each assumption, ask: what evidence supports this? If the answer is “none” or “it seems reasonable,” the assumption is weak.

Rate them:

Solid: Supported by multiple independent sources.
Plausible: Supported by some evidence but not confirmed.
Weak: No supporting evidence. Just feels true.

Step 3: Challenge the Weak Assumptions

For every weak assumption, ask: what if this is wrong? How would that change my conclusions?

If you assumed the target is in the UK because their IP says London, but they are actually using a VPN, your entire location assessment is wrong. If you assumed the LinkedIn profile is real but it is a fabricated persona, your attribution falls apart.

Step 4: Document the Check

Write down your assumptions, their ratings, and the impact if they are wrong. Include this in your report. It shows the client you have thought critically about your own work. It protects you if an assumption later proves false.

Part 3: Cognitive Biases to Guard Against

Your brain works against you in investigations. Here are the biases that destroy OSINT work.

Confirmation Bias: You look for evidence that supports your initial theory and ignore evidence against it. Counter this by actively searching for disconfirming evidence. If you think the target is in London, search for evidence they are not in London.

Anchoring Bias: The first piece of information you receive carries disproportionate weight. A flashy finding early in an investigation can anchor your thinking even if later evidence contradicts it. Counter this by revisiting early conclusions regularly.

Availability Bias: You overweight information that is easy to recall. A dramatic news article about a company feels more significant than a dry regulatory filing, even if the filing contains more relevant information. Counter this by weighting evidence based on reliability, not memorability.

Stereotyping Bias: You assume patterns based on demographic characteristics. “The target is a young male, so he must be technically skilled.” This is lazy. Counter this by building your profile on evidence, not assumptions.

Knowing these biases exist does not make you immune. The structured techniques exist because even trained analysts fall for them. Use the frameworks. They protect you from yourself.

Part 4: Evidence Evaluation and Confidence Ratings

Not all evidence is equal. Rate your evidence by source reliability and information credibility.

Source Reliability:

A: Reliable — Proven track record. Official records. Verified accounts.
B: Usually Reliable — Generally trustworthy. Minor inconsistencies.
C: Unreliable — History of inaccuracy. Unverified claims.
D: Unknown — New source. No track record.

Information Credibility:

1: Confirmed — Corroborated by multiple independent sources.
2: Probably True — Consistent with other evidence but not independently confirmed.
3: Possibly True — Plausible but unconfirmed.
4: Doubtful — Inconsistent with other evidence.
5: Unlikely — Contradicted by reliable evidence.

Every finding in your report should carry a rating. “The target’s date of birth is May 1962” with a rating of A1 (Reliable source, independently confirmed) is solid. “The target may have ties to a competitor” with a rating of D3 (Unknown source, unconfirmed) is speculation. Label it accordingly.

Lecture 7.3: The Art of Pivoting

Pivoting is the core skill of OSINT investigation. You start with one piece of data. An email address. A username. A phone number. From that single point, you move outward. Each new discovery becomes a new starting point. The investigation expands until you have a complete picture.

Pivoting without a plan leads to chaos. You chase every link. You open fifty tabs. You collect data with no structure. At the end of the day, you have a lot of bookmarks and no conclusions.

This lecture teaches you to pivot with purpose.

Part 1: What Is a Pivot Point

A pivot point is any piece of data that connects to another piece of data. It is the bridge between where you are and where you need to go.

Common pivot points:

Email address → Links to social media accounts, breach databases, domain registrations.
Username → Links to other platforms, forum posts, GitHub repositories.
Phone number → Links to messaging apps, public records, carrier lookups.
Profile picture → Links to other accounts via perceptual hash matching.
Name → Links to corporate registries, news articles, court records.
Domain → Links to WHOIS records, subdomains, email servers, IP addresses.
Physical address → Links to property records, other residents, nearby businesses.

Every piece of data you collect is a potential pivot point. Not every pivot point is worth pursuing. Knowing which ones to chase and in what order is the skill.

Part 2: The Pivot Hierarchy

When you have multiple pivot points available, pursue them in this order. This hierarchy prioritizes high-value, high-reliability pivots over speculative ones.

Tier 1: Official Records

Corporate registries. Court filings. Property records. Government databases. These are the most reliable sources available. They carry legal weight. They are rarely falsified. If you have a name, pivot to Companies House or SEC EDGAR first. If you have an address, pivot to property records first. Official records anchor your investigation in verifiable fact.

Tier 2: Platform Metadata

User IDs. Account creation dates. Linked accounts. These are platform-assigned and unchangeable. A numeric user ID extracted from Facebook page source is a permanent identifier. An account creation timestamp from GitHub is a temporal anchor. These pivots are technically verifiable and resistant to manipulation.

Tier 3: Self-Reported Identity Data

Social media bios. LinkedIn profiles. Personal websites. Forum signatures. These are what the target says about themselves. They may be accurate. They may be aspirational. They may be fabricated. Treat them as leads, not facts. Verify against Tier 1 and Tier 2 before relying on them.

Tier 4: Third-Party Mentions

News articles. Blog posts. Other people’s social media posts. These are what others say about the target. They provide context but are subject to the biases and errors of the source. A news article quoting the target is Tier 4. The court filing the article references is Tier 1. Always trace back to the original source.

Tier 5: Inferred Connections

Patterns you observe but cannot directly verify. Similar writing styles. Overlapping interests. Timezone correlations. These are analytical leads, not evidence. They guide further investigation. They do not go in your final report as facts.

Part 3: The Pivot Decision Framework

When you are at a data point and deciding where to pivot next, ask yourself four questions.

Question 1: What question am I trying to answer?

Every pivot should serve an investigative objective. “I need to confirm the target’s location.” “I need to find a corporate email address.” “I need to link this anonymous account to a real identity.” If a pivot does not help answer a specific question, deprioritize it.

Question 2: Is this pivot point reliable?

A corporate registry filing is reliable. A random forum post claiming the target lives in a specific city is not. Prioritize Tier 1 and Tier 2 pivots before chasing Tier 4 and 5.

Question 3: Will this pivot produce new pivot points?

Some pivots are dead ends. A profile picture that hashes to nothing on other platforms stops there. An email address that appears in zero breach databases stops there. That is fine. Not every pivot produces results. But prioritize pivots likely to open new investigation paths.

Question 4: Am I drifting from the objective?

It is easy to fall down rabbit holes. You start investigating a target’s business partner, who leads to their spouse, who leads to their charity work, and suddenly you are three degrees removed from the original question. Set a timer. Every thirty minutes, ask yourself: am I still investigating the right thing?

Part 4: Building a Pivot Map

A pivot map is a visual or written record of every pivot you have made and every pivot still available. It prevents duplication. It shows you where you have been and where you can go next.

The format is simple. For each entity you discover, record:

Entity: What you found (email address, username, company name).
Source: Where you found it (Companies House, Instagram page source, GitHub commit).
Confidence: A1 through D5 based on the rating system from Lecture 9.2.
Pivot Options: What new paths this entity opens.
Status: Pending, In Progress, Completed, Dead End.

Example:

This map keeps your investigation organized. When you hit a dead end, you consult the map and see what other pivots are still pending. You never waste time wondering what to do next.

Part 5: Knowing When to Stop Pivoting

Pivoting is addictive. There is always one more link to follow. One more profile to check. One more database to search. The best investigators know when to stop.

Stop pivoting when:

You have answered the investigative question. The client asked for a risk assessment on a potential business partner. You have confirmed their identity, their corporate associations, their adverse media status, and their digital footprint. You have enough. Stop.
New pivots are producing diminishing returns. Each new branch yields less relevant information. You are learning about the target’s third cousin’s former roommate. This is not intelligence. This is noise.
You are circling back to already-visited entities. If your pivot map shows you revisiting the same types of sources without new findings, you have exhausted the available open source intelligence.
The cost of further investigation outweighs the value. Every hour you spend is an hour the client pays for. If two more days of investigation will not change the risk rating, deliver the report.

You now have the operational tradecraft to sustain investigations over time without burning your persona. You have the analytic frameworks to evaluate what you find and challenge your own conclusions. You have the pivoting methodology to move through an investigation with purpose, not chaos.

Anyone can learn to run a tool. Anyone can memorize dorks. What you have now is different. You know how to think through an investigation. How to structure your analysis. How to protect yourself while you work. How to move from one data point to the next with discipline.

These are the skills that separate collectors from analysts. A collector gathers data. An analyst understands what it means. Be the analyst.

Module 8: Dark Web Intelligence & .onion Investigation

The dark web is not as mysterious as movies make it seem. It is simply a part of the internet that is not indexed by standard search engines and requires specific software to access. Criminals use it. Whistleblowers use it. Journalists use it. Activists use it. For an investigator, it is another intelligence source. Nothing more. Nothing less.

Most OSINT courses either ignore the dark web entirely or treat it like forbidden territory. This module takes a different approach. You will learn how the dark web works, how to access it safely, how to find intelligence on it, and how to stay on the right side of the law while doing it.

This is not a hacking module. You will not learn to buy anything. You will not learn to exploit anyone. You will learn to observe, document, and extract intelligence from a part of the internet most investigators never touch.

Lecture 8.1: Understanding the Dark Web — How It Actually Works

Before you access anything, you need to understand the infrastructure.

The Three Layers of the Internet

The internet is not one thing. It has layers.

Surface Web: Everything indexed by Google, Bing, and Yandex. News sites, social media, corporate websites. This is where you have spent the entire course so far. The surface web is about 4% of the total internet.

Deep Web: Everything not indexed by search engines but still accessible with a standard browser. Your email inbox. Your bank account after login. Private databases. Paid research portals. Company intranets. You access the deep web every day. It is not illegal. It is just not indexed.

Dark Web: Websites that require specific software to access. The most common is Tor, which uses .onion domains. These sites are not indexed by Google. They cannot be reached through Chrome or Firefox without Tor. The dark web is a small fraction of the deep web.

The dark web is not inherently criminal. Tor was created by the US Naval Research Laboratory. It is used by journalists, activists, whistleblowers, and privacy-conscious individuals. Criminals also use it because it provides anonymity. Your job is to navigate it professionally and ethically.

How Tor Works

Tor stands for The Onion Router. It works by encrypting your traffic in layers and bouncing it through three random relays around the world.

Your traffic enters the Tor network through a guard relay.
It passes through a middle relay.
It exits through an exit relay and reaches the destination website.

Each relay only knows the previous hop and the next hop. No single relay knows both where the traffic came from and where it is going. This provides anonymity for both the user and the website operator.

When you visit a .onion site, the traffic never leaves the Tor network. There is no exit relay. Both you and the website remain anonymous.

Lecture 8.2: Setting Up a Safe Investigation Environment

You cannot investigate the dark web from your personal machine. You need a dedicated, isolated environment that protects your identity and contains any potential threats.

The Recommended Setup: Whonix

Whonix is an operating system designed for anonymous investigation. It runs as two virtual machines inside VirtualBox.

Whonix Gateway: Routes all traffic through Tor. No traffic can leave this VM without going through Tor.
Whonix Workstation: Your investigation environment. You do all your work here. It has no internet connection except through the Gateway.

If the Workstation is compromised, the attacker cannot find your real IP address because all traffic is forced through Tor via the Gateway. This is the safest setup for dark web investigation.

Installation Steps:

Install VirtualBox on your host machine.
Download Whonix from https://www.whonix.org. Choose the VirtualBox version.
Import both VMs (Gateway and Workstation) into VirtualBox.
Start the Gateway first. Wait for it to connect to Tor.
Start the Workstation. All internet access from the Workstation now routes through Tor.

Setting Up Whonix for ANONYMOUS Tor Browsing (Dark Web Documentary - By John Hammond:

Alternative: Tails OS

Tails is a live operating system that runs from a USB stick. It routes all traffic through Tor and leaves no trace on the host machine. It is designed for single-session use. When you shut down Tails, everything is wiped.

Tails is good for quick investigations. Whonix is better for ongoing work where you need to save evidence and return to it.

Browser Setup Inside Your Investigation Environment

The Tor Browser comes pre-installed in both Whonix and Tails. It is a modified version of Firefox configured for maximum privacy.

JavaScript is partially disabled on high-security settings.
Browser fingerprinting is minimized.
All traffic goes through Tor.
No plugins. No extensions. No exceptions.

Do not install Chrome. Do not install Firefox. Use only the Tor Browser inside your investigation VM. Anything else compromises your anonymity.

Dark Web Documentary 01 - Getting Setup with Tails Linux - by John Hammond:

Alternative Setup: Tor Browser on Kali Linux (Quick Start)

If you are using Kali Linux and need a fast, functional Tor setup without building virtual machines, install the Tor Browser directly.

Step 1: Install Tor Browser Launcher

Open your terminal and run:

sudo apt update
sudo apt install torbrowser-launcher -y

Step 2: Launch and Connect

Once installed, launch it from your Kali application menu by searching for “Tor Browser,” or run from the terminal:

torbrowser-launcher

The first time you run this, it automatically downloads the latest signature-verified version of the Tor Browser. This ensures you get an authentic, untampered copy.

Once it opens, click Connect to join the Tor network. You are now browsing through Tor.

Important Notes for This Setup:

This is a quick-start method. It is less isolated than Whonix. Your host machine’s IP is still visible to anyone who compromises your browser.
Use this for low-risk investigation and learning. For sensitive dark web work, switch to Whonix.
Never run Tor Browser as the root user. The launcher handles permissions correctly.
Keep Tor Browser updated. The launcher checks for updates on each launch.

When to Use Each Setup

Setup ————Best For ——— Security Level

Tor Browser on Kali > Quick lookups, learning, low-risk browsing > Basic
Tails OS > Single-session investigations, no trace left > High
Whonix > Ongoing investigations, evidence preservation > Maximum

Lecture 8.3: Navigating the Dark Web — Finding .onion Sites

There is no Google for the dark web. .onion sites are not indexed by traditional search engines. You need specialized tools to find them.

Dark Web Search Engines

These search engines index .onion sites. They are accessible only through Tor.

Ahmia: ahmia.fi — The most reliable dark web search engine. It indexes public .onion sites and filters out known malicious content. Also accessible on the surface web at ahmia.fi to search for .onion links.
Torch: torch.search.onion (accessible only via Tor) — One of the oldest dark web search engines. Larger index but less filtered than Ahmia.
Darkfail: darkfaillnbn.onion (accessible only via Tor) — A directory of known dark web sites with status indicators showing which are currently online.

Dark Web Directories and Wikis

Directories are human-curated lists of .onion links organized by category.

The Hidden Wiki: Multiple versions exist. These are community-edited directories of dark web sites. Quality varies. Some links are outdated. Some point to scams. Navigate carefully.
Onion Links: onionlinks.net — A surface web site that catalogs .onion links by category.

How to Search Effectively

Start with Ahmia. Search for keywords related to your investigation.
Check Darkfail for directories organized by topic.
Use The Hidden Wiki for categorized listings.
Document every .onion URL you find. Dark web sites disappear and reappear frequently.
Verify before trusting. A .onion site claiming to be a news outlet may be a front for disinformation.

Lecture 8.4: Investigating .onion Sites — What to Document

Once you find a .onion site, treat it like any other website investigation. Document everything.

What to Capture:

URL: The full .onion address. These are long, seemingly random strings.
Site Name and Purpose: What does the site claim to be?
Content Categories: Forums, marketplaces, information dumps, communication platforms.
Language: Many dark web sites are in English, but Russian, Chinese, and other languages are common.
Registration Requirements: Does the site require an account? If so, document the registration process. Do not register unless absolutely necessary for your investigation and you have legal authorization.
Date of Access: Dark web sites disappear. The date you accessed it matters.
Screenshots: Capture the homepage and key pages. Preserve evidence.
Public Content: Any messages, posts, files, or images that are publicly visible without login.

What NOT to Do:

Do not register an account without legal authorization. Many dark web sites are monitored by law enforcement. Registration may link your identity to a criminal platform.
Do not download files. Dark web files may contain malware. If you must download, do it inside a disposable VM with no network access.
Do not interact with users. You are an observer. Not a participant.
Do not purchase anything. Even for research. Even to see what happens. This crosses from investigation into criminal activity.

Lecture 8.5: Extracting Intelligence from Dark Web Content

Public dark web content carries intelligence just like surface web content.

Forum Reconnaissance

Many .onion sites are forums. Users post messages, share files, and discuss topics. Public forums can be read without an account.

Read thread titles. Find topics relevant to your investigation.
Document usernames. Cross-reference them against surface web platforms. Criminals sometimes reuse handles.
Look for PGP keys. Many dark web users sign messages with PGP keys. These keys are unique and can be cross-referenced.
Note posting patterns. Timezone indicators, language proficiency, and writing style are behavioral intelligence.
Document any linked accounts. Users sometimes mention their Telegram, Signal, or Jabber handles.

Marketplace Observation

Dark web marketplaces exist. You can browse some of them without an account.

Document the categories of goods sold. This tells you what the marketplace facilitates.
Note vendor usernames and ratings. Cross-reference vendors across multiple marketplaces.
Look for shipping restrictions. “Ships to EU only” tells you the vendor’s likely location.
Document accepted cryptocurrencies. Bitcoin and Monero are standard. Some accept newer privacy coins.

File and Document Analysis

Some .onion sites host files. Documents, databases, and images.

If a file is publicly downloadable and your investigation requires it, download it inside a disposable, air-gapped VM.
Extract metadata from the file using ExifTool.
Check the file hash against known malware databases.
Analyze the content offline. Disconnect the VM from all networks before opening any file.

Paste Sites and Information Dumps

Dark web paste sites are like Pastebin but on .onion domains. Users post text, code, credentials, and messages.

Search paste sites for email addresses, usernames, and keywords related to your target.
Document timestamps. Pastes have creation dates.
Cross-reference paste content with breach data from Module 10.

Lecture 8.6: Cryptocurrency Tracing Basics

Dark web transactions use cryptocurrency. Following the money is a core OSINT skill.

Bitcoin Tracing

Bitcoin is pseudonymous, not anonymous. Every transaction is recorded on a public ledger called the blockchain.

Tools:

Blockchain.com Explorer: blockchain.com/explorer — Search any Bitcoin address or transaction ID.
WalletExplorer: walletexplorer.com — Links Bitcoin addresses to known wallets and services.
OXT: oxt.me — Visual Bitcoin transaction mapping tool.

What to Look For:

Transaction history of a known dark web wallet address.
Addresses that interact with known exchange wallets (Coinbase, Binance). These can be subpoenaed for identity information.
Clusters of addresses that appear to belong to the same entity.

Monero Tracing (Limited)

Monero is designed for privacy. Transactions are not publicly traceable like Bitcoin. However, OSINT techniques still apply.

Look for Monero addresses shared publicly on forums or paste sites.
Cross-reference the address with any surface web mentions.
Network analysis of who shares the same Monero address across different platforms.

Lecture 8.7: OSINT Tools for the Dark Web

Several surface web tools provide dark web intelligence without requiring direct access.

Ahmia.fi: Search .onion sites from the surface web.
OnionScan: onionscan.org — Scans .onion sites for misconfigurations and exposed metadata.
Hunchly: A web capture tool designed for OSINT investigations. Works with Tor Browser to automatically capture and timestamp pages you visit.
DarkSearch: A dark web search engine accessible on the surface web.

Lecture 8.8: Legal and Ethical Boundaries

The dark web is legally sensitive territory. Many sites host illegal content. You must operate within strict boundaries.

What Is Legal:

Accessing public .onion sites.
Viewing publicly visible content.
Documenting publicly available information.
Using Tor for privacy.
Cross-referencing dark web data with surface web sources.

What Is Not Legal:

Accessing sites that host child exploitation material. If you encounter this, close the browser immediately. In some jurisdictions, even accidental access carries legal risk. Report via appropriate channels if your role requires it.
Purchasing illegal goods or services.
Interacting with criminal actors without law enforcement coordination.
Downloading illegal content.
Hacking or attempting to bypass authentication on dark web sites.

If You Encounter Illegal Content:

Close the browser tab immediately.
Document the URL and the circumstances in your investigation notes.
Do not download anything. Do not screenshot illegal content.
If you are working with law enforcement, follow their reporting procedures.
If you are an independent investigator, consult a lawyer before proceeding further.

The dark web contains disturbing material. Be prepared for that. Have a plan for what you will do when you encounter it. Your psychological safety matters.

Lecture 8.9: Practical Investigation Workflow Summary

Set up a Whonix or Tails investigation environment. Never use your personal machine.
Launch the Tor Browser from inside the environment.
Use Ahmia and Darkfail to find .onion sites relevant to your investigation.
Document every .onion URL, site name, and category.
Browse public forums and pages. Screenshot key content. Document usernames, PGP keys, and posting patterns.
Cross-reference dark web usernames with surface web platforms.
Search paste sites for email addresses, usernames, and keywords.
Trace cryptocurrency addresses related to your target using blockchain explorers.
Never register accounts. Never download files to a network-connected machine. Never interact with users.
Document everything. Screenshots, URLs, timestamps, and your analysis.

Lecture 8.10: Practical Investigation — From Dark Web Marketplace to Real-World Attribution

This exercise walks you through a simulated investigation. You will trace a threat actor from a dark web marketplace to their real-world identity using only OSINT techniques. Every step applies what you learned in this module and across the entire course.

The Scenario

You are investigating a vendor on a dark web marketplace who sells stolen credentials and compromised accounts. The vendor uses the handle ShadowVendor88. Their marketplace profile shows:

Username: ShadowVendor88
Joined: March 2024
Ships from: “EU”
PGP Key ID: 0xABCD1234EFGH5678
Accepted payment: Bitcoin and Monero
Public posts: 47 forum messages in the marketplace discussion section

Your objective is to identify the real-world person behind ShadowVendor88 using only publicly available information.

Phase 1: Profile Documentation

Start by documenting everything visible on the marketplace profile. You do not need an account to browse public sections of many marketplaces.

Document:

Username: ShadowVendor88
Join date: March 2024
Region: “EU”
PGP Key ID: 0xABCD1234EFGH5678
Post count: 47
Writing style from visible posts
Any linked contact methods (Telegram, Jabber, email)

This is your baseline. Every piece of data is a potential pivot point.

Phase 2: PGP Key Cross-Referencing

The PGP key is your strongest lead. PGP keys are unique. If the same key appears anywhere on the surface web, you have a direct link.

Step 1: Copy the PGP Key ID: 0xABCD1234EFGH5678.

Step 2: Search the key ID on PGP key servers:

https://keyserver.ubuntu.com
https://pgp.mit.edu

Enter the key ID. If the key is publicly registered, you will find the full public key and any associated email addresses or names.

Step 3: Search the key ID on Google:

“ABCD1234EFGH5678”
“0xABCD1234EFGH5678”
“ShadowVendor88” “PGP”

If the vendor reused this PGP key on a surface web forum, a GitHub repository, or a personal website, Google will find it.

What you might find:

The same PGP key associated with a GitHub account under a real name.
The same key used on a privacy-focused forum where the user also listed a Protonmail address.
The key registered on a keyserver with an email address attached.

Each of these is a direct bridge from the dark web persona to a surface web identity.

Phase 3: Username Cross-Referencing

Threat actors reuse usernames. It is lazy. It is human. Exploit it.

Step 1: Search ShadowVendor88 on Google, Yandex, and Bing.

“ShadowVendor88”
“ShadowVendor88” site:reddit.com
“ShadowVendor88” site:github.com
“ShadowVendor88” site:twitter.com
“ShadowVendor88” site:telegram.me
“ShadowVendor88” site:t.me

Step 2: Search username permutations. If ShadowVendor88 is taken on one platform, the user may use ShadowVendor, ShadowVendor8, Shadow.Vendor, or ShadowVendor_88 on others.

Step 3: Search username search engines:

whatsmyname.app
Sherlock
Maigret

What you might find:

A Reddit account with the same handle posting in r/hacking and r/darknet.
A GitHub account with a repository containing scripts for credential stuffing.
A Twitter account with the same handle discussing privacy tools.

Phase 4: Writing Style Analysis

Read the 47 forum posts from ShadowVendor88. Analyze the writing style.

Look for:

Spelling: British English or American English? “Colour” vs “Color” tells you where they learned English.
Grammar patterns: Do they use commas before “and”? Do they capitalize properly?
Slang and idioms: Regional phrases. “Mate” suggests UK or Australia. “Buddy” suggests North America.
Technical jargon: How they describe their products. What tools they reference.
Punctuation habits: Double spaces after periods. Em dash vs en dash. These are fingerprints.

Now search surface web forums, Reddit, and Twitter for posts with the same writing patterns. Use specific phrases from their dark web posts in quotes.

Example: If ShadowVendor88 wrote “fresh logs, guaranteed valid, no refunds” on the marketplace, search that exact phrase on Google. Threat actors often reuse the same sales copy across platforms.

Phase 5: Cryptocurrency Tracing

The vendor accepts Bitcoin. Their marketplace profile lists a Bitcoin address for payments.

Step 1: Copy the Bitcoin address.

Step 2: Search it on blockchain.com/explorer and walletexplorer.com.

Step 3: Look at transaction history:

Does the address send funds to a known exchange wallet? Coinbase, Binance, Kraken? Exchanges require identity verification. The exchange knows who owns that wallet.
Does the address receive funds from other known dark web wallets? This maps their network.
Does the address interact with any surface web services that require registration?

Step 4: Search the Bitcoin address on Google:

“1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa” (example format)

If the vendor ever posted this address on a forum, a social media post, or a website, Google finds it. Many threat actors share wallet addresses carelessly.

Phase 6: Email Discovery

Through PGP key searches, username cross-referencing, or cryptocurrency tracing, you may discover an email address.

Example: The PGP keyserver shows the key is registered to shadowvendor88@protonmail.com.

Now apply Module 3 email intelligence:

Search the email on breach databases (Have I Been Pwned, DeHashed, IntelX).
Search the email on Google: "shadowvendor88@protonmail.com".
Check if the email is linked to any surface web accounts via password reset probing (ethical, passive only).
Cross-reference the email against social media platforms.

If a breach database returns a real name, physical address, or phone number associated with that email, you have attribution.

Phase 7: Social Media Attribution

Through the email address or username, you found a LinkedIn profile, a Twitter account, or a GitHub repository.

Step 1: Open the surface web profile. Document everything.

Step 2: Compare the profile picture. Does it match any image posted by ShadowVendor88 on the marketplace?

Step 3: Compare the join date. If the surface web account was created in February 2024 and the dark web account in March 2024, you have a timeline correlation.

Step 4: Compare technical skills. If the LinkedIn profile lists “Penetration Testing” and “Python Scripting,” and the dark web vendor sells credential stuffing tools written in Python, you have a skill correlation.

Step 5: Compare location. If the dark web profile says “Ships from EU” and the LinkedIn profile says “Located in Frankfurt, Germany,” you have a geographic correlation.

Phase 8: Building the Attribution Case

You now have multiple correlation points. Present them as a structured attribution case.

Phase 9: The Attribution Statement

Write a clear, evidence-backed attribution statement.

The dark web marketplace vendor operating under the handle ShadowVendor88 is identified as John Doe of Frankfurt, Germany. Attribution is established through: (1) PGP key correlation linking the dark web persona to a GitHub account under the name John Doe, (2) Username reuse across dark web and surface web platforms, (3) Consistent writing style patterns across both personas, (4) Bitcoin address shared between the dark web marketplace and a Reddit account linked to John Doe, (5) Email address correlation through breach data, (6) Geographic consistency between the dark web shipping region and surface web location, and (7) Professional skill alignment between the dark web activity and surface web employment history.

Phase 10: Reporting and Evidence Preservation

Compile all evidence into a structured report using Module 10 methodology.
Include an entity graph showing ShadowVendor88 connected to John Doe through PGP key, email, Bitcoin address, username, and writing style.
Preserve all screenshots with timestamps.
Document all sources with access dates.
Store evidence in a secure, encrypted location.
If working with law enforcement, follow their chain of custody procedures.

What You Learned

This exercise applied techniques from across the entire course. Dark web reconnaissance. PGP key cross-referencing. Username permutation searching. Writing style analysis. Cryptocurrency tracing. Email intelligence. Social media attribution. Report writing.

Every dark web persona leaves traces on the surface web. Your job is to find them. The dark web provides anonymity, not invisibility. Mistakes happen. Keys get reused. Usernames get recycled. Writing styles remain consistent. Bitcoin addresses get posted publicly.

Follow the threads. Build the case. Attribute the actor.

Part 11: Quick Reference

Objective ________________Method

Safe investigation environment: Whonix (VirtualBox) or Tails (USB boot)
Browser: Tor Browser (pre-installed in Whonix/Tails)
Find .onion sites: Ahmia, Torch, Darkfail
Search dark web: Ahmia.fi (surface web accessible)
Cryptocurrency tracing: Blockchain.com Explorer, WalletExplorer, OXT
Evidence capture: Hunchly, manual screenshots
Username cross-reference: Dark web usernames → surface web search
PGP key cross-reference: Search PGP key fingerprints on surface web
File analysis: Disposable VM, ExifTool, hash check

This is Dark Web Intelligence. It is not magic. It is not forbidden. It is another intelligence source that requires discipline, preparation, and strict ethical boundaries. Set up your environment. Know what you are looking for. Document what you find. Get out safely. That is how professionals operate.

Module 9: Image Forensics & Hidden Data Recovery

Images carry more than what meets the eye. Hidden text. Manipulated pixels. Encoded messages. Altered timestamps. An investigator who only looks at the surface of an image misses half the intelligence it contains.

This module teaches you how to analyze images forensically, recover hidden information, and decode encoded data. You will use free tools like Photopea for image manipulation, CyberChef for encoding and decoding, and Python scripts to automate the process. Every technique is practical. Every example is hands-on.

Lecture 9.1: Introduction to Image Forensics — What Images Hide

Images are not flat. They contain layers of information. Some of it is visible. Much of it is not.

Every image file carries metadata (EXIF, as covered in Module 2). Beyond metadata, images can contain:

Hidden text or objects concealed by darkening, blurring, or overlaying.
Encoded messages embedded in pixel values or color channels.
Manipulated regions where part of the image was altered or cloned.
Steganography where entire files are hidden inside the image data.
Compression artifacts that reveal whether an image was edited or resaved.

This module focuses on the practical techniques to uncover these hidden elements. You will not need expensive forensic software. Photopea/Forensically and CyberChef are free and browser-based. Everything you learn here works with tools you already have.

Lecture 9.2: Photopea for Investigators — Image Manipulation & Analysis

Photopea is a free, browser-based image editor. It works like Photoshop but requires no installation. You open it at https://www.photopea.com and start working immediately.

What Photopea Can Do for OSINT:

Adjust brightness, contrast, and exposure to reveal hidden details in dark images.
Zoom into high-resolution images without losing clarity.
Layer multiple images to compare differences.
Remove overlays and watermarks where possible.
Convert between file formats.
Analyze individual color channels (Red, Green, Blue) to see what each layer contains.

Getting Started:

Go to https://www.photopea.com
Click “Open From Computer” or drag an image file into the browser window.
The image opens in a workspace similar to Photoshop.

Key Tools for Investigation:

Brightness/Contrast: Image → Adjustments → Brightness/Contrast. Increase brightness on dark images to reveal details hidden in shadows.
Levels: Image → Adjustments → Levels. Drag the white slider left to brighten highlights. Drag the black slider right to darken shadows. This reveals details that a simple brightness adjustment misses.

Exposure: Image → Adjustments → Exposure. Increase exposure to lighten severely underexposed images.
Zoom Tool: Press Z or use the magnifying glass icon. Zoom into specific areas. Look for pixel-level details.

Lecture 9.3: Darkening and Restoration — Revealing Hidden Details

One of the most common ways people hide information in images is by darkening the image until the content becomes invisible. A screenshot containing sensitive text is darkened until the text blends into the black background. The person sharing it assumes no one can read it. They are wrong.

How to Restore a Darkened Image in Photopea:

Step 1: Open the darkened image in Photopea.

Step 2: Go to Image → Adjustments → Levels.

Step 3: In the Levels window, you will see a histogram showing the distribution of dark and light pixels. A heavily darkened image has almost all pixels bunched on the left (dark) side.

Step 4: Grab the white slider (far right) and drag it left. As you drag, the image brightens. Hidden details emerge from the darkness.

Step 5: Adjust the middle (gray) slider to fine-tune the contrast. The goal is to make hidden content readable.

Step 6: If Levels is not enough, try the Auto Correction tools. Go to Image → Adjustments and use:

Auto Tune: Automatically balances brightness and contrast across the image. A good first step for quick restoration.
Auto Contrast: Adjusts the contrast automatically. Useful when the image has both very dark and very light areas.
Auto Color: Corrects color imbalances while adjusting brightness. Helps when the darkened image has a color tint.

Step 7: If details are still hidden, go to Image → Adjustments → Exposure. Increase the Exposure slider. This brightens every pixel uniformly and often reveals content that other adjustments miss.

Keep in mind that combining these options often produces better results than relying on a single adjustment. Start with Auto Tune. If that does not fully restore the image, apply Levels. If details remain hidden, add Exposure. The order matters. Experiment until the hidden content becomes readable.

Lecture 9.4: Hiding and Recovering Secret Text with Darkening Techniques

Some individuals intentionally hide text by making it the same color as the background. For example, white text on a white background, or black text on a black background. The text is there. The human eye cannot see it. The image data contains it.

How to Reveal Hidden Text:

Method 1: Levels Adjustment

Open the image in Photopea. Apply Levels as described in Lecture 12.3. If the text is slightly lighter or darker than the background, adjusting the levels will reveal it.

Method 2: Color Channel Isolation

On Photopea, go to Window → Channels. You will see the Red, Green, and Blue channels. Click each channel individually. Sometimes hidden text is visible in one channel but not the others. The Red channel might show text that is invisible in the full-color image.

Method 3: Invert Colors

Go to Image → Adjustments → Invert. This flips all colors to their opposites. Black becomes white. White becomes black. Hidden white text on a white background becomes black text on a black background after inversion, but subtle differences in shade may now be visible.

Method 4: Posterize

Go to Image → Adjustments → Posterize. Reduce the number of color levels. This simplifies the image into distinct color bands. Text that was only slightly different from the background may become clearly visible as a separate color band.

Practical Example:

A threat actor posts what appears to be a blank white image. You download it. Open it in Photopea. Isolate the Red channel. Text appears. It is a message. The actor used white text on a white background. The Red channel gave them away.

Lecture 9.5: CyberChef for OSINT — Encoding & Decoding Basics

CyberChef is a free, browser-based data processing tool. It is often called the “Cyber Swiss Army Knife.” You open it at https://gchq.github.io/CyberChef. It requires no installation.

What CyberChef Can Do for OSINT:

Decode Base64, Hex, Binary, and other encodings.
Decrypt Caesar ciphers and other simple ciphers.
Convert between data formats.
Extract strings and patterns from raw data.
Analyze encoded messages found in images, documents, or communications.

How CyberChef Works:

CyberChef has four areas:

Operations Panel (left): A list of all available operations. You search for what you need.
Recipe Panel (center): The sequence of operations you apply to your data. You drag operations here.
Input Panel (top right): Where you paste the data you want to decode.
Output Panel (bottom right): Where the result appears.

Basic Workflow:

Copy encoded text from your source (an image caption, a forum post, a file).
Paste it into the Input panel.
Use the magic for auto detection of encoded words or search for the decoding operation you need in the Operations panel.
Double-click or drag it to the Recipe panel.
The Output panel shows the decoded result instantly.

Lecture 9.6: Caesar Cipher — Manual and Automated Decoding

A Caesar cipher is one of the oldest and simplest encryption methods. Each letter in the message is shifted by a fixed number of positions in the alphabet. A shift of 3 turns A into D, B into E, and so on.

Threat actors, puzzle creators, and privacy-conscious individuals sometimes use Caesar ciphers to hide messages in plain sight. You will find them in social media bios, forum signatures, and image captions.

Manual Decoding:

Write out the alphabet. Shift each letter in the encoded message backward by the same number. If the shift is 3, D becomes A, E becomes B. Try different shift values until the message makes sense.

Automated Decoding with CyberChef:

Copy the encoded text.
Go to https://gchq.github.io/CyberChef.
In the Operations panel, search for “ROT13” or “Caesar.” ROT13 is a Caesar cipher with a shift of 13.
Double-Click or drag it (ROT13) to the Recipe panel.
If ROT13 does not decode it, use the “ROT13 Brute Force” operation (as shown in the image). This tries every possible shift and shows all results. One of them will be readable.
If you prefer manual control over the decoding process, Cryptii is a great alternative. It is a browser-based tool at https://cryptii.com that lets you manually select the cipher type, set the shift value, and see the result in real time. Use it when you want to experiment with different shifts one at a time rather than brute forcing everything at once.
Lecture 9.7: Base64, Hex, and Binary — Decoding Common Encodings
Not all encoded messages use ciphers. Many use data encodings designed for computers to read. These are common in OSINT investigations.
Base64:
Base64 encodes binary data as text. It looks like a random string of letters, numbers, and symbols, often ending with = or ==.
Example: SGVsbG8gV29ybGQ=
To decode in CyberChef:
1. Paste the Base64 string into the Input panel.
2. Use the “Magic stick” for auto string detection or search for “From Base64” in Operations.
3. Drag it to the Recipe panel.
4. The Output shows: Hello World

Hex:

Hexadecimal represents data using base-16 numbers (0-9 and A-F). It often appears in computer logs, error messages, and encoded files.

Example: 48656c6c6f20576f726c64

To decode in CyberChef:

Paste the Hex string into the Input panel.
Search for “From Hex” in Operations.
Drag it to the Recipe panel.
The Output shows: Hello World

Binary:

Binary uses only 0s and 1s. Each group of 8 bits represents one character.

Example: 01001000 01100101 01101100 01101100 01101111

To decode in CyberChef:

Paste the Binary string into the Input panel.
Search for “From Binary” in Operations.
Drag it to the Recipe panel.
The Output shows: Hello World

Where You Find These Encodings:

Social media bios (Base64-encoded contact details).
Forum signatures (Hex-encoded messages).
Image metadata fields (Base64-encoded data).
Paste sites (Binary-encoded messages).
Email headers (Base64-encoded subject lines).

Lecture 9.8: Steganography — Finding Hidden Files Inside Images

Steganography is the practice of hiding data inside other data. Unlike encryption, which makes a message unreadable, steganography makes a message invisible. A JPEG photo posted on social media might contain a hidden ZIP file. A PNG avatar on a forum might have a text document embedded in its pixel data.

For an investigator, steganography is both a threat and an opportunity. Threat actors use it to communicate covertly. Whistleblowers use it to exfiltrate data. You need to know how to detect it and extract what is hidden.

How Steganography Works

Digital images are made of pixels. Each pixel has color values (Red, Green, Blue). Steganography modifies the least significant bits of these color values. The change is so small the human eye cannot detect it. The image looks normal. But embedded in those tiny changes is an entire hidden file.

Common steganography techniques:

LSB (Least Significant Bit): The most common method. Data is stored in the last bit of each pixel’s color value.
Appended Data: A file is simply appended to the end of an image file. The image still opens normally. The extra data is ignored by image viewers.
Metadata Embedding: Data is hidden inside EXIF or comment fields.
Color Channel Hiding: Data is stored in a specific color channel (Red, Green, or Blue).

Tools for Detecting and Extracting Steganography

Steghide

Steghide is a command-line tool that hides and extracts data from JPEG and BMP images. It is included in Kali Linux.

Install:

sudo apt install steghide

Extract hidden data from an image:

steghide extract -sf image.jpg

When you run this command, steghide will prompt you to enter the passphrase that was used when the data was originally embedded. If there was no passphrase set, simply press Enter. If successful, the hidden file is extracted to your current directory.

Extract to specific filename:

steghide extract -sf image.jpg -xf output.txt

Check if an image contains hidden data (without extracting):

steghide info image.jpg

This tells you whether the image contains embedded data and what type of file it might be.

Format Support: steghide only works with JPEG, BMP, WAV, and AU files. If your image is a .png, steghide won't work on it.

Browser-Based Steganography Tool (No Command Line Required)

If you prefer a graphical interface without touching the terminal, use the browser-based steganography tool at: https://stylesuxx.github.io/steganography.

This tool runs entirely in your browser. No installation. No command line. You upload an image, and it decodes any hidden message embedded in the least significant bits. It also works in reverse. You can encode a message into an image to understand how the process works.

How to decode a hidden message:

Go to https://stylesuxx.github.io/steganography.
Click the Decode tab.
Upload the image you want to analyze.
The tool extracts and displays any hidden text found in the image’s LSB data.

How to encode a message (for testing and learning):

Click the Encode tab.
Upload a clean image.
Type your message in the text field.
Download the new image with the hidden message embedded.

Use this tool when you need a quick steganography check without opening a terminal. It is fast, free, and requires zero setup.

zsteg

zsteg specializes in detecting LSB steganography in PNG and BMP images. It tries multiple methods and reports any hidden data it finds.

Install:

sudo apt install zsteg

If the first command failed, use the below:

Step 1: Install Ruby and Gem

sudo apt install ruby ruby-dev -y

Step 2: Install zsteg via Gem

sudo gem install zsteg

Step 3: Verify Installation

zsteg --help

If it returns the help menu, it is installed correctly.

Step 4: Use zsteg

zsteg image.png

The output shows whether data is hidden in any color channel or bit plane. If data is found, zsteg displays it.

Strings

The strings command extracts readable text from any file, including images. It works by scanning the file for sequences of printable characters and printing them out. If someone appended a text file to the end of an image, strings will find it.

Think of strings like an X-ray for files. The image looks normal on the surface. strings shows you what is inside.

Basic Usage

strings image.jpg

This prints every readable string in the file. The output can be long. You need to filter it.

Filtering with grep

Pipe the output of strings into grep to search for specific keywords.

strings image.jpg | grep -i “password”

This searches for the word “password” anywhere in the file. The -i flag makes it case-insensitive. It matches “Password,” “PASSWORD,” and “password.”

Common Search Patterns

Here are the searches you should run on every suspicious image:

Find Credentials:

strings image.jpg | grep -i “password”
strings image.jpg | grep -i “login”
strings image.jpg | grep -i “username”
strings image.jpg | grep -i “email”
strings image.jpg | grep -i “@”

The @ symbol catches email addresses. Any string containing @ is likely an email.

Find Hidden Files:

strings image.jpg | grep -i “.zip”
strings image.jpg | grep -i “.txt”
strings image.jpg | grep -i “.pdf”
strings image.jpg | grep -i “.doc”
strings image.jpg | grep -i “.exe”

If someone appended a ZIP or other file, the filename may appear in the strings output.

Find URLs and Onion Addresses:

strings image.jpg | grep -i “http”
strings image.jpg | grep -i “.onion”
strings image.jpg | grep -i “www.”

Find Contact Information:

strings image.jpg | grep -i “@”
strings image.jpg | grep -E “[0-9]{10,}”    # Phone numbers (10+ digits)
strings image.jpg | grep -i “telegram”
strings image.jpg | grep -i “bitcoin”
strings image.jpg | grep -i “bc1”

Find Encryption Keys and Hashes:

strings image.jpg | grep -i “pgp”
strings image.jpg | grep -i “key”
strings image.jpg | grep -i “encrypt”
strings image.jpg | grep -E “[A-Fa-f0-9]{32,}”    # MD5/SHA hashes

Showing Context Around Matches

When you find a match, you want to see what is around it. The -A, -B, and -C flags show context.

Show lines AFTER the match:

strings image.jpg | grep -A 50 “CYBERSHIELD”

This prints the matching line plus 50 lines after it. Use this when the data you want follows a header or keyword.

Show lines BEFORE the match:

strings image.jpg | grep -B 20 “END OF DATABASE”

This prints 20 lines before the match. Use this to see what leads up to a known endpoint.

Show lines BEFORE and AFTER the match:

strings image.jpg | grep -C 30 “SELLER INFO”

This prints 30 lines before and 30 lines after the match. Use this to capture an entire section of hidden data in one command.

Controlling String Length

By default, strings prints sequences of 4 or more printable characters. You can adjust this with the -n flag.

strings -n 3 image.jpg

This prints strings as short as 3 characters. Use this for finer granularity, but expect more noise.

strings -n 10 image.jpg

This prints only strings of 10 or more characters. Use this to filter out short, meaningless fragments and focus on longer, meaningful text.

Searching Binary Files Directly with grep

If strings does not find what you need, grep can search the raw binary file directly.

grep -a “CYBERSHIELD” image.jpg

The -a flag tells grep to treat the binary file as text. This searches every byte of the file for the keyword. It is slower but more thorough.

Online Tools

If you prefer a graphical interface, several online tools detect and extract steganography.

StegOnline: https://stegonline.georgeom.net — Upload an image. Browse hidden data across different bit planes. Extract embedded files.
Aperi’Solve: https://aperisolve.fr — Upload an image. It runs multiple steganography tools automatically and displays all results.
Forensically: https://29a.ch/photo-forensics — Provides multiple image forensic tools including steganography detection.

How to Detect Steganography Manually

Not all hidden data requires a tool to find. Some signs are visible.

File size anomalies: A simple 400x400 pixel photo that is 15MB is suspicious. JPEGs of that size are typically a few hundred kilobytes. The extra size may contain hidden data.
Image quality inconsistencies: An image that looks slightly grainy or has visible noise in dark areas may have LSB data embedded.
Metadata inspection: Run exiftool image.jpg. Look for unusually long comment fields, software tags, or custom metadata entries.
Hex dump inspection: Run xxd image.jpg | less. Scroll through the raw data. Look for file headers like PK (ZIP archive) or ‰PNG (PNG image) appearing in the middle or at the end of the file. This indicates an appended file.

Practical Example: Extracting a Hidden ZIP File

A target posts a photo on a forum. The photo looks normal. But the file size is 8MB for a 640x480 image. That is too large.

Step 1: Run strings on the image:

strings photo.jpg | grep -i “.zip”

Output shows: secret.zip. A ZIP file is appended to the image.

Step 2: Extract the appended data using binwalk:

sudo apt install binwalk
binwalk -e photo.jpg

Binwalk scans the file for embedded file signatures and extracts them automatically.

Step 3: Check the extracted folder. The ZIP file is there. If it is password-protected, you will need the passphrase. But the existence of the hidden file is itself intelligence.

Practical Exercise Addendum: The Hidden ZIP Challenge

Return to the image from the Hidden Message Challenge. After decoding the visible message, you suspect there is more. Run steghide on the restored image. Run zsteg. Check the file size. Use strings. There is a ZIP file hidden inside the image. Extract it. The ZIP contains a text file. That file is your final answer.

Quick Reference — Updated

Objective ____________Tool/Method

Detect hidden files in images: steghide info, zsteg, binwalk
Extract hidden files: steghide extract, binwalk -e
Find appended data: strings, xxd
Online steg analysis: StegOnline, Aperi’Solve, Forensically
Detect LSB steganography: Python script, zsteg
Inspect file structure: xxd, hexdump

Quick Reference

Objective ____________Tool/Method

Brighten darkened images: Photopea → Levels, Exposure
Reveal hidden text: Photopea → Color channel isolation, Invert, Posterize
Decode Base64: CyberChef → From Base64
Decode Hex: CyberChef → From Hex
Decode Binary: CyberChef → From Binary
Brute force Caesar cipher: CyberChef → ROT13 Brute Force, or Python script
Image forensics is not magic. It is methodical analysis. Many manipulated darkened images can be brightened, and many encoded messages can be decoded. Many tools are free, and basic techniques are simple. Now you know them.

Module 10: Transportation OSINT — Tracing Cars, Vessels, and Aircraft

People are tracked by more than their social media accounts. They drive cars. They board planes. They ship cargo on vessels. Every vehicle leaves a trail. License plates are photographed. Flight paths are logged. Ships broadcast their positions. These trails are public. Most investigators never look at them.

This module teaches you how to trace a target through the vehicles they use. You will learn to identify cars from a single photo, pull ownership history from a VIN, track ships in real time, and follow aircraft by their tail numbers. Every technique is practical. Every data source is open.

Lecture 10.1: Vehicle Identification — Make, Model, and Year from a Photo

A single photo of a car can tell you more than you think. The make, model, and year are often identifiable from visual details.

What to Look For:

Body shape: Sedan, SUV, coupe, truck. This narrows the category immediately.
Headlights and taillights: Manufacturers design unique light signatures. A BMW’s angel eyes. An Audi’s LED strip. These are distinctive.
Grille design: The front grille is a brand signature. Lexus spindle grille. Jeep seven-slot grille. BMW kidney grille.
Badges and emblems: Often visible even in low-resolution images. The font and placement matter.
Wheel design: Alloy wheels are often model-specific. A particular rim style may only appear on one trim level.
Side profile and window line: The silhouette of a car is unique to each model.
Side mirrors: Shape and placement vary between models.
License plate placement: Some cars have center-mounted plates. Others are offset.

Practical Process:

Step 1: Screenshot the vehicle from the image. Crop tightly around the car. Remove distracting background.

Step 2: Upload the cropped image to Google Lens. Google Lens is surprisingly good at identifying car makes and models from photos.

Step 3: If Google Lens does not return a clear match, use reverse image search on Yandex. Yandex often performs better on vehicle images.

Step 4: Search the suspected make and model on Google Images. Compare the headlights, grille, and body lines of known models to your photo. Look for exact matches.

Step 5: Narrow down the year. Car models receive facelifts every few years. A 2018 Honda Civic has a different front bumper than a 2021 Honda Civic. Search for “Honda Civic 2018 vs 2021 front” and compare.

Step 6: Document your identification with annotated screenshots. Circle the matching features. This is your evidence.

Lecture 10.2: License Plate Lookup — Country-Specific Databases

License plates are unique identifiers. If you have a plate number, you can pull vehicle information from public databases.

Understanding License Plate Formats:

Every country has a different format. Learn to read them.

United States: State-specific. “ABC 1234” format varies.
United Kingdom: “AB12 CDE” format. The first two letters indicate the registration region. The numbers indicate the year.
Germany: “B-AB 1234” format. The first letter(s) indicate the city. “B” is Berlin. “M” is Munich.
Russia: “A123BC 77” format. The numbers at the end indicate the region. “77” is Moscow.

Before you search a plate, identify the country. The plate design, colors, and format tell you where to look.

Free License Plate Lookup Tools:

UK: vehicleenquiry.service.gov.uk — Enter any UK plate. Returns make, color, engine size, CO2 emissions, tax status, and MOT history.
US: vehiclehistory.gov — Official US government database for vehicle history. Limited free access.
US (Free): vincheck.info — Enter a plate or VIN. Returns vehicle specs, title history, and accident records.
Global: platesmania.com — User-uploaded photos of license plates from around the world. Search by plate number.
Global: worldlicenseplates.com — Reference for identifying plate formats by country.

Practical Example:

A photo shows a car with a UK plate “AB12 CDE.” You go to vehicleenquiry.service.gov.uk. Enter the plate. The site returns: “FORD, FIESTA, RED, 1596cc, PETROL.” You now know the exact make, model, color, and engine size from a single plate number.

Lecture 10.3: VIN Decoding — What a Vehicle Identification Number Reveals

Every vehicle manufactured after 1981 has a 17-character VIN. This number encodes the manufacturer, model, engine type, year, and factory location.

Where to Find a VIN:

Dashboard near the windshield (visible from outside).
Driver’s side door jamb.
Insurance documents.
Registration papers.
Sometimes visible in car listing photos online.

How to Decode a VIN:

Position 1-3 (WMI - World Manufacturer Identifier):
Tells you the country and manufacturer. “1GC” is General Motors USA. “WBA” is BMW Germany. “JHM” is Honda Japan.

Position 4-8 (Vehicle Descriptor):
Tells you the model, body type, engine type, and transmission.

Position 9 (Check Digit):
Used to verify the VIN is valid.

Position 10 (Model Year):
A single character representing the year. “A” is 1980 or 2010. “L” is 1990 or 2020. “M” is 1991 or 2021. “N” is 1992 or 2022.

Position 11 (Plant Code):
Tells you which factory built the vehicle.

Position 12-17 (Serial Number):
The unique production sequence.

Free VIN Decoders:

vindecoder.net — Enter any VIN. Returns full vehicle specs.
vehiclehistory.gov — US official VIN lookup.
vincheck.info — Free VIN check with title history.

Practical Example:

A target is selling a car online. The listing includes a photo showing the VIN on the dashboard. You copy the VIN. Enter it on vincheck.info. The site returns: “2018 Toyota Camry, 2.5L 4-cylinder, manufactured in Georgetown, Kentucky.” You now have the exact year, model, engine, and factory location.

Lecture 10.4: Marine Traffic Tracking — Following Ships in Real Time

Ships broadcast their position, speed, and destination publicly using AIS (Automatic Identification System). This data is collected and displayed on marine tracking websites. You can track any vessel in the world.

Marine Traffic

Go to https://www.marinetraffic.com. The map shows thousands of vessels in real time.

Click any ship icon. You see the vessel name, type, flag, speed, course, and destination.
Search by vessel name or IMO number. The IMO number is a unique permanent identifier for every commercial vessel.
View the vessel’s track history. See where it has been over the past days or weeks.
View port calls. See when it arrived and departed each port.

Vessel Finder

Go to https://www.vesselfinder.com. Is an alternative with similar functionality. Sometimes one platform has data the other does not. Check both.

What You Can Find:

A ship’s current location and heading.
Its destination port and estimated arrival time.
Its flag state (the country where it is registered).
Its owner and operator (for commercial vessels).
Historical track data showing past routes.

Practical Example:

A target claims to be importing goods from China. They mention a shipment on the vessel “EVER GIVEN.” You search “EVER GIVEN” on MarineTraffic. The vessel is currently in the Red Sea, heading for Rotterdam. The AIS data confirms the shipment timeline matches their claim.

Lecture 10.5: Aircraft Tracking — Following Planes by Tail Number

Every aircraft has a registration number, commonly called a tail number. It is painted on the fuselage and is unique to that aircraft. Flight tracking websites log every flight.

Flight Rader24

Go to https://www.flightradar24.com. The map shows thousands of aircraft in the air.

Click any plane icon. You see the flight number, aircraft type, altitude, speed, and route.
Search by tail number (registration) to find a specific aircraft.
Search by flight number to find a specific commercial flight.
View playback to see past flights.

ADS-B Exchange

https://globe.adsbexchange.com is unfiltered. FlightRadar24 and FlightAware allow owners to hide their aircraft. ADS-B Exchange shows everything that broadcasts ADS-B data. Military aircraft, private jets, government planes. All visible.

What You Can Find:

A private jet’s travel history over months.
A government aircraft’s movements.
A commercial flight’s actual departure and arrival times.
Aircraft owner information from registration databases.

Practical Example:

A target claims to be in London for a meeting. A photo on their Instagram shows a private jet interior. The tail number “N123AB” is visible in the window reflection. You search “N123AB” on ADS-B Exchange. The aircraft flew from New York to Miami on the date of the alleged meeting. The target lied. The tail number gave them away.

Lecture 10.6: Aircraft Registration Lookup

Every country maintains a public aircraft registry. Search by tail number to find the owner.

US (FAA Registry): https://registry.faa.gov/aircraftinquiry OR https://www.flightaware.com/resources/registration/ — Enter a US tail number (starts with “N”). Returns the registered owner, address, aircraft make and model, and serial number.

UK (CAA Registry): https://www.caa.co.uk — Search by registration (starts with “G-”). Returns owner and aircraft details.

Global: https://www.aircraft-registration.com — Links to registries by country.

Practical Example:

A private jet with tail number “N456CD” is seen at an airport near your target’s residence. You search the FAA registry. The owner is “XYZ Holdings LLC.” You search that company on OpenCorporates. The beneficial owner is your target. The jet is theirs.

Lecture 10.7: Satellite Imagery for Vehicle Tracking

Satellite imagery can show vehicles parked at specific locations at specific times.

Google Earth Pro: https://www.google.com/maps

View historical imagery. Go back in time to see a location on different dates.
Zoom into parking lots, driveways, and industrial areas.
Look for vehicles. Note their presence or absence on different dates.

Sentinel Hub: https://www.sentinel-hub.com — Free satellite imagery updated every few days.

Not as high resolution as Google Earth but more current.

Practical Example:

A target claims to have sold a specific car in 2024. You use Google Earth Pro historical imagery. The car is visible in their driveway in March 2025. The car was not sold. The satellite imagery proves it.

Lecture 10.8: Building Movement Patterns from Vehicle Data

Individual vehicle sightings are data points. Combine them to map a target’s movements.

The Workflow:

Collect every vehicle sighting. License plate photos, AIS tracks, flight logs, satellite imagery.
Plot each sighting on a map with a timestamp.
Connect the dots chronologically.
Look for patterns. Frequent visits to a specific location. Travel routes that repeat.
Cross-reference vehicle data with other intelligence. Social media check-ins. Phone location data. Financial transactions.

Practical Example:

A target’s car is photographed at a warehouse on Monday. Their private jet flies to the same city on Tuesday. A ship they are connected to docks at the port on Wednesday. Three data points. One location. A pattern emerges.

Quick Reference

Objective ______________Tool

Identify car from photo: Google Lens, Yandex Images
UK license plate lookup: vehicleenquiry.service.gov.uk
US license plate lookup: vincheck.info
Global plate reference: platesmania.com, worldlicenseplates.com
VIN decoding: vindecoder.net, vehiclehistory.gov
Marine tracking: marinetraffic.com, vesselfinder.com
Flight tracking: flightradar24.com, globe.adsbexchange.com
US aircraft registry: registry.faa.gov/aircraftinquiry
Satellite imagery: Google Earth Pro, Sentinel Hub

This is Transportation OSINT. Cars, ships, and planes are not just transportation. They are tracking devices that broadcast their identities, positions, and histories. Learn to read the signals. Follow the trails. Build the patterns. Every vehicle tells a story.

Module 11: Geospatial Intelligence (GEOINT) — Mapping the World from Open Sources

Geospatial intelligence is the discipline of extracting meaning from location data. Satellite images. Maps. Coordinates. Elevation models. Sun positions. Every photo taken outdoors contains geospatial clues. Every location has a history visible from orbit. Every event leaves a mark on the earth that someone can find.

This module is not a repeat of Module 2. Module 2 taught you to geolocate a single image. This module teaches you to think spatially. To work with satellite data. To analyze terrain. To map movements. To detect change over time. These are skills that intelligence agencies, war crimes investigators, and disaster response teams use daily.

By the end of this module, you will be able to take a satellite image and extract intelligence from it the way a professional GEOINT analyst would.

Lecture 11.1: Commercial Satellite Imagery — Your Eyes in the Sky

You do not need a spy satellite. Free and commercial imagery is available to anyone with an internet connection.

Google Earth Pro

Google Earth Pro is free. Download it from https://www.google.com/earth/versions. It is not the browser version. It is a desktop application with far more power.

What Google Earth Pro gives you:

High-resolution satellite imagery of most of the planet.
Historical imagery going back decades in many areas.
3D terrain and building models.
Measurement tools for distance and area.
The ability to import and export KML/KMZ files for mapping.

Sentinel Hub

Sentinel Hub at https://www.sentinel-hub.com provides free access to satellite imagery from the European Space Agency’s Sentinel satellites. These satellites image the entire planet every few days.

What Sentinel Hub gives you:

Imagery updated every 2-5 days.
Multiple spectral bands including infrared.
The ability to see through clouds using radar.
Free tier sufficient for most OSINT investigations.

Sentinel imagery is lower resolution than Google Earth, but it is current. Google Earth might show a location from 2022. Sentinel shows it from last week.

When to Use Which:

Google Earth Pro: High-resolution analysis, historical comparison, 3D terrain.
Sentinel Hub: Recent imagery, change detection, monitoring ongoing events.

Lecture 11.2: Historical Imagery and Change Detection

The most powerful feature of Google Earth Pro is the time slider. It lets you scroll back through years of satellite imagery to see how a location has changed.

How to Use the Time Slider:

Step 1: Open Google Earth Pro. Navigate to your target location.

Step 2: Look at the toolbar at the top. Find the clock icon with a green arrow pointing left. Click it.

Step 3: A slider appears. Drag it left to go back in time. Drag it right to return to the present. The imagery changes as you move the slider. Each position shows a different date.

Step 4: Note the date of each image in the bottom left corner of the screen. Document which dates are available.

Practical Example: Detecting Construction

A company claims they built a factory in 2023. You navigate to the location in Google Earth Pro. Open the time slider. The imagery from December 2022 shows an empty field. The imagery from March 2023 shows foundation work. The imagery from June 2023 shows a completed building. The timeline matches their claim.

Practical Example: Detecting Deception

A target claims a warehouse was destroyed by fire in 2024. You check historical imagery. The warehouse was already gone in 2021. The fire claim is false. The imagery proves it.

Change Detection with Sentinel Hub:

Sentinel updates every few days. Use it to monitor ongoing situations.

Track construction progress at a suspected facility.
Monitor troop buildup at a border.
Observe flood damage or deforestation.
Watch for vehicles or equipment appearing at a location.

Compare two Sentinel images side by side. One from last month. One from this week. What changed? Document every difference.

Lecture 11.3: QGIS for OSINT — Professional Geospatial Analysis

QGIS is a free, open-source Geographic Information System. It is the industry standard for geospatial analysis outside of paid tools like ArcGIS. Install it from https://qgis.org.

What QGIS Can Do for OSINT:

Import satellite imagery and overlay multiple data sources.
Plot coordinates from social media posts, photos, and reports.
Measure distances and areas precisely.
Create professional maps for reports.
Perform spatial analysis like buffer zones and heatmaps.
Work with geotagged data exported from other tools.

Basic Workflow:

Step 1: Install QGIS. Open it. You see a blank map canvas.

Step 2: Add a basemap. Go to Browser panel → XYZ Tiles → OpenStreetMap. Drag it onto the map canvas. You now have a world map.

Step 3: Add satellite imagery. Right-click XYZ Tiles → New Connection. Name it “Google Satellite.” Enter the URL:

https://mt1.google.com/vt/lyrs=s&x={x}&y={y}&z={z}

Click OK. Drag this new layer onto the map. You now have satellite imagery in QGIS.

Step 4: Plot points. Create a new layer. Add points at coordinates you have collected. Each point can have attributes like name, date, and source.

Step 5: Analyze. Use the measuring tool to find distances between points. Use buffer zones to show areas within a certain radius of a location.

Step 6: Export. Create a print layout. Add a title, legend, scale bar, and north arrow. Export as PDF or PNG for your report.

Practical Example:

You have coordinates from ten geotagged Instagram posts made by a target over six months. You import them into QGIS. You plot each point with the date as an attribute. You use the heatmap tool to show where the target spends the most time. A dense cluster appears around a specific neighborhood. That is likely their home. The map goes into your report.

Lecture 11.4: Coordinate Systems — Making Sense of the Numbers

Coordinates are the language of GEOINT. You need to understand them to work with maps, satellite imagery, and geotagged data.

Latitude and Longitude (Decimal Degrees):

The most common format. Latitude is north-south. Longitude is east-west.

Positive latitude = North of the equator.
Negative latitude = South of the equator.
Positive longitude = East of Greenwich, UK.
Negative longitude = West of Greenwich, UK.

Example: 51.5074, -0.1278 is London. 51.5074 is the latitude (north). -0.1278 is the longitude (west).

Degrees, Minutes, Seconds (DMS):

An older format still used in some contexts. The same London coordinates in DMS: 51°30'26.6"N 0°07'40.1"W.

51° = 51 degrees.
30' = 30 minutes (1/60 of a degree).
26.6" = 26.6 seconds (1/60 of a minute).
N = North.
0°07'40.1"W = 0 degrees, 7 minutes, 40.1 seconds West.

MGRS (Military Grid Reference System):

Used by military and emergency services. It divides the world into grid zones. Example: 30U YC 12345 67890. Harder to read but very precise.

UTM (Universal Transverse Mercator):

Similar to MGRS. Divides the world into 60 zones. Coordinates are in meters within each zone. Example: Zone 30N, 699456E, 5710542N.

Converting Between Formats:

Use online tools to convert coordinates between formats:

https://www.earthpoint.us/Convert.aspx — Convert between decimal degrees, DMS, MGRS, and UTM.
Google Earth Pro — Enter coordinates in any format. It converts automatically.

Practical Tip:

When you extract coordinates from a photo’s EXIF data, they are usually in decimal degrees. When you find coordinates in a military document, they may be in MGRS. Know how to convert between them. It takes seconds with the right tool.

Lecture 11.5: Sun Positioning and Shadow Analysis — How to Use SunCalc

Every outdoor photo contains a hidden clock and compass. The shadows tell you when the photo was taken and which direction the camera was facing. You do not need to be a physicist. You just need SunCalc.

What Is SunCalc?

SunCalc is a free online tool at https://www.suncalc.org. It shows you the position of the sun at any location on any date and time. It draws a line showing the sun’s path across the sky and the angle of shadows.

How SunCalc Works:

Step 1: Go to https://www.suncalc.org. You will see a map of the world.

Step 2: Move the red pin to your location of interest. You can search for an address or drop the pin manually.

Step 3: At the top, set the date. If you know the date the photo was taken, set it. If not, you can experiment with different dates.

Step 4: Drag the time slider at the top. As you move it, the sun moves across the sky on the map. A colored arc shows the sun's path for that day. An orange line shows the current sun position and the direction of shadows.

Step 5: Look at the data panel. It shows:

Sunrise and sunset times.
Solar noon (when the sun is highest).
Sun altitude (angle above the horizon).
Sun azimuth (compass direction of the sun).
Shadow length relative to object height.

Using SunCalc for Photo Analysis:

Scenario: You have a photo of a building. You know the location. You do not know when it was taken.

Step 1: Look at the shadows in the photo. Which direction are they pointing? Shadows point away from the sun.

Step 2: Open SunCalc. Place the pin on the building’s location. Set the date to your best estimate (the year and month if you know it).

Step 3: Drag the time slider. Watch the orange shadow line. When the direction of the line matches the direction of the shadows in the photo, you have found the approximate time.

Step 4: Look at the shadow length. SunCalc tells you the shadow length relative to the object’s height. A shadow twice as long as the object’s height means the sun is low in the sky, likely early morning or late afternoon. A short shadow means the sun is high, near midday.

Step 5: Confirm. Check the sun altitude. Low altitude equals long shadows. High altitude equals short shadows. Match what you see in the photo.

Practical Example:

A photo shows a building with a shadow pointing directly to the right. The shadow is about the same length as the building is tall.

You place the pin on the building in SunCalc. You drag the time slider. At 8:30 AM, the shadow line points to the right. The sun altitude is 25 degrees. SunCalc shows the shadow length is 2.1 times the object height. This matches what you see in the photo. The photo was taken at approximately 8:30 AM local time.

You now have a timestamp. The target claimed to be elsewhere at 8:30 AM. The shadow proves otherwise.

What SunCalc Cannot Do:

SunCalc cannot tell you the exact minute. Cloud cover affects shadow visibility. Terrain like hills or buildings can block the sun. Use SunCalc for estimates, not forensic certainty. Combine it with other evidence. A shadow estimate that aligns with other timeline data is strong. A shadow estimate alone is suggestive.

Lecture 11.6: OpenStreetMap for Investigations

OpenStreetMap (OSM) is a free, editable map of the world. It is built by volunteers and often contains details that Google Maps does not. For an investigator, OSM is a source of building footprints, road networks, and points of interest.

What OSM Gives You:

Building outlines with heights and types.
Road networks with names and classifications.
Points of interest: schools, hospitals, military bases, industrial facilities.
Infrastructure: power lines, pipelines, water towers.
Administrative boundaries.

Using OSM Data:

Method 1: The Website

Go to https://www.openstreetmap.org. Search for a location. Zoom in. Buildings appear as outlined shapes. Click on a building. The sidebar shows its attributes if they have been mapped.

Practical Example:

You are investigating a target who claims to work at a specific office building. You find the building on OSM. The attributes show it is classified as “residential,” not “commercial.” The target’s claim does not match the map data. This is a discrepancy worth investigating.

Lecture 11.7: Overpass Turbo for OSINT — Extracting Contact Data and Business Intelligence

OpenStreetMap is not just a map. It is a database of businesses, facilities, and infrastructure with contact details, addresses, and operational data. Overpass Turbo lets you query this database and extract structured intelligence on targets.

What You Can Extract:

From a single Overpass query, you can pull:

Business names and types
Physical addresses with postcodes
Phone numbers
Email addresses
Website URLs
Opening hours
Social media links (where mapped)
Owner or operator names (for some facilities)

This data is publicly contributed by mappers and business owners. It sits in OSM, waiting to be queried.

Query 1: Extract All Restaurants in an Area with Contact Details

[out:json];
area[name=”London”]->.a;
node[”amenity”=”restaurant”](area.a);
out;

This returns every restaurant node in London. Click on any result. The properties panel shows the name, address, phone number, email, website, cuisine type, and opening hours.

Example:

This is business intelligence pulled from a map. No breach data. No paid tools. Just a free query.

Query 2: Find All Businesses in a Specific Area with Email Addresses

This query is more targeted. It only returns nodes that have an email address listed.

[out:json];
area[name=”Camden”]->.a;
node[”email”](area.a);
out;

This returns every business, office, and facility in Camden that has an email address in OSM. Each result includes the name, email, and often phone number and website.

Query 3: Find All Facilities Linked to a Specific Domain

If you are investigating a company and want to find all their locations, search by website domain.

[out:json];
node["website"~"example.co.uk”];
out;

The ~ operator means “matches this pattern.” This query finds every node where the website field contains “example.co.uk.” You get every location linked to that domain.

Query 4: Find All Surveillance Cameras, ATMs, or Security Infrastructure Near a Target

[out:json];
node(51.5074,-0.1278);
node(around:500)[”man_made”=”surveillance”];
out;

This finds every surveillance camera within 500 meters of a coordinate. Use this for physical security assessment or to find cameras that may have captured a target.

Replace "man_made"="surveillance" with:

"amenity"="atm" — Find ATMs.
"amenity"="bank" — Find banks.
"man_made"="cctv" — Find CCTV cameras.
"barrier"="gate" — Find security gates.
"amenity"="police" — Find police stations.

Query 5: Map an Entire Corporate Presence in a City

If a company name appears in OSM data, find every location.

[out:json];
area[name=”London”]->.a;
node[”name”~”Tesco”](area.a);
out;

Replace "Tesco" with any company name. This returns every Tesco location in London with addresses, phone numbers, and opening hours.

Query 6: Find All Government or Military Facilities in a Region

[out:json];
area[”name”=”Berlin”]->.a;
way[”military”](area.a);
way[”government”](area.a);
out geom;

out geom returns the shape of each facility, not just a point. You see the actual footprint of military bases and government buildings.

Query 7: Extract Phone Numbers and Emails in Bulk

This query returns every node in an area that has both an email and a phone number.

[out:json];
area[name=”Manchester”]->.a;
node[”email”][”phone”](area.a);
out;

The double tag filter ["email"]["phone"] means “must have both an email tag AND a phone tag.” This filters out incomplete records and gives you only high-value targets.

The Reality Check: What Overpass Turbo Cannot Do

Before you get too excited, understand the limitations. Overpass Turbo is powerful, but it is not a guaranteed source of intelligence.

Coverage Is Inconsistent:

OpenStreetMap is built by volunteers. Some cities like London, Berlin, and New York have thousands of contributors and extremely detailed data. Businesses list their phone numbers, emails, websites, and opening hours. Small towns and rural areas may have almost nothing. You might query a city and get fifty restaurants with full contact details. You might query another city of the same size and get three results with only names.

Data May Be Outdated:

A business that was mapped in 2019 may have closed in 2022. The OSM entry may still exist. Phone numbers change. Emails get abandoned. Websites go offline. OSM relies on volunteers to update records. Many entries are years old and unchecked.

Not Every Node Has Contact Details:

Most nodes in OSM have only a name and a type. Only a fraction include email addresses, phone numbers, or websites. You can run a query for all restaurants in a city and get 200 results. Maybe 15 have phone numbers. Maybe 5 have emails. The rest are just names and locations.

Some Data Is Intentionally Minimal:

Business owners and mappers sometimes add only basic information. A restaurant might be tagged as amenity=restaurant with a name and nothing else. Not because the data is hidden, but because no one added it.

Search by Domain Often Returns Nothing:

Querying for ["website"~"targetcompany.com"] only works if someone explicitly added that website to OSM. Most companies do not bother. You will often get zero results even for large organizations.

How to Handle This:

Run the query. If you get results, great. Document everything.
If you get zero results or very few, that is not a failure. It tells you the target area has limited OSM coverage. That is intelligence in itself.
Cross-reference what you do find with other sources. An email found in OSM should be verified through Google dorks, breach databases, or social media.
Do not rely on Overpass Turbo as your only source. It is one tool in a larger investigation. Use it alongside WHOIS lookups, social media searches, and corporate registries.

When Overpass Turbo Is Most Useful:

Investigating businesses in major cities with active OSM communities.
Finding physical locations and addresses for companies.
Mapping infrastructure around a target location.
Discovering contact details that are not easily found through Google.

When Overpass Turbo Is Least Useful:

Investigating individuals rather than businesses.
Searching in rural or under-mapped areas.
Looking for highly specific or niche data.
Expecting every result to have full contact details.

Lecture 11.8: 3D Terrain Analysis

Google Earth Pro renders terrain in 3D. You can tilt the view to see elevation, mountains, and valleys. This helps with line-of-sight analysis and understanding what a photo’s background tells you.

How to Use 3D Terrain:

Step 1: Open Google Earth Pro. Navigate to your location.

Step 2: Hold the middle mouse button or Shift key and drag to tilt the view. The map becomes 3D. Mountains rise. Valleys sink.

Step 3: Use the “Add Path” tool to draw a line from a viewpoint to a distant feature. Right-click the path → “Show Elevation Profile.” This shows you the terrain between those two points.

Practical Example:

A photo shows a mountain in the background. You tilt Google Earth to match the angle. You find a mountain that has the exact same profile. The photo was taken from a specific hilltop. You now have the photographer’s approximate location.

Quick Reference

Objective ___________Tool

High-resolution satellite imagery: Google Earth Pro
Recent satellite imagery: Sentinel Hub
Historical imagery and change detection: Google Earth Pro time slider
Professional GIS analysis: QGIS
Sun position and shadow timing: SunCalc.org
Coordinate conversion: earthpoint.us, Google Earth Pro
Building and infrastructure data: OpenStreetMap, Overpass API
3D terrain and elevation profiles: Google Earth Pro
Basemap for QGIS: OpenStreetMap XYZ Tiles

This is Geospatial Intelligence. Not just finding a location on a map. Understanding terrain. Reading shadows. Analyzing change over time. Extracting data from satellite pixels. Building professional maps that prove your findings. This is the skill set that separates the investigator from the analyst. The analyst sees a photo. The GEOINT analyst sees a clock, a compass, and a timeline.

Module 12: HUMINT-OSINT Hybrid — Trawling Forums and Online Communities

A forum is an online discussion platform where people post messages and reply to each other over time. Unlike social media, where posts disappear into a feed within hours, forum threads are often permanent. A discussion started in 2015 may still be readable in 2026. Every post, every reply, every user profile, all archived in one place.

Forums are organized into sections by topic. A motorcycle forum might have sections for different bike brands, maintenance tips, and regional meetups. Each section contains threads. Each thread is a conversation. Each user has a profile with their post count, join date, and sometimes personal details they filled in years ago and forgot about.

For an investigator, a forum is a time capsule. It preserves the target’s interests, opinions, expertise, and relationships over months or years. People write more freely on forums because they feel anonymous. They drop personal details without thinking. They share photos. They list their email addresses in signatures. They argue with other members and reveal their biases.

This is the HUMINT-OSINT hybrid. You are not just collecting data. You are reading human behavior. Understanding how people communicate when they think no one is watching. That is the deepest intelligence there is.

Lecture 12.1: Why Forums Are the Deepest OSINT Source

Social media is where people perform. Forums are where people speak.

On Twitter, a target curates their image. On LinkedIn, they wear their professional mask. On Instagram, they post their best moments. But on a niche forum, they talk about what they actually care about. Their hobbies. Their obsessions. Their grievances. Their expertise.

Forums are where the unfiltered person lives. Someone who posts anonymously on a motorcycle forum will discuss their exact bike model, their mechanical problems, their riding routes, and sometimes their real name in a signature block they forgot about.

Most investigators skip forums because they are harder to navigate than social media. That is exactly why you should not skip them. The intelligence is deeper and the competition is thinner.

Lecture 12.2: Finding Niche Forums and Online Communities

Before you can investigate a forum, you have to find it. There are thousands of forums on the internet, each serving a specific community.

Method 1: Google Dorks

Use search operators to find forums related to your target’s interests.

site:forum.* “keyword”
site:*.com/forum “keyword”
“powered by vBulletin” “keyword”
“powered by phpBB” “keyword”
“powered by XenForo” “keyword”
“powered by Discourse” “keyword”
“powered by Simple Machines” “keyword”

Replace keyword with the topic - [ Motorcycles. Vintage watches. Cybersecurity. Fitness ] - Whatever your target cares about.

The "powered by" dorks are powerful because every forum software leaves a unique signature. Searching for that signature plus your keyword returns only actual forums.

Method 2: Reddit as a Forum Directory

Reddit is a gateway. People in niche communities often link to external forums.

site:reddit.com “keyword” “forum”
site:reddit.com “keyword” “message board”

Search for your target’s interest on Reddit. Read the comments. Community members frequently recommend specific forums to newcomers. Those recommendations are your map.

Method 3: Forum Directories

Several websites index forums by category.

Boardreader: https://boardreader.com — Search engine dedicated to forums.
FindAForum: https://findaforum.net — Directory of forums by category.
The Biggest Boards: https://thebiggestboards.com — Rankings of the largest forums. [No longer working - domain up for sell but you can reverse this using the Wayback Archive].

Method 4: Discord and Telegram as Clues

Many niche communities have moved to Discord and Telegram but maintain legacy forums. Search Discord server listings and Telegram directories for your keyword. The communities you find often link back to their original forums.

Lecture 12.3: Forum Reconnaissance — Profiles, Posting History, Signatures

Once you find a forum, do not start reading random posts. First, document the structure.

What to Capture on a Forum:

User Profiles

Click on the target’s username. This opens their profile page. Look for:

Join Date: When they registered. This is a temporal anchor.
Post Count: How active they are. A high post count means they have been around for a while.
Last Active: When they were last online. This tells you if they are still active.
Location Field: Many forums have a location field. Users often fill it with their city or region.
Occupation Field: Some forums ask for occupation. Users may list their real job.
Interests: Additional fields for hobbies or specialties.
Contact Details: Some profiles include email, ICQ, AIM, MSN (older forums), or social media links.
Avatar: The profile picture. Save it. Run reverse image search.
Signature Block: A block of text or images appended to every post. This is gold. Signatures often contain names, quotes, links, and contact details.

Posting History

Click “View all posts by this user” or a similar link. Browse their history. Look for:

Personal details shared casually: “I live in Manchester so...”
Photos posted: Their car, their bike, their workspace. Each is a clue.
Links to other platforms: YouTube, Twitter, personal blogs.
Timestamps: When they post. Morning, evening, work hours. This reveals timezone.
Tone and expertise: Are they a beginner or an expert? What do they care about?

Signature Block Analysis

The signature is a persistent footer attached to every post. Users often forget what is in it. Look for:

Real names
Company names
Personal website
Social media handles
Email addresses
Quotes that reveal beliefs or affiliations

A signature that says “John D. - IT Consultant, London - “www.johndoeconsulting.com“ is a full identity disclosure the user forgot they had.

Lecture 12.4: Writing Style Analysis for Attribution

Writing style is a fingerprint. It does not change between platforms. If you know how someone writes on one forum, you can recognize them on another.

What to Analyze:

Spelling

British vs American English. “Colour” vs “Color.” “Favour” vs “Favor.”
Canadian spellings. “Centre” vs “Center.”

Punctuation

Oxford comma usage. “a, b, and c” vs “a, b and c.”
Spacing after periods. One space or two.
Use of em dashes (—) versus hyphens (-) versus parentheses.

Capitalization

Proper capitalization. All lowercase. ALL CAPS.
Do they capitalize the first letter of every word?

Sentence Structure

Short, choppy sentences or long, flowing paragraphs?
Do they use fragments? Run-ons?

Slang and Idioms

Regional phrases. “Mate” vs “Buddy” vs “Pal.”
“Pop” vs “Soda” vs “Coke.”
“Rubbish” vs “Garbage” vs “Trash.”

Technical Jargon

What terms do they use for their field?
Do they use the correct terminology or approximate it?

Typos and Habits

Misspellings they consistently make.
Words they always abbreviate.
Emoji usage. Which ones do they favor?

The Workflow:

Collect a sample of the target’s posts from one forum. Minimum 500 words for reliable analysis.
Note their writing characteristics in a profile.
Search other forums for posts with the same characteristics.
Compare. A match in five or more characteristics is a strong indication of the same author.

Note: Writing style alone is not proof. Combined with username similarity, avatar matching, or IP correlation, it becomes powerful attribution evidence.

Lecture 12.5: Tracking Users Across Multiple Forums

Users rarely stay on one forum. They join multiple communities for different interests. Tracking them across forums builds a fuller profile.

Method 1: Username Search

Take the username from one forum. Search it on Google.

“username” forum
“username” site:forum.*
“username” “powered by”

Many users reuse the same handle across forums. A unique username like wrench_rider_77 is easy to trace.

Method 2: Avatar Reverse Image Search

Download the user’s avatar. Run it through Google Lens and Yandex Images. If the same image appears on other forums, you have found their accounts.

Method 3: Email Search

If the forum profile lists an email address, search that email.

“email@example.com” forum
site:*.com/forum “email@example.com”

Method 4: Writing Style Correlation

Use the writing style profile from Lecture 12.4. Search other forums for posts matching those characteristics. Even if the username is different, the writing style may be the same.

Method 5: Signature Block Search

Copy a unique phrase from the target’s signature block. Search it in quotes.

“unique signature phrase”

Signatures are often reused across forums. A Google search for the exact phrase returns every forum where they have used it.

Lecture 12.6: Extracting Emails and Contact Details from Forums

Forums are less privacy-conscious than social media. Users list contact details openly.

Where to Look:

Profile Pages

Some forums display an email contact form or a public email address on the profile page.

Signature Blocks

As mentioned, signatures often contain emails and contact links.

Buy/Sell/Trade Sections

Users selling items often list their contact details. Search the forum’s marketplace section for the target’s posts.

Classified Ads

Forums with classified sections often require contact details in the ad.

Registration Data (via Breach)

Many forums have been breached over the years. If the forum appears in breach databases, the registration emails of all users are exposed. Search the forum name plus “breach” or “data leak” to find if user data is available.

Google Dorks for Forum Emails

site:forumname.com “gmail.com”
site:forumname.com “yahoo.com”
site:forumname.com “@”

Lecture 12.7: Recovering Deleted Forum Content with Wayback Machine

Users delete posts. Forums get shut down. Content disappears. The Wayback Machine remembers.

Method 1: Archive the User Profile

Paste the target’s forum profile URL into https://web.archive.org. Browse historical snapshots. Old versions of the profile may show details the user later removed.

Method 2: Archive the Forum Threads

If you know specific threads where the target posted, archive those URLs. Old snapshots may contain posts that were later deleted.

Method 3: Google Cache

Search the post URL on Google. If Google cached the page before deletion, you may still see the cached version.

Method 4: Forum Archives

Some forums have their own archives. Wayback Machine also captures entire forum directories. Use the wildcard technique from Module 5.2 to discover archived pages.

Lecture 12.8: Dark Web Forums — Safe Access and Intelligence Gathering

Dark web forums are where the most sensitive discussions happen. Threat actors, whistleblowers, and privacy-conscious communities. Accessing them requires the same infrastructure from Module 11.

Safety Rules:

Always use Whonix or Tails.
Never register with personal details.
Never download files.
Never interact with users.
Document everything without screenshots of illegal content.

What to Look For:

Usernames that match surface web handles.
PGP keys that can be cross-referenced.
Writing styles that match known surface web personas.
References to surface web accounts, emails, or websites.

The same attribution techniques apply. Dark web users make the same mistakes as surface web users. They reuse usernames. They repeat writing patterns. They leave breadcrumbs.

Quick Reference

Objective__________Method

Find forums: Google dorks: "powered by vBulletin" "keyword"
Forum search engine: Boardreader.com
Profile reconnaissance: Join date, posts, location, occupation, avatar, signature
Avatar reverse search: Google Lens, Yandex
Writing style analysis: Spelling, punctuation, slang, jargon
Cross-forum username search: "username" "powered by"
Email discovery: Profile pages, signatures, marketplace posts, breach data
Deleted content recovery: Wayback Machine, Google Cache
Dark web forum access: Whonix/Tails + Tor Browser

This is Module 12. Forums are where the real person hides in plain sight. They post their opinions, their locations, their expertise, and sometimes their identity, all under an anonymous username they think protects them. It does not. The breadcrumbs are everywhere. Your job is to follow them.

Module 13: OSINT for Fraud & Scam Investigation

Fraud is everywhere. Scammers operate on every platform, in every country, targeting victims through email, social media, fake websites, and cryptocurrency. They steal money, identities, and trust. Law enforcement is overwhelmed. Victims rarely get justice. OSINT changes that.

This module teaches you how to investigate fraud using open source intelligence. You will learn to trace phishing emails back to their infrastructure. You will learn to unmask fake social media profiles. You will learn to follow cryptocurrency payments across the blockchain. You will learn to build evidence packages that law enforcement can actually use.

This is not abstract theory. This is applied investigation. Every technique you have learned in this course, email intelligence, username attribution, domain reconnaissance, cryptocurrency tracing, social media analysis, comes together here for one purpose: finding the scammer behind the scam.

Fraud investigation is one of the most in-demand OSINT skills in the market. Banks need it. Insurance companies need it. Law firms need it. Cybersecurity firms need it. Victims need it. If you can trace a scammer, you will never lack work.

Lecture 13.1: Understanding Fraud and Scam Types — What You Are Investigating

Before you start any investigation, you need to know what kind of fraud you are dealing with. Each scam type leaves different digital traces. Your approach changes depending on the scam.

Common Scam Types:

Phishing Scams: Fake emails or websites designed to steal credentials or payment information. They impersonate banks, delivery companies, or government agencies.

Romance Scams: Scammers create fake profiles on dating sites. They build emotional relationships over weeks or months, then ask for money.

Fake Online Stores: Scammers set up websites that look like legitimate shops. Victims pay for goods that never arrive.

Cryptocurrency Scams: Fake investment platforms, rug pulls, and wallet drainers. Victims send crypto to scammer-controlled addresses.

Business Email Compromise (BEC): Scammers impersonate a company executive or vendor. They trick employees into sending payments to fraudulent accounts.

Advance Fee Fraud: The classic “Nigerian Prince” scam. Victims pay an upfront fee to release a larger sum that never exists.

Tech Support Scams: Scammers claim the victim’s computer is infected. They charge fees for fake repairs.

Each scam leaves a trail. Your job is to find it.

Lecture 13.2: Investigating Phishing Emails — Tracing the Sender

A phishing email is evidence. Every header, every link, every attachment is a clue. But you have to read the clues correctly. If you misread them, you will chase the wrong lead.

Step 1: Analyze the Email Header

Email headers contain routing information. They show the path the email took to reach you.

Open the email. View the full headers. In Gmail, click the three-dot menu → “Show original.” In Outlook, click “View message source.”

Look for:

Return-Path: The actual sending address. Often different from the display name.
Received: lines. These show the path the email took from server to server.
Reply-To: Where replies go. Often different from the From address.
SPF/DKIM/DMARC results: Whether the email passed authentication checks.
DKIM signature (d= tag): The domain that cryptographically signed the email.

The Received lines are read from bottom to top. The bottommost Received line shows the first server that handled the email. This is the closest thing you have to the sender’s origin.

Step 2: Analyze DKIM Alignment — The Critical Red Flag

DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to an email. That signature is tied to a specific domain, found in the d= tag of the DKIM header.

The Expectation: If an email claims to be from security@paypal.com in the From header, the DKIM domain (d=) should also be paypal.com.

The Reality (Mismatch): If the From header says security@paypal.com, but the DKIM signature says d=scammerdomain.com, it means the server that signed the email has no legitimate connection to the domain in the From header.

This is known as a DKIM alignment failure. It is one of the most reliable indicators of domain spoofing or unauthorized sending.

How DKIM Alignment Works in DMARC

DMARC requires either DKIM or SPF (or both) to be valid and aligned with the header From: domain to pass.

For DKIM Alignment, the domain in the From: header must match the domain in the DKIM signature’s d= tag:

Relaxed Mode (Default): The From: header domain and the d= tag domain must share the same base/organizational domain (e.g., company.com and mail.company.com align).
Strict Mode: The From: header domain and the d= tag domain must be an exact match.

When a Mismatch Is Not Malicious:

There are a few benign scenarios where a mismatch happens due to configuration choices.

Third-Party Email Platforms: A company uses a marketing service like Mailchimp or SendGrid to send emails on their behalf but forgets to set up custom DKIM records. The email arrives From: company.com, but is signed d=mcsv.net. It is technically legitimate but poor email hygiene.
Shared Sending Infrastructure: A small business uses an ISP or web host that signs all outgoing mail using the web host’s domain instead of the customer’s domain.

Bottom Line: If a sender domain mismatch occurs alongside other suspicious elements, like asking you to log in, verify details, click links, or wire money, treat the email as phishing.

Step 3: Use the Google Admin Toolbox Messageheader Tool

If you do not want to manually parse headers, use Google’s free header analysis tool.

Go to: https://toolbox.googleapps.com/apps/messageheader

Paste the full email header into the box. Click “Analyze the header above.”

The tool breaks down:

From, To, Reply-To fields.
SPF authentication result.
DKIM authentication result.
DMARC authentication result.
The full chain of Received lines in chronological order.
The sender’s originating IP address.

This gives you a clean, structured view of the email's path and authentication status. It saves time and catches details you might miss manually.

Step 4: Understand What the IP Actually Tells You

The IP address in the email header does not tell you where the scammer lives. It tells you the location of a server that handled the email. There is a big difference.

IP Location Is Not Attacker Location:

Geolocating the sender’s IP address identifies the physical server or data center that hosted the mail relay. It could be a VPN. A Tor exit node. A compromised server in another country. Or a legitimate email provider. It does not identify the physical home or office of the cybercriminal.

Webmail Masking:

Modern email providers like Gmail, Outlook.com, and Yahoo strip the sender’s actual device IP address from outbound headers. When a scammer sends an email from a Gmail account, the header shows Google’s server IP, not the scammer’s home IP. This is intentional privacy protection. It means you cannot trace the scammer back to their computer through webmail headers.

Forged Received Headers:

Attackers who operate their own mail servers can insert fake Received lines at the bottom of the header chain. These forged lines point to a random IP to mislead investigators. Always verify which server actually handed the message to your email provider. The last Received line before your provider’s server is the one you can trust. Anything below that may be forged.

Step 5: What to Do With the IP Anyway

Even with these limitations, the IP is still useful intelligence.

If the email claims to be from a bank in London but the originating server is in Lagos, that is a discrepancy worth documenting.
If the IP belongs to a known VPN or Tor exit node, that tells you the sender was using anonymization tools. That is intentional obfuscation. It is a behavior pattern.
If the IP belongs to a data center, that suggests an automated spam operation rather than a personal account.

Use tools like http://ipinfo.io, http://whatismyipaddress.com, and http://ip2location.com to identify the ISP and country. But label the finding correctly. Write “The email originated from a server hosted in [Country]” instead of “The scammer is in [Country].” Precision matters.

Step 6: Analyze the Links

Phishing emails contain malicious links. Do not click them. Analyze them.

Copy the link URL without opening it. Right-click and copy the link address.

Use these tools:

VirusTotal: http://virustotal.com — Checks the link against multiple security vendors.
UrlScan.io: http://urlscan.io — Opens the link in a sandbox and shows a screenshot of the destination.
CheckPhish: https://checkphish.ai — AI-powered phishing detection.

These tools tell you whether the link is malicious and what the destination page does. They do not reveal the scammer’s location. They reveal infrastructure.

Step 7: Investigate the Domain

Run a WHOIS lookup on the phishing domain.

Look for:

Registration date. Recently registered domains are a red flag.
Registrant details. Privacy protection may hide the owner.
Name servers. Patterns may link multiple scam domains.

Again, the domain tells you about the infrastructure, not the person. A domain registered through a privacy-protecting registrar in a high-risk jurisdiction is a clue about how the scammer operates, not where they live.

Step 8: Analyze Attachments

Upload attachments to VirusTotal or Any.Run. Never open them directly.

The results tell you what malware was attached and how it behaves. This is intelligence about the scammer’s tools and methods.

What You Can Conclude From Email Headers:

The email’s path through servers. This shows how the scammer routed the message.
The use of anonymization tools like VPNs or Tor. This shows intent to hide.
The use of compromised or spoofed infrastructure. This shows operational pattern.
DKIM alignment status. This shows whether the email is authentic or spoofed.
The geographic location of the first trusted server. This is an investigative lead, not proof.

What You Cannot Conclude From Email Headers:

The scammer’s real name.
The scammer’s home address.
The scammer’s device IP address (in most webmail cases).
The scammer’s exact physical location.

Email header analysis is the starting point, not the conclusion. It gives you infrastructure leads. Combine it with domain analysis, link analysis, cryptocurrency tracing, and social media investigation to build the full picture. One data point is noise. Five data points pointing the same direction is intelligence.

Lecture 13.3: Tracing Fake Social Media Accounts

Scammers create fake profiles to reach victims. These profiles always leave traces.

Step 1: Profile Analysis

Open the fake profile. Document everything:

Username.
Display name.
Profile picture. Save it. Run reverse image search.
Bio. Look for inconsistencies.
Account creation date. New accounts are suspicious.
Follower count. Fake accounts often have thousands of followers but no engagement.
Posting history. Stolen photos, generic captions, no personal content.

Step 2: Reverse Image Search the Profile Picture

Download the profile picture. Run it through:

Google Lens.
Yandex Images.
TinEye.

If the image appears on a stock photo site, a legitimate person’s LinkedIn, or a different social media account, you have found the real source. Scammers steal photos. The reverse search proves it.

Step 3: Username Search

Search the username across platforms:

“username” site:instagram.com
“username” site:twitter.com
“username” site:tiktok.com
“username” site:facebook.com

Scammers often reuse handles. The same username appearing on multiple platforms with different profile pictures indicates a network of fake accounts.

Step 4: Phone Number Discovery

If the scammer shared a phone number, run it through the Phone Number OSINT workflow from Module 5. Check WhatsApp, Signal, and Telegram. Check carrier lookups. Trace it back to a real identity where possible.

Step 5: Email Discovery

If the scammer shared an email, run it through:

HaveIBeenPwned.
DeHashed.
IntelX.
IntelBase/BhehindTheEmail/Fingerprint.to

Breach data often connects scammer emails to real names, addresses, and other accounts.

Lecture 13.4: Investigating Romance Scams

Romance scammers build fake identities, gain emotional trust, and then request money. The investigation focuses on proving the identity is fake and tracing the real person behind it.

Step 1: Profile Photo Analysis

Romance scammers use stolen photos. Often of military personnel, models, or attractive professionals. Run every photo through reverse image search. Find the real person whose image was stolen. This proves the profile is fraudulent.

Step 2: Story Analysis

Romance scammers follow scripts. Their stories have patterns:

They claim to work overseas (oil rig, military, international business).
They cannot meet in person.
They ask for money for emergencies, travel, or medical bills.
They escalate quickly. “I love you” within days.

Document the story. Look for inconsistencies. Dates that do not add up. Locations that contradict themselves.

Step 3: Tracing the Scammer

The scammer may share payment details. Western Union receiver names. Gift card numbers. Cryptocurrency addresses.

Western Union/MoneyGram: Receiver names and locations. These are often real. The scammer or their mule must collect the money.
Gift Cards: The scammer shares the card code and it is redeemed. The redemption can sometimes be traced to a device or account.
Cryptocurrency: Follow the wallet address on blockchain explorers. Cluster the address with known scam wallets.

Step 4: Documentation for Victims

Romance scam victims are often embarrassed. They delete messages. They hide details. Your report helps law enforcement understand the full scope. Include every communication, every payment, every piece of evidence. This is a financial crime. Treat it seriously.

Lecture 13.5: Investigating Fake Online Stores and E-Commerce Fraud

Fake stores are easy to create and easy to spot if you know what to look for.

Step 1: Website Analysis

Open the suspect store. Look for red flags:

Prices too good to be true.
Recently registered domain.
No physical address or a fake address.
No contact information or only a web form.
Copied product descriptions from legitimate sites.
Broken English in policies and FAQs.

Step 2: Domain Investigation

Run a WHOIS lookup on the domain.

Key indicators:

Domain registered within the last 90 days.
Privacy protection on the WHOIS record.
Registrar in a high-risk jurisdiction.
Multiple domains registered by the same registrant email. Search that email in WHOIS databases to find other scam sites.

Step 3: Verify the Store’s Claimed Affiliation

If the store claims to belong to a legitimate company, verify the connection through infrastructure.

Take the company’s real domain, say companyx.com. Run subdomain enumeration against it using the techniques from Module 6. Use tools like crt.sh, Sublist3r, or Amass. Look for e-commerce subdomains like:

shop.companyx.com
store.companyx.com
buy.companyx.com

If subdomain enumeration returns no e-commerce subdomains matching the store’s claimed identity, that is a red flag.

A legitimate corporate storefront lives on the company’s domain or a verified subdomain. The absence of any such subdomain means the claim is not supported by infrastructure evidence.

If the store operates on a separate domain that looks similar to the company’s, like companyx-store.com or companyxshop.net, that is even more suspicious. Scammers register lookalike domains because they cannot use the real one.

Step 4: Document the Finding Professionally

Write the finding clearly in your report:

“The store claims affiliation with Company X. Subdomain enumeration of companyx.com returned no e-commerce subdomains matching the store’s claimed identity. The store operates on a separate domain registered on [date]. This is inconsistent with a legitimate corporate storefront.”

This is not proof of fraud on its own. But combined with other red flags, it strongly indicates deception.

Step 5: Check Website Reputation

VirusTotal: Paste the URL. Check for security vendor flags.
URLScan.io: View a screenshot of the site in a safe sandbox.
ScamAdviser: scamadviser.com — Scores websites based on trust signals.
Trustpilot: Search the store name. Look for reviews. If it is a scam, victims have complained.

Step 6: Trace the Payment Methods

Fake stores usually accept crypto or wire transfers. They avoid payment methods with buyer protection like PayPal or credit cards.

If the store lists a bank account for wire transfer, that account name and number are evidence. Law enforcement can trace the bank account.

If the store lists a crypto wallet, trace the wallet on blockchain explorers. Cluster it with other known scam wallets.

Step 7: Identify the Platform

Many fake stores run on Shopify, WooCommerce, or Wix. Check the page source for platform signatures. Search for “Powered by Shopify” or WooCommerce meta tags. Report the store to the platform. They will shut it down.

Lecture 13.6: Cryptocurrency Scam Tracing

Crypto scams are the fastest-growing fraud category. The blockchain is public. Every transaction is visible. Your job is to follow the money.

Step 1: Obtain the Scammer’s Wallet Address

The victim sent crypto to a wallet address. This address is your starting point.

Step 2: Blockchain Exploration

Use blockchain explorers:

Blockchain.com/explorer — Bitcoin transaction search.
Etherscan.io — Ethereum transaction search.
Tronscan.org — Tron transaction search.

Enter the wallet address. View every transaction. See where funds entered and where they left.

Step 3: Wallet Clustering

Scammers rarely use a single wallet. They move funds between multiple addresses to obscure the trail.

Use clustering tools:

WalletExplorer: walletexplorer.com — Links Bitcoin addresses to known wallets and services.
Arkham Intelligence: arkhamintelligence.com — Visual blockchain analysis platform.
Chainalysis (commercial): Used by law enforcement. Free tools cover basic clustering.

Step 4: Exchange Identification

Follow the funds until they reach an exchange wallet. Exchanges like Coinbase, Binance, and Kraken require identity verification. The exchange knows who owns the receiving account. This is where law enforcement sends a subpoena.

Step 5: Cross-Reference the Wallet Address

Search the wallet address on Google:

“1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa”

Scammers sometimes reuse wallet addresses across platforms. A forum post, a social media profile, or a dark web listing may reference the same address. Each mention is a new lead.

Step 6: Document the Flow

Create a transaction flow diagram. Show the path from victim wallet to scammer wallet to exchange. Annotate every hop. This visual is critical for law enforcement.

Lecture 13.7: Business Email Compromise (BEC) Investigation

BEC scams target companies. Scammers impersonate executives or vendors and trick employees into sending payments.

Step 1: Analyze the Impersonation Email

Open the email. View full headers. Identify the actual sending IP. Compare it to the legitimate executive’s usual IP range. If the email claims to be from the CEO in New York but the header shows an IP in Nigeria, it is fraud.

Step 2: Analyze the Spoofed Domain

BEC scammers often use lookalike domains. company.com becomes c0mpany.com or company.co.

Run a WHOIS lookup on the lookalike domain. Document the registration date, registrar, and any available owner details.

Step 3: Trace the Payment Destination

The scam email asks the employee to send payment to a new bank account. This account is your evidence.

Bank name and account number.
Account holder name.
SWIFT code and IBAN for international payments.

Law enforcement can freeze the account if contacted quickly. Time is critical in BEC cases.

Step 4: Follow the Mule Network

Scammers use money mules to receive stolen funds. The account holder may be a complicit mule or an innocent person whose identity was stolen. Investigate the account holder using OSINT. Document everything.

Step 5: Preserve Evidence

BEC investigations often lead to legal action. Every email, every header, every domain record, every payment instruction must be preserved. Screenshot everything. Save raw email files. Maintain chain of custody where possible.

Lecture 13.8: Documenting Evidence for Law Enforcement

Your investigation is only as good as your evidence package. Law enforcement cannot act on speculation. They need documentation.

What to Include:

Executive Summary: What happened, who is affected, what you found.
Timeline: Chronological order of events.
Email Evidence: Full headers, screenshots, analysis.
Domain Evidence: WHOIS records, registration dates, name servers.
IP Evidence: Geolocation, ISP details, timestamps.
Cryptocurrency Evidence: Transaction hashes, wallet addresses, flow diagrams.
Social Media Evidence: Profile screenshots, reverse image search results, username correlations.
Entity Graph: Visual map of all connected entities.
Recommendations: For law enforcement, victim, and affected organizations.

Evidence Preservation Rules:

Never alter original evidence. Keep raw copies.
Screenshot with timestamps visible.
Save emails as .eml files where possible.
Document your investigation steps.
If evidence may be used in court, follow chain of custody.

Practical Exercise: The Complete Scam Investigation

The Scenario:

A victim received a phishing email claiming to be from their bank. They clicked the link, entered their credentials, and lost money from their account. The phishing email, the fake website, and a cryptocurrency wallet address are your only evidence.

Your Tasks:

Analyze the phishing email headers using the Google Admin Toolbox Messageheader tool. Document the SPF, DKIM, and DMARC results. Check for alignment failure.
Extract the sending IP. Geolocate it. Label the finding correctly as server location, not attacker location.
Analyze the phishing link. Run it through VirusTotal and URLScan.io.
Investigate the phishing domain. Run WHOIS. Document registration details.
Trace the cryptocurrency wallet address. Follow the transactions. Identify where funds left the wallet.
Search the wallet address and domain on Google for cross-references.
Build an entity graph connecting the email, IP, domain, and wallet.
Compile a full evidence package for law enforcement.

Deliverable:

A complete investigation report with all findings, screenshots, and your methodology. Submit as a PDF.

Quick Reference

Objective__________Tool

Analyze email headers: Google Admin Toolbox Messageheader, Gmail “Show original”
Check DKIM alignment: Compare From domain to d= tag in DKIM signature
Geolocate IP: ipinfo.io, whatismyipaddress.com, ip2location.com
Analyze malicious links: VirusTotal, URLScan.io, CheckPhish
Investigate domains: whois, whois.domaintools.com
Analyze attachments: VirusTotal, Any.Run
Reverse image search: Google Lens, Yandex, TinEye
Website reputation check: ScamAdviser, Trustpilot
Cryptocurrency tracing: Blockchain.com Explorer, Etherscan, WalletExplorer
Entity graph: Maltego, Obsidian, draw.io

This is Module 13. Fraud investigation is OSINT applied to real harm. Scammers leave trails. Phishing emails contain IPs and DKIM mismatches. Fake profiles use stolen photos. Crypto wallets record every transaction. Your job is to follow the evidence, document the trail, and build a case that law enforcement can act on. This is the work that matters.

Module 14: Python for OSINT Automation — Building Your Own Tools

Every investigator eventually hits the same wall. You have a technique that works, but doing it manually across ten targets or a hundred data points is eating hours you do not have. Automation is the answer. But copying someone else’s script without understanding it makes you dependent. The moment the target platform changes its layout, or the API updates, or your needs shift, the script breaks and you cannot fix it.

This section is not about giving you five scripts to copy. It is about teaching you how to build your own. You will learn a repeatable process for turning any manual OSINT task into a working Python tool. You will use AI as your coding assistant. You will use Kali Linux as your development environment. By the end, you will not need anyone else’s scripts. You will write your own.

The Automation Development Framework

Every automation project follows the same five phases. Learn this framework, and you can apply it to any task you encounter.

Phase 1: Define the Manual Process

Before you write a single line of code, you must understand exactly what you do manually. Write it down step by step. Be specific. “I go to this URL. I type this query. I look for this element on the page. I copy this data. I paste it here.” If you cannot describe the manual process precisely, you cannot automate it.

Phase 2: Identify the Data Flow

Where does the data come from? Where does it go? What format is it in at each stage? The input might be a username from a text file. The output might be a CSV of profile URLs. The transformation happens in between. Map this flow before you code.

Phase 3: Select Your Tools

For OSINT automation on Kali Linux, your core toolkit is:

Python 3 — The language. It is installed by default on Kali. It has libraries for HTTP requests, HTML parsing, JSON handling, and file operations.
Requests — For making HTTP requests to websites and APIs.
BeautifulSoup — For parsing HTML and extracting specific elements.
aiohttp — For making many requests simultaneously when speed matters.
Subprocess — For calling external tools like ExifTool from within Python.
JSON/CSV modules — For structured data input and output.

Phase 4: Build with AI Assistance

You do not need to memorize syntax. You need to know how to ask the right questions. Modern AI coding assistants can generate boilerplate, suggest libraries, and debug errors. But they only produce good output when you give them good input.

The key is providing context. Do not ask “write me a script.” Ask:

“I need a Python script that sends a GET request to a URL, parses the HTML with BeautifulSoup, and extracts all links with the class ‘result-link’. Show me the code with error handling.”
“This function returns a list of URLs. I need to check each URL to see if it returns a 200 or 404 status code. Make it async with aiohttp for speed. Handle timeouts.”
“I have a JSON file with this structure. Show me how to extract the ‘email’ field from every object and write them to a CSV.”

The AI becomes your pair programmer. You provide the logic and the requirements. It provides the syntax. You review, test, and refine.

Phase 5: Test, Break, Fix, Repeat

Your first version will break. This is normal. Run it against a known target. See where it fails. Is the HTTP request timing out? Add a longer timeout. Is the HTML structure different than expected? Inspect the page again. Is the site blocking your requests? Add proper User-Agent headers. Each failure teaches you something about how the target platform works. Debugging is intelligence gathering.

The Kali Linux Advantage

Kali Linux is built for security work. It comes with Python pre-installed. It comes with network tools, proxy support, and a terminal environment designed for technical work. For OSINT automation development, Kali gives you:

Python 3 out of the box. No setup required. Open a terminal and start coding.
Virtual environment support. Create isolated Python environments for each project so dependencies do not conflict.
Proxy integration. Route your script’s traffic through Tor or a VPN with simple terminal commands.
Cron scheduler. Schedule your finished scripts to run automatically at set intervals.

Your development workflow on Kali:

mkdir osint_project

cd osint_project

python3 -m venv venv

source venv/bin/activate

pip install requests beautifulsoup4 aiohttp

nano my_tool.py

python3 my_tool.py

That is it. Five commands, and you have an isolated development environment ready for any automation project.

Scripting Lab 1: Multi-Engine Dork Orchestrator

The Manual Process

You have a Google dork. You type it into Google. You scroll through results. You copy the links. You type the same dork into Bing. You scroll. You copy. You type it into DuckDuckGo. You scroll. You copy. Then you combine all three lists, remove duplicates, and save the final list. This takes fifteen minutes per dork.

Building the Tool — Step by Step

Start by writing the manual process as pseudocode:

1. Take a dork query as input
2. Send query to Google
3. Extract all result links from Google’s response
4. Send query to Bing
5. Extract all result links from Bing’s response
6. Send query to DuckDuckGo
7. Extract all result links from DuckDuckGo’s response
8. Combine all links
9. Remove duplicates
10. Save to file

Now you have a blueprint. Each step becomes a function or a block of logic.

Ask your AI assistant: “I need a Python function that takes a search query, sends it to Google via HTTP GET, parses the HTML with BeautifulSoup, and returns a list of result URLs. Include a proper User-Agent header.”

It gives you the Google function. You test it. It works for some results but misses others. You inspect Google’s actual HTML and realize the class names vary. You update the parsing logic. You repeat this process for Bing and DuckDuckGo.

The orchestration function combines the results, uses Python’s set() to deduplicate, and writes the output file. You now have a working tool.

Testing and Refinement

Run it with a simple dork: site:example.com. Compare the results against a manual search. Are you getting the same links? If not, inspect the HTML of the search results page. The class names or element structures may have changed. Update the parsing logic. This is the reality of web scraping. Sites change. Your tools must adapt.

Add error handling. What if the request times out? What if the site blocks you? Wrap each request in a try-except block. Log errors instead of crashing.

Scripting Lab 2: Bulk EXIF Extractor & Geolocation Plotter

The Manual Process

You have a folder of images. You open each one in ExifTool. You copy the GPS coordinates. You paste them into Google Maps. You note the device model and timestamp. You do this for every image. After processing fifty images, you have a scattered collection of notes and no clear picture of the target’s movements.

Building the Tool — Step by Step

The pseudocode:

1. Walk through a directory and find all image files
2. Run ExifTool on each image in JSON mode
3. Extract GPS coordinates, timestamp, device make, model, serial number
4. Convert GPS from degrees-minutes-seconds to decimal
5. Write all data to a CSV file
6. Generate an HTML map with pins at every GPS location

The key decision is how to call ExifTool. Python’s subprocess module lets you run terminal commands and capture the output. You call exiftool -json image.jpg and parse the JSON response.

Ask your AI assistant: “Show me how to use Python’s subprocess module to run ExifTool with the -json flag on an image file, capture the output, and parse it into a Python dictionary.”

GPS conversion is the trickiest part. ExifTool returns GPS as strings like “40 deg 45’ 30.00” N”. You need to parse this and convert it to decimal degrees. Write this logic once, test it with known coordinates, and reuse it.

The map generation uses Leaflet.js, a JavaScript library for interactive maps. Your Python script generates the HTML file with JavaScript embedded. This is a clean approach. No external dependencies for mapping. Just a single HTML file that opens in any browser.

Testing and Refinement

Test with images that have known GPS coordinates. Verify the pins appear in the correct locations on the map. Test with images that have no GPS data. The script should handle these gracefully, skipping map pins but still recording metadata in the CSV.

Scripting Lab 3: Intelligent Permutation & Availability Engine

The Manual Process

You have a username. You guess variations. You type each variation into Twitter’s URL bar. You check if the profile loads. You repeat for Instagram, GitHub, Reddit, and a dozen other platforms. Each check takes thirty seconds. Checking fifty permutations across ten platforms is 500 manual checks. You will miss things.

Building the Tool — Step by Step

The pseudocode:

1. Take a username as input
2. Generate permutations using substitution rules, separator changes, and suffix additions
3. For each permutation, check against a list of platform profile URLs
4. A 200 status code means the profile exists
5. A 404 means it does not
6. Collect and report only the hits

The permutation logic is the intelligence. You are encoding the patterns you already know from Module 3. Character substitution: o becomes 0, e becomes 3. Separator variation: underscores become periods become hyphens. Suffix addition: appending 123, 2024, official, real.

Ask your AI assistant: “I need a Python function that takes a username string and generates permutations using character substitution, separator variation, and common suffix addition. Return a deduplicated list.”

The profile checking must be fast. Checking 500 combinations sequentially takes minutes. Async with aiohttp drops this to seconds. Ask: “Show me how to use aiohttp to asynchronously check 100 URLs and return the status code for each. Handle timeouts and errors.”

Testing and Refinement

Start with a known username. Run the script. Do the hits match platforms where you know the account exists? Are there false positives? Some sites return 200 for nonexistent profiles because they show a “page not found” message with a 200 status code instead of a proper 404. You must handle this by checking the page content, not just the status code. Look for “not found” text in the response body.

This is real-world scraping. The status code is a starting point, not the final answer. Validate with content checks.

Scripting Lab 4: Username-to-User ID Cross-Reference Tool

The Manual Process

You have a list of Twitter usernames. For each one, you view the page source, search for id_str, and copy the numeric ID. You do the same for Facebook, searching for profile_id or userID. Each username takes two minutes. A list of 50 usernames takes nearly two hours of repetitive work.

Building the Tool — Step by Step

The pseudocode:

1. Read usernames from a text file
2. For each username, request the public profile page on Twitter
3. Search the HTML for the id_str pattern using regex
4. Request the public profile page on Facebook
5. Search the HTML for profile_id, userID, or entity_id patterns
6. Write results to a CSV

The core technique is regular expressions. You are searching raw HTML for specific patterns. Twitter embeds the user ID in a JSON block within the page. The pattern is "id_str":"123456789". Facebook uses multiple patterns depending on how the page loads.

Ask your AI assistant: “I need a Python function that takes HTML source text and uses regex to extract the value of id_str from a JSON-like structure. Show me the regex and error handling.”

Testing and Refinement

Test with known accounts where you have manually verified the numeric IDs. Does the script return the correct values? Test with accounts that have custom URLs versus default numeric URLs. Test with accounts that are private versus public. Each variation may require a different extraction approach.

Facebook is particularly challenging because it changes its page structure frequently. Your regex patterns that work today may break next month. This is why you build the tool yourself instead of relying on someone else’s unmaintained script. When it breaks, you know how to fix it.

Scripting Lab 5: Reddit Historical Monitoring Bot

The Manual Process

You check a Reddit user’s profile every day. You scroll through their recent comments. You try to remember what you have already seen and what is new. You copy interesting posts into your notes. You wonder if they deleted anything since your last check. This is unreliable and time-consuming.

Building the Tool — Step by Step

The pseudocode:

1. Take a Reddit username as input
2. Request the user’s comment JSON feed from Reddit’s public API
3. Compare returned comment IDs against a local storage file of previously seen IDs
4. New comments are appended to an activity log
5. The storage file is updated with the latest comment IDs
6. Schedule the script to run daily

Reddit provides a public JSON API at reddit.com/user/username/comments.json. No authentication required. No API key. Just add .json to the end of the user profile URL. This returns structured data with comment IDs, timestamps, subreddits, and content.

Ask your AI assistant: “Show me how to request JSON data from Reddit’s public API using Python requests, parse the nested structure to extract comment ID, subreddit, body, and timestamp, and handle the case where the user has no comments.”

The state tracking is what makes this a monitoring tool instead of a one-time scraper. You store seen comment IDs in a local JSON file. Each run compares new IDs against stored IDs. Only unseen comments are reported.

Testing and Refinement

Run the script twice on the same user without any new activity between runs. The second run should report zero new comments. Have the user post a new comment. Run the script again. It should detect exactly one new comment. Verify the timestamp and content are correct.

Schedule it with cron on Kali Linux:

0 8 * * * /home/user/osint_project/venv/bin/python3 /home/user/osint_project/reddit_monitor.py

This runs the script every day at 8 AM. You wake up to a fresh activity report.

Building Your Own Automation Toolkit

The five labs above are templates. The real skill is applying this development framework to any task you encounter.

When you find yourself doing something manually, stop. Write down the manual process. Convert it to pseudocode. Identify the data sources and outputs. Ask your AI assistant for help with specific functions. Test against known targets. Refine until it works reliably. Save the tool. You now own it.

Over time, you build a personal library of automation tools. Each one solves a specific problem you have faced in real investigations. Each one is code you understand because you built it. When a platform changes, you adapt your tool. When a new investigative need arises, you build a new tool.

This is not about learning Python perfectly. It is about learning how to solve problems with code. The syntax you can always look up. The logic is what matters.

The Automation Mindset

Start small. Automate one repetitive task. Gain confidence. Automate another. Before long, you will have a suite of tools that handle the mechanical work of OSINT collection, freeing your mind for the work that actually requires human intelligence. Analysis. Attribution. Judgment.

The machine collects. The investigator thinks.

Module 15: Intelligence Report Writing & Entity Graph Visualization

You can run the most brilliant investigation of your career. You can uncover connections nobody else found. You can piece together a target’s entire digital footprint from a single username. But if you cannot communicate what you found in a way that your client understands, believes, and can act on, your investigation - failed.

Report writing is not the boring part of OSINT. It is the part that gives everything else meaning. The report is your product. The client does not see your late nights. They do not see your clever dorks or your elegant scripts. They see the document you put in front of them. That document must be clear, accurate, sourced, and professional. This module teaches you how to build it.

Lecture 15.1: Structuring the Intelligence Report

A professional intelligence report follows a predictable structure. This is not about being creative. It is about being clear. The client should know exactly where to find the answer to any question within seconds of opening your document.

Here is the standard structure. Use it for every report you write

1. Executive Summary

This is the most important section. Many clients will read nothing else. The executive summary must answer the original question in plain language, with no jargon, in under one page. State the investigation objective. State the key findings. State the risk rating or assessment. State the recommended next steps.

If your executive summary is vague, the client assumes the whole report is vague. Write it last. Write it after you know everything. Then make it sharp.

Example:

This investigation examined John Doe in connection with a proposed business partnership. Public records confirm Mr. Doe is a British national, born May 1962, residing in London. He is the sole director of HALL OR NOTHING MANAGEMENT LIMITED (dissolved January 2023). No adverse media, sanctions listings, or legal actions were identified. Open source intelligence revealed three additional social media profiles consistent with the subject’s known identity. Based on available information, the subject presents a LOW risk for partnership. A full finding summary follows.

2. Investigation Objective

Restate exactly what you were asked to do. This sets the scope. If something is outside scope, note it here. This protects you if the client later asks why you did not investigate something you were never asked to investigate.

3. Methodology

Explain how you gathered information. Do not list every tool. Summarize the approach. “Public records searches were conducted using UK Companies House and OpenCorporates. Social media analysis was performed using native platform search and public profile review. Historical data was retrieved via the Internet Archive Wayback Machine. All information was collected from publicly available sources without contacting the subject.”

This section establishes that your methods were legal, ethical, and repeatable.

4. Key Findings

This is the body of the report. Organize findings by category. Corporate records. Personal identity. Digital footprint. Historical intelligence. Risk indicators. Each finding gets its own subsection with a clear heading. Each claim is supported by evidence.

5. Evidence Log

A table linking each finding to its source. This is what makes your report defensible. If a client questions a claim, you point to the evidence log. Every row contains the finding, the source URL or document reference, the access date, and any relevant notes.

6. Risk Assessment

A clear rating of Low, Medium, or High with justification. Do not hedge. The client is paying you for your professional judgment. Give it.

7. Recommendations

What should the client do with this information? Proceed? Investigate further? Decline the partnership? Be specific.

Lecture 15.2: Writing for Your Audience — Client, Legal, or Internal

Your writing style changes depending on who reads the report. The structure stays the same. The language adapts.

Corporate Client

A business client wants answers, not education. Use plain language. Avoid jargon. Put the conclusion first. Bullet points are your friend. They are not paying you to show off your vocabulary. They are paying you to help them make a decision.

Legal Referral

If your report may end up in court, every word matters. State facts, not opinions, unless clearly labeled as such. Use precise language. “The subject’s LinkedIn profile listed employment at XYZ Corp from 2018 to 2022” is a fact. “The subject appears to have exaggerated their employment history” is an opinion. Label opinions clearly. Cite every source. Courts destroy reports with unsupported claims.

Internal Security Team

An internal team wants technical detail. They want your methodology in depth. They want to replicate your findings. Give them the dorks you used. Give them the API endpoints. Give them the tool commands. They may need to run the same investigation again in six months. Your report should make that possible.

Lecture 15.3: Evidence Documentation & Source Citation Standards

Every claim in your report needs a source. Not most claims. Every claim. If you cannot cite it, you cannot write it.

The Standard Citation Format

For each piece of evidence, record:

Source URL or Document Reference: The exact web address or filing number.
Access Date: When you retrieved the information. Websites change. The access date proves what you saw existed on that date.
Screenshot Reference: A filename or page number pointing to the visual record you preserved.
Notes: Any context about the source’s reliability or limitations.
Preserving Evidence

Screenshots are not optional. Websites disappear. Profiles get deleted. Filings get updated. Your screenshot is the permanent record. Take full-page screenshots. Save them with descriptive filenames. Store them in a folder alongside your report. If your report says something, there should be a screenshot proving it.

Lecture 15.4: Entity Graph Visualization — Tools & Methodology

An entity graph turns your written findings into a visual map. It shows connections between people, companies, accounts, emails, and locations in a way that text cannot. A good graph tells the story at a glance.

Why Graphs Matter

Your client may not read all twenty pages. They will look at the graph. If the graph clearly shows the target at the center with connections radiating outward to companies, social media accounts, and risk indicators, they understand the investigation immediately. The graph is your executive summary in visual form.

Tools for Entity Graph Building

Maltego is the industry standard for OSINT graph building. It is commercial software with a free Community Edition. Maltego allows you to create entities (people, companies, domains, emails), connect them with relationships, and run transforms that automatically discover new connections. The learning curve is real, but the output is professional-grade.

Gephi is a free, open-source graph visualization platform. It is less automated than Maltego but gives you complete control over the visual output. You build a spreadsheet of nodes and edges, import it into Gephi, and the software renders the graph. This is the tool to use when you need publication-quality visuals.

Obsidian is a free knowledge management tool that doubles as an investigation mapping platform. It uses Markdown files and supports a graph view that visually connects your notes. Create a note for each entity (person, company, email, account). Link notes together using wiki-style links. Obsidian’s graph view renders the connections automatically. This is ideal for building an investigation knowledge base that grows over time. You can toggle between reading your structured notes and viewing the connection graph. For long-term investigations with many entities, Obsidian keeps everything organized and visually traceable.

OSINTTracker is a purpose-built OSINT investigation management tool. It is designed specifically for investigators who need to track entities, relationships, and findings across complex cases. Unlike general-purpose graph tools, OSINTTracker understands OSINT workflows. You log entities, define relationships, attach evidence, and the platform generates connection maps automatically. It bridges the gap between note-taking and graph visualization in a single interface built for the work you actually do.

Google Drawings / draw.io are free, simple options for small graphs. If your investigation found five entities and six connections, you do not need Maltego. A clean diagram in draw.io is faster and equally clear.

Lecture 15.5: Building the Final Intelligence Package

The final package is more than the report. It is everything the client needs to understand, verify, and act on your findings.

The Package Contents

The Written Report (PDF) — The structured document from Lecture 10.1.
The Entity Graph (PNG or PDF) — The visual map from Lecture 10.4.
The Evidence Folder — All screenshots, organized by finding. Filenames match the evidence log.
The Raw Data (Optional) — CSV files, JSON output, tool results. Include this if the client has technical staff who may want to verify or extend your work.

Packaging for Delivery

Zip everything into a single archive. Name it clearly: Investigation_SubjectName_YYYY-MM-DD.zip. Include a README file that lists the contents and explains the folder structure.

If delivering via email, encrypt the attachment. The report contains personal data. Protect it.

The Final Review Checklist

Before you submit, go through this list:

Every claim in the report has a cited source.
Every cited source has a matching screenshot in the evidence folder.
The entity graph is clear and labeled.
The executive summary answers the original question.
The risk rating is justified.
The report has been proofread for spelling and grammar.
The client’s name, your name, and the date are on the cover page.
The file is encrypted if sent electronically.

If any item on this list is unchecked, you are not done.

Additional Resources for Report Writing

These OSINT practitioners have published excellent content on report writing and investigation methodology. Study their work.

Tactical OSINT Academy — Entity graph building and investigation workflow. The video referenced in Lecture 8.4 is a strong starting point.
Bellingcat — The public face of professional open source investigation. Their published reports are models of structure, sourcing, and clarity. Read them. Study how they present findings.
Trace Labs — Missing persons OSINT. Their methodology emphasizes speed, accuracy, and actionable intelligence. Their report templates are worth reviewing.
Michael Bazzell (IntelTechniques) — His books and training materials cover report writing for private investigators. Practical, no-nonsense guidance.

Building Your First Entity Graph — A Walkthrough

This video by CyberSudo / UK OSINT Community are one of the clearest tutorials on entity graph building for investigators. Watch it before you build your first graph:

These videos covers selecting entities, establishing relationships, and structuring the graph so it tells a coherent story rather than becoming a tangled mess. This is essential viewing.

Graph Methodology

Start with the primary entity. Your target. Place them in the center.
Add confirmed connections. Companies they direct. Social media accounts you verified. Email addresses you extracted. Each connection gets its own node.
Add secondary connections. The company’s other directors. The email domain’s owner. Each layer moves outward from the center.
Color code by confidence. Green for confirmed. Yellow for probable. Red for unverified. The client sees immediately what is solid and what needs further work.
Label every edge. Do not just draw lines. Label them. “Director of.” “Owns.” “Linked via profile picture hash.” “Registered email address.” The label explains the connection.
Keep it clean. A graph with 200 nodes is noise. A graph with 20 nodes and clear relationships is intelligence. If the graph is too dense, split it into multiple views. One for corporate structure. One for digital footprint. One for risk indicators.

Choosing the Right Tool

Tool________Best_________ForCost

Maltego — Automated transforms, large investigations > Free CE / Paid Pro
Gephi — Publication-quality static graphs > Free
Obsidian — Investigation knowledge base with graph view > Free
OSINT — TrackerPurpose-built OSINT case management and graphing > Free / Paid
draw.io / Google — Drawings Simple, small graphs > Free

Capstone Course: The Integrated Investigation

This final module is not a lecture. It is a simulated, real-world investigation. Every technique, every tool, every methodology you have learned across this course now comes together in a single assignment. There are no walkthroughs. Only the target, the task, and your training.

Challenge One:

Scenario

A client is considering a business partnership with an individual named Michael Hall. Before proceeding, they require a discreet background investigation. The client has provided only a name, a dissolved company, and a LinkedIn profile. You must find everything else.

Target Information

Subject Name: Michael Hall
Known Company: HALL OR NOTHING MANAGEMENT LIMITED
LinkedIn Profile: https://www.linkedin.com/in/michael-hall-8256b964/

Investigation Tasks

Using only open-source intelligence, gather comprehensive intelligence on the subject to inform your client’s decision. Answer the following questions with documented methodology for each.

Task 1: Who is Michael Hall, and what is his affiliation with HALL OR NOTHING MANAGEMENT LIMITED?

Task 2: What is his role within the company? Provide any appointment dates, resignation dates, or changes in position.

Task 3: What is his country of residence and date of birth? Cite the source document.

Task 4: What is the company registration number?

Task 5: What was the company’s previous name, and during what period was that name in use?

Task 6: What is the current company status? Is it still active?

Task 7: On 22 May 2008, what was the company’s full legal name, registered office address, post town, country, and postcode?

Task 8: Extract Michael Hall’s LinkedIn numeric User ID. Document your extraction method.

Task 9: Discover any corporate or personal email addresses associated with Michael Hall or his company. Document how each was found and validated.

Deliverable Requirements

Your report must include:

Clear, concise answers to each task.
The methodology, techniques, and tools used for each phase of intelligence collection.
Source citations for every finding (URLs, document references, access dates).
A professional tone suitable for client delivery.

Submission

Submit your completed report to: cybershieldmentor@gmail.com

Operational Boundaries

Use only publicly available information.
Do not contact the subject or any associated individuals.
Do not attempt to access any private accounts or systems.
This is a training exercise. All findings are for educational purposes only.

Begin your investigation. Your client is waiting.

Challenge Two:

Practical Exercise: Operation Dark Leak — The Intercepted Image

Classification: TRAINING EXERCISE // OSINT-2026-089

Threat Vector: Data Exfiltration / Dark Web Credential Sale

Scenario: A threat actor was intercepted attempting to sell stolen corporate credentials on a dark web marketplace. The evidence is a single image file. Your task is to extract the hidden data, identify the threat actor, and build a complete intelligence profile.

The Evidence

You have been provided with one image file:

File Name: invoice_2026_03.jpg

Download Link: https://drive.google.com/file/d/1i-Noh21EavnWH8zprQlmjVoHGaLmYvDP/view?usp=sharing

The image appears to be a standard invoice template. Nothing more. Everything you need is hidden within it.

Your Tasks

Phase 1: Breach Intelligence

Extract the hidden data from the image. Identify:

The breached company name.
The number of compromised employees.
The CEO’s full name, email address, and office location.
Any other compromised individuals and their roles.
The date of the breach.

Hint: The techniques you need are covered in Module 9 — Image Forensics & Hidden Data Recovery. Start with the simplest tool first.

Phase 2: Threat Actor Intelligence

Within the extracted data, you will find a seller information section. Document:

The threat actor’s alias.
The dark web onion URL.
The Telegram username.
The Bitcoin address.
The PGP Key ID.
The encryption key.

Phase 3: GitHub Attribution — Unmasking the Threat Actor

The seller information contains an alias. This alias is a GitHub numeric user ID. Your task is to resolve it to a real identity.

Step 1: Resolve the numeric GitHub ID to a username. Use the GitHub API or the techniques covered in Module 4.6 — GitHub Recon.

Step 2: Pull the full GitHub profile. Document:

Username.
Real name (if listed).
Email address.
Company affiliation (if listed).
Location.
Personal website or blog URL.
Twitter/X/LinkedIn handle.
Account creation date.

Step 3: Analyze the threat actor’s repositories and provide intelligence on their:

Commit email addresses
Skills and interests.
Any leaked credentials or sensitive files accidentally committed.

Step 4: Using the information extracted from GitHub, map the threat actor’s wider digital footprint:

Real name and username across LinkedIn, Twitter/X, and Google.
Their email breach integrity
Profile intelligence
Document every additional account, platform, and piece of personal information discovered.

Step 5: Geolocate the threat actor. From the location found on GitHub or other platforms, identify the city and country. If a specific address or landmark is visible in any discovered content, locate it on Google Earth Pro. Screenshot and annotate.

Phase 4: Comprehensive Intelligence Report

Compile everything into a structured intelligence report.

Report Sections:

Executive Summary — One paragraph overview of findings.
Breach Intelligence — Full details of the compromised company and employees.
Threat Actor Profile — Identity, location, contact details, and digital footprint.
Dark Web Findings — Marketplace listing documentation.
Cryptocurrency Trace — Bitcoin address analysis.
Entity Graph — Visual map showing the threat actor, their GitHub profile, email addresses, social media accounts, the breached company, the dark web marketplace, and the Bitcoin address. Use Maltego, Obsidian, draw.io, or any graph tool.
Risk Assessment — Low, Medium, or High with justification.
Recommendations — For law enforcement or client action.

Deliverable Format

Submit a single PDF report with all sections. Include screenshots of every step. Annotate images to show key findings. Cite all sources with URLs and access dates.

Cybershieldmentor@gmail.com

Disclaimer

The GitHub user ID used in this exercise is real and resolves to a public profile used for educational purposes. All names, email addresses, phone numbers, IP addresses, physical addresses, Bitcoin addresses, dark web URLs, and Telegram handles are fabricated. They do not represent real individuals or organizations. This challenge is for educational purposes only.

A Final Word to the Analyst

You have reached the end of this course. You now know how to extract unchangeable numeric IDs from social media platforms. You know how to geolocate an image from a single street sign. You know how to trace a company’s real owners through layers of offshore entities. You know how to recover deleted Reddit posts, extract commit emails from GitHub, and pull profile pictures from phone numbers without ever making a call.

These skills are powerful. Do not confuse power with permission

Every technique in this course works on real people. Real people with real lives, real families, and real expectations of privacy, even when they post publicly. The fact that you can find something does not mean you should. The fact that information is publicly accessible does not mean the subject intended for it to be collected, analyzed, and filed in a report about them.

Before you investigate anyone, ask yourself three questions

First, is the purpose legitimate? Due diligence for a business partner. Locating a missing person. Supporting a legal case. Investigating a threat. These are legitimate purposes. Investigating an ex-partner out of jealousy is not. Investigating a stranger out of curiosity is not. If you cannot explain your purpose to a colleague without feeling uncomfortable, stop.

Second, are you minimizing harm? Collect only what you need for the investigation. Do not hoard data. Do not share findings with anyone outside the authorized audience. When the investigation is complete, securely dispose of what you no longer need. The less personal data sitting in your investigation folders, the less can be leaked, stolen, or misused.

Third, are you operating within the law? Laws vary by jurisdiction, but the principle is universal. If you are unsure whether a technique is legal, consult a lawyer before using it. “I read it in an OSINT course” is not a legal defense. This course has taught you what is technically possible. It is your responsibility to determine what is legally permissible in your jurisdiction and your context.

The OSINT community has a saying: “Trust but verify.” I will add one more: “Investigate, but do not become the story.”

Your operational security failures become someone else’s headline. Your ethical failures become ammunition against the entire profession. Every time an investigator uses these techniques for harassment, stalking, or personal gain, it damages the credibility of legitimate OSINT work. Do not be that person.

You have the tools. You have the methodology. You have the technical skills. What you do with them defines who you are as a professional.

Go do good work. Be thorough. Be accurate. Be ethical. The field needs more investigators like that.

About the Author

This course was built by someone who does the work. No theory without practice. No technique without testing.

If you want to connect, ask questions, or share what you have built using these skills, you can find me here:

- LinkedIn: https://www.linkedin.com/in/precious-vincent-669279263/`
- X (Twitter): https://x.com/d4rk_intel`
- GitHub: https://github.com/techenthusiast167`

End of Course

Appendices

Appendix A: Glossary of OSINT Terms & Appendix B: Complete Tools Index

Every term and tool referenced in this course, organized by category, with URLs.

https://drive.google.com/file/d/1GUvsefNWHBbngd8bE1_enrFjvq0zMANt/view?usp=sharing

NEED TO REVISIT THE FOUNDATIONS?
If you need to refresh your operational security setup, review the Google Dorking syntax bible, or look up target verification protocols for specific social platforms, you can return to the initial volume at any time. > > CLICK HERE TO GO BACK TO VOLUME 1: FOUNDATIONS & SOCMINT DEEP DIVES:

The Professional OSINT Practitioner

D4RK_INTEL — Sat, 18 Jul 2026 21:49:25 GMT

Volume 1: Foundations, Geospatial, & Target Footprint Analysis

Core Syllabus Index

Module 0: The OSINT Foundation & Ethical Framework

Lecture 0.1: What OSINT Is and Is Not
Lecture 0.2: A Brief, Practical History
Lecture 0.3: The OSINT Trinity: Ethics, Law, and OPSEC

Module 1: Advanced Search Engine Mastery & The Art of the Google Dork

Lecture 1.1: How Search Engines Index the World
Lecture 1.2: The Dorking Syntax Bible (Operators & Practical Application)

Module 2: Image Intelligence (IMINT): Geolocation, Verification, and Metadata

Lecture 2.1: The Art and Science of Image Geolocation
Lecture 2.2: Reverse Image Search Tradecraft (Crop First, Search Second)
Lecture 2.3: EXIF, the Hidden Storyteller

Practical Assignment: The "Where in the World" Geolocation Capstone

Module 3: Email & Username Intelligence: The Digital Skeleton

Lecture 3.1: Email Deconstruction & Intelligence
Lecture 3.2: The Forgotten Art of Verification & Password Reset Intel
Lecture 3.3: Username-Driven Attribution (Permutation Logic)
Lecture 3.4: Breach Intelligence — Turning Emails into Identities

Practical Assignment: Operation SHADOW TRACE

Module 4: Social Media Intelligence (SOCMINT): Platform Deep Dives

Lecture 4.1 to 4.11: Advanced Target Enumeration & Verification on Facebook, LinkedIn, Instagram, Reddit, X (Twitter), GitHub, TikTok, Bluesky, and Discord.

Module 0: The OSINT Foundation & Ethical Framework

Before you open a single tool, before you run a single search, before you touch any data, you need to understand what you are doing, why you are doing it, and how to do it without destroying yourself in the process. This module sets the baseline. Everyone starts here.

Lecture 0.1: What OSINT Is and Is Not

OSINT is Open Source Intelligence. The official definition is simple: intelligence produced from publicly available information that is collected, exploited, and disseminated in a timely manner to an appropriate audience.

Let me break that down

Publicly available means the information is accessible without special access. No passwords. No breaches. No hacking. If you need to log in, bypass a paywall, or exploit a vulnerability, that is not OSINT. That is something else entirely.

Collected, exploited, and disseminated means you do not just find data. You process it. You analyze it. You turn it into something actionable. Then you deliver it to someone who can use it. Raw data is not intelligence. Intelligence is data that has been verified, contextualized, and presented with meaning.

The Intelligence Cycle Applied to OSINT

Every professional investigation follows a cycle. Skip a step, and your product suffers.

Planning & Direction: What is the question? What does the client actually need? Define your scope before you start, or you will drown in data.
Collection: Gather the raw information. Search engines, social media, public records, domain tools, archives.
Processing & Exploitation: Organize the raw data. Strip out noise. Convert formats. Prepare for analysis.
Analysis & Production: Connect the dots. Identify patterns. Draw conclusions. Produce a report that answers the original question.
Dissemination: Deliver the finished intelligence to the client in a format they can use.

Distinguishing OSINT from Adjacent Disciplines

OSINT is one intelligence discipline among many. Do not confuse them.

HUMINT — is human intelligence. Talking to people. Recruiting sources. Running informants. That is not OSINT.
SIGINT — is signals intelligence. Intercepting communications. That is not OSINT.
GEOINT — is geospatial intelligence. Satellite imagery analysis. OSINT can include GEOINT when the satellite data is publicly available, but the classified stuff is not OSINT.

What OSINT Is Not

Let me be absolutely clear on this.

OSINT is not hacking. You do not bypass security. You do not exploit vulnerabilities. You do not access systems without authorization.

OSINT is not doxxing. Doxxing is publishing private information with malicious intent. OSINT is collecting and analyzing publicly available information for legitimate purposes. The difference is intent, consent, and dissemination.

OSINT is not illegal access. If a file is publicly accessible on a server but the server owner did not intend for it to be public, accessing it may still be legal in some jurisdictions. That does not make it ethical. We will cover this boundary in depth.

If you want to be a hacker, this is the wrong course. If you want to be a professional investigator who operates within the law and maintains ethical standards, you are in the right place.

Lecture 0.2: A Brief, Practical History

OSINT sounds new. It is not. Governments have been doing this for over eighty years.

The Early Days

During World War II, the United States created the Foreign Broadcast Information Service, or FBIS. Their job was simple. Monitor foreign radio broadcasts. Transcribe them. Translate them. Analyze them. This was open source intelligence before the term existed.

The BBC performed a similar function for the United Kingdom. Both organizations understood that publicly available information, when systematically collected and analyzed, produces intelligence as valuable as anything from a spy.

The Digital Revolution

The commercial internet changed everything. Suddenly, information that used to require a physical presence to access became available to anyone with a modem. Search engines organized it. Forums and early social media created new sources of human behavior data.

The 2010s saw the rise of platforms like Facebook, Twitter, YouTube, and LinkedIn. Billions of people began voluntarily publishing their locations, relationships, opinions, and activities. For an intelligence analyst, this was unprecedented.

The Open Source Revolution

The 2020s marked a turning point. The conflict in Ukraine demonstrated that open source intelligence had matured into a primary intelligence discipline. Civilian analysts using commercial satellite imagery, social media posts, and public flight tracking data were able to document military movements, verify attacks, and expose disinformation in near real-time.

This was not a niche hobby. It was a strategic capability. Governments, corporations, and investigative organizations now recognize OSINT as essential. That is the world you are entering.

Lecture 0.3: The OSINT Trinity: Ethics, Law, and OPSEC

Three things govern every investigation you will ever conduct. Ethics. Law. Operational Security. Ignore any one of them, and you are not a professional. You are a liability.

Ethics

Ethics is not the same as law. Something can be legal and still be wrong. Your ethical framework is what separates you from a stalker, a harasser, or a vigilante.

Key principles:

Respect for privacy — Just because information is publicly available does not mean the person intended for it to be public. Consider context. A photo posted to a public Facebook group is public. A photo extracted from an unsecured cloud storage bucket is also technically public, but the subject did not consent to its distribution. Understand the difference.
Data minimization — Collect only what you need for the investigation. Do not hoard personal data. When the investigation is complete, securely dispose of what you no longer require.
Intent — Ask yourself why you are investigating. Is the purpose legitimate? Due diligence for a business partnership? Locating a missing person? Supporting a legal case? These are legitimate purposes. Investigating an ex-partner out of jealousy? That is stalking.
When does investigation become stalking? When the purpose is personal rather than professional. When the collection is obsessive rather than systematic. When the subject has a reasonable expectation of privacy and you violate it. If you are not sure, ask a colleague. If you cannot explain your purpose to a third party without sounding creepy, stop.

Law

Laws vary by jurisdiction, but some principles apply broadly.

GDPR — (General Data Protection Regulation) governs the processing of personal data in the European Union and the UK. It applies even if you are outside the EU but processing data about EU residents. Understand the basics. Public availability is not an automatic defense.
CFAA — (Computer Fraud and Abuse Act) in the United States makes it illegal to access a computer system without authorization. If a site has terms of service and you violate them, you may be committing a federal crime. Read terms of service. Know what you are agreeing to.
Terms of service are legally binding contracts — If a platform prohibits automated scraping, and you automate scraping, you are in violation. This may be civil rather than criminal, but it can still get you sued or banned.
Publicly available does not mean legal to collect or process — This is the most important legal lesson in this course. A document sitting on an open server is publicly available. If you access it for a legitimate purpose, you may be fine. If you download it, republish it, or use it for harassment, you may be committing crimes. Context and jurisdiction matter. When in doubt, consult a lawyer.

Operational Security (OPSEC)

Your own security is your first priority. If your investigation exposes you, you become the story. Your target may retaliate. The platform may ban you. Your employer may face legal consequences.

Practical Setup: The Investigation Environment

Every investigation starts with a clean, isolated environment.

Virtual Machine (VM): Use VirtualBox or VMware. Install a clean operating system. This VM is only for investigations. Nothing personal lives here.
Dedicated Browser: Use Firefox or Brave within the VM. Configure privacy settings. Disable telemetry. Install essential extensions only.
VPN or Dedicated Connection: Your investigation traffic should not originate from your home IP address. Use a VPN with a kill switch, or a dedicated mobile hotspot.
No Cross-Contamination: Never log into personal accounts from your investigation VM. Never check your email. Never browse social media. This VM touches the target. Nothing else.

Sock Puppets, Not Sloppy Puppets

A sock puppet is a fabricated online identity used for investigation. Done right, it is a professional tool. Done wrong, it is a liability that exposes you in seconds.

Creating a credible sock puppet requires:

A believable backstory: The persona needs a name, a location, an occupation, and a plausible history. Do not invent a neurosurgeon if you do not know what a neurosurgeon does. Keep it simple. Keep it close to what you actually know.
Aged accounts: Create accounts and let them sit. A brand-new account with zero friends, zero posts, and zero history is immediately suspicious. Build the persona over weeks or months before using it for investigation.
Consistent activity: Post occasionally. Follow people. Build a presence. The account should look lived-in.
Dedicated infrastructure: Each sock puppet gets its own email address, its own phone number (for verification), and its own profile picture. Never reuse details across puppets.
Browser fingerprinting countermeasures: Websites track your browser fingerprint, a combination of your screen resolution, installed fonts, timezone, language settings, and more. Use anti-fingerprinting browser extensions or dedicated tools like the Brave browser’s fingerprinting protection. Your sock puppet’s fingerprint must not match your real fingerprint.
VM escape risks: If malware on the target’s site breaks out of your VM and reaches your host machine, you are compromised. Keep your VM software updated. Do not download files from suspicious sites directly. Use a sandbox.
Canary tokens: These are hidden trackers you can embed in documents or links. If someone opens a file you planted, the token alerts you. This is how you detect if your sock puppet has been discovered and someone is investigating you back.

Module 1: Advanced Search Engine Mastery & The Art of the Google Dork

This module moves beyond simple search into the syntax-based exploitation of search engine indexes.

Lecture 1.1: How Search Engines Index the World

Search engines like Google, Yandex, Bing, and others are far more than everyday query tools. For the OSINT investigator, they are the primary gateway to an immense, continuously updated repository of publicly available intelligence. These platforms systematically crawl, index, and organize billions of web pages, documents, and exposed directories, often surfacing data that website owners never intended to be discoverable.

Security analysts and professional investigators have long recognized this power. For years, they have relied on search engines not merely for casual research, but as precision instruments to gather actionable intelligence and uncover evidence. Whether the task involves mapping the digital footprint of a person of interest, tracing infrastructure in a cybercrime investigation, or conducting comprehensive due diligence on a corporation, mastery of search engine mechanics separates the professional from the amateur. This lecture establishes the foundational understanding of how that indexing process works because you cannot exploit what you do not understand.

Understanding crawlers, indexes, and why dorks work.

Let us get one thing straight before we touch any dork or type any command: you need to understand what happens behind the scenes when a search engine does its job. If you skip this part, you will just be memorizing syntax without knowing why it works, and that is not how a real investigator operates.

Search engines use automated bots, often called crawlers or spiders. These bots are constantly moving across the web, jumping from one link to another, downloading page content, and following new paths wherever they lead. They are not smart. They are just fast and relentless. They land on a page, read the text, the titles, the links, the file names, and then they move on. Whatever they find, they take back to the search engine’s main database, which we call the index.

Now, the index is basically a gigantic, constantly updating library of everything the crawlers have seen. But here is the part most people miss: crawlers do not just index the obvious stuff. They also index things like directory listings that someone forgot to secure, backup files with weird extensions, server error messages that leak software versions, and even login portals that were never meant to be found through a simple search. They just crawl and capture. They do not judge whether something should be public or not. That is where we come in.

This brings us to Dorks

A Google dork is not some magic hack. It is simply a search query that uses advanced operators to tell the search engine exactly what we want from that massive index. Think of it like this: the index holds everything the crawler saw. Most people just type random words and hope for the best. We, on the other hand, use operators to filter out the noise and pull back only what is valuable. We are not breaking anything. We are not accessing anything illegally. We are simply asking the search engine a smarter question.

So when you use a dork like intitle:"index of", you are basically telling Google: “Hey, from your entire index, show me only pages where the title tag literally says ‘index of’.” That is it. The power does not come from the tool. It comes from you understanding how the data got there in the first place and knowing how to ask for it properly.

This is the foundation. Once you internalize this, every operator, every filter, every combination will make sense because you will know what you are actually doing under the hood.

Lecture 1.2: The Dorking Syntax Bible

Now we get to the part everyone thinks they already know. Most people can type `site:` into Google and feel like a hacker. But there is a massive difference between knowing a few operators and truly understanding how to combine them for precise, repeatable results. That is what this lecture is about.

Let us break down the core operators one by one, not just as definitions, but as tools with specific intelligence purposes

site:

This one restricts your search to a single domain or top-level domain. Sounds simple, right? But here is what most people miss. `site:example.com` searches that domain and all its subdomains. So if you are investigating a company, you are not just searching their main website. You are also pulling results from their support portal, their dev environment, their staging server, whatever is publicly exposed and indexed. You can also flip this. `site:gov` restricts results to government domains. `site:edu` targets educational institutions. For an investigator, this operator is your scope control. Use it first, then layer everything else on top.

intitle:

This operator searches only within the HTML title tag of a page, the text that appears on your browser tab. Why is this important? Because the title tag often contains the most descriptive, structured information about what a page actually is. Directory listings have “Index of” in the title. Login pages often have “Login” or “Sign In.” Camera feeds have the device model. When you use `intitle:`, you are not just searching for words on a page. You are searching for the page’s identity.

inurl:

This one hunts inside the URL itself. URLs carry structure. They reveal file paths, directory names, parameters, and sometimes even usernames. If you see `/admin/` in a URL, you know what that likely points to. If you see `/uploads/`, you know files might be sitting there openly. The `inurl:` operator lets you target those structural clues directly. This is how you find login portals, exposed admin panels, and configuration files that were never meant to be public.

intext:

This searches only within the body text of a page. It ignores titles, URLs, and metadata. Why does this matter? Because sometimes the thing you are looking for, like a password, an internal project name, or a specific phrase from a leaked document, only exists in the body content. `intext:` lets you cut straight to it without getting distracted by pages that merely mention your keyword in a title or link.

Combining Operators

Here is where the real skill comes in. Any amateur can use one operator. A professional combines them to build a precise query that returns exactly what they need and nothing else.

Let me give you an example. Say you are doing a corporate investigation and you want to find Excel files on the target’s domain that contain the word “confidential.”

You do not just type “confidential” into Google. You build this:

`filetype:xlsx site:company.com intext:”confidential”`

Now let us break down what this does. `site:company.com` locks your search to their domain. `filetype:xlsx` tells Google you only want Excel spreadsheets. `intext:”confidential”` instructs it to look inside the body of those spreadsheets for that specific word. Three operators, one query, and suddenly you are looking at documents that were probably meant to stay internal.

That is the mindset. Every operator is a filter, and your job is to stack filters until only the gold remains.

The Often-Overlooked Operators

Nobody talks about these enough, and that is a mistake.

`daterange:` lets you restrict results to a specific time period using Julian date format. This is critical for investigations where you need to see what was indexed during a particular time-frame, like before a company claimed they removed certain content, or during the period when a cyberattack was happening.

Number ranges, accessed through the numrange operator or simply by using two dots between numbers, are another underused weapon. Let us say you are looking for a specific model of a vulnerable IoT device. Instead of guessing, you can search for a range of serial numbers or firmware versions that are known to be exploitable. This turns a broad search into a surgical strike.

`filetype:` we already touched on, but understand how deep this goes. Beyond `xlsx` and `pdf`, you can hunt for `.sql` database backups, `.env` configuration files, `.log` server logs, `.bak` backup files, and more. Each file type tells a different story. A `.sql` file might contain user credentials. A `.env` file might leak API keys. A `.log` file might expose internal IP addresses and server paths.

Practical Application

Let me give you real scenarios so you understand how this plays out in actual investigations.

Finding Exposed Directories:

When a web server has directory listing enabled, it creates a page titled “Index of” showing every file in that folder like a file explorer. To find these, you use:

`intitle:”index of” site:target.com`

This returns every open directory on the target’s domain. From there, you browse manually and look for interesting filenames. I have found internal strategy documents, employee photos, database backups, etc using this dorks.

Finding Specific File Types:

Maybe you are looking for PDF reports a company published but never meant to be easily discovered. You would use:

`filetype:pdf site:target.com intitle:”internal”`

Or you are hunting for exposed spreadsheets:

`filetype:xlsx site:target.com intext:”salary”`

Every combination tells a different story and targets a different type of exposed data.

Finding Login Portals:

Many organizations expose login pages to the internet without realizing how easily they can be discovered. Try this:

`inurl:admin site:target.com intitle:”login”`

Or for network devices:

`inurl:/cgi-bin/ site:target.com`

These queries surface routers, cameras, and management interfaces that might still be using default credentials.

Finding IoT Devices and Vulnerable Software:

Shodan is great, but Google also indexes device interfaces. Cameras, printers, and other IoT devices often have web-based control panels. You can find them with queries like:

`intitle:”webcam” inurl:/view/`

Or for a specific vulnerable version of software:

`intext:”Powered by phpMyAdmin 4.7” site:target.com`

This tells you exactly which version is running, and from there you can cross-reference known vulnerabilities.

The Mindset

Do not memorize dorks. That is a beginner’s game. Understand what each operator does, then think logically about what kind of page would contain the information you are looking for. What would its title be? What would its URL look like? What file type would the data live in? Answer those questions, translate them into operators, and you will be able to build dorks for any situation, not just the ones someone else gave you.

Going Deeper: A Resource I Wrote for You

Before we close out this lecture on dorking syntax, I want to point you toward a resource I created specifically to deepen your understanding of what we just covered.

I wrote an article called The Art Of The Query, and I did not write it to give you a list of dorks to memorize. I wrote it to teach you how to think. How to approach a target with logic instead of guesswork. How to see operators not as commands, but as building blocks you can combine and recombine based on what you’re hunting for.

In that piece, I break down the mental framework behind crafting queries that surface what others miss. I walk through real examples and show the thought process behind each query, because once you internalize that process, you stop needing cheat sheets. You start building your own dorks on the fly, tailored to whatever investigation is in front of you.

If you want to go beyond what we covered today and really sharpen your search game, take the time to study it.

Here is the link: https://medium.com/p/ab129564af38

Read it carefully. Practice the techniques. That is how you move from knowing about dorks to mastering them.

Module 2: Image Intelligence (IMINT): Geolocation, Verification, and Metadata

If there is one skill set that has defined modern OSINT investigations, it is image intelligence. We have all seen it play out in real time. An image surfaces online, and within hours, sometimes minutes, investigators have pinpointed the exact location where it was taken. That is not luck. That is not some secret tool. That is a trained, systematic approach to extracting every possible clue from an image.

This module is where you learn to do exactly that. We are covering geolocation, verification, and metadata, not as separate concepts, but as parts of a single investigative workflow. By the end, you will not just look at images. You will dissect them.

Lecture 2.1: The Art and Science of Image Geolocation

Let me start by telling you what geolocation is not. It is not guessing. It is not scrolling around Google Earth hoping to stumble across a matching building. That is what amateurs do, and amateurs burn hours for nothing.

Professional geolocation is a methodical, checklist-driven process. You move from the big picture down to the smallest detail, and you document every single step along the way. You never, ever guess. If you can not prove it, you do not have it yet.

I am going to break this into two phases:

Foreground analysis and Background analysis. In practice, you will jump between both as clues present themselves, but understanding them separately builds the mental framework.

Foreground Analysis

The foreground is everything close to the camera. This is often where the richest clues live, so start here.

Signage is your best friend (as illustrated in the image above). A store name, a street sign, a billboard, even a warning label on a piece of equipment. Every sign tells you something. A shop name gives you a business to search. A street sign gives you an intersection. A warning label in a specific language narrows your geographic region instantly. Do not just read the sign. Ask what the sign implies. A sign in French does not just mean France. It could be Belgium, Switzerland, Senegal, or parts of Canada. That distinction is where the real work begins.

Language is another immediate filter. Text visible in the image, whether on signs, products, or clothing, can narrow your search to a handful of countries. But go deeper. Is it Brazilian Portuguese or European Portuguese? Simplified or Traditional Chinese? These distinctions matter, and a trained investigator learns to spot them.

Flags seem obvious, but be careful. A flag tells you what someone wants you to see. It does not always tell you where the image was actually taken. I have seen images with Russian flags that were geolocated to Ukraine, and images with American flags taken in the Middle East. Use flags as a starting point, not a conclusion.

License plates are pure gold when you can see them clearly. Even a partial plate, combined with the color and format of the plate itself, can narrow a location to a specific country or even a specific region within that country. Different countries use different colors for commercial versus private vehicles. Some regions have unique formats. Learn to recognize these patterns.

Architecture tells a story too. Building materials, window styles, roof types, and construction methods vary dramatically across the world. A building with thick stone walls and small windows suggests a hot climate. A steep, snow-shedding roof suggests northern winters. Balconies, shutters, brick patterns, all of these are regional fingerprints.

Vegetation is another clue most beginners ignore. Palm trees narrow things down, but which palm trees? A coconut palm and a date palm grow in very different environments. Deciduous trees versus evergreens tell you about climate. The color of the soil, the type of crops in a field, even the weeds growing through a crack in the pavement can provide hints.

People in the image also provide clues, but you have to be careful here too. Clothing styles, uniforms, and traditional dress can indicate region. Face masks during certain periods pointed toward countries with specific public health policies. But people travel. People immigrate. A person’s appearance is a clue, not a confirmation.

Background Analysis

Once you have exhausted the foreground, you move to what is behind the subject. This is background analysis, and for many investigators, this is where the real challenge begins.

Skyline analysis is one of the most powerful techniques we have. If you can see a city skyline, you can often match the silhouette of buildings to known locations. But even without a full skyline, individual structures help. A distinctive church spire, a uniquely shaped skyscraper, a water tower on a hill. These are landmarks, and landmarks are searchable.

Topography is the shape of the land itself. Is the location flat or hilly? Are there mountains in the distance? If so, what do they look like? Rounded, ancient mountains versus sharp, young peaks. The presence of snow on peaks in summer tells you about elevation and latitude. You can use tools like PeakVisor to identify mountain profiles from a single ridgeline.

Mountain profiles are particularly useful in rural or wilderness areas. If you have a clear view of a mountain range, you can often match the skyline to topographic data and pinpoint your location with surprising accuracy. I have seen investigators geolocate a photo taken in the middle of nowhere based entirely on the shape of a distant peak.

Utility poles and power lines are forensic gold. Different countries, and sometimes different regions within countries, use distinct pole designs, insulator types, and wiring configurations. Japan’s utility poles look different from Germany’s. Even the number of crossarms and the way wires are arranged can narrow your search. This is a niche skill, but once you learn it, you will never unsee it.

Road markings are equally valuable. The color of lane lines, the pattern of dashed versus solid, the font used on road signs, the design of guardrails. All of these differ by country and sometimes by state or province. A yellow center line means something very different in North America versus Europe. Learn these standards.

Annotation for Verification

Now we come to the most important part of this entire lecture, and I need you to take this seriously.

Finding a location is only half the job. A professional investigator proves their finding. You do this through annotation, which is simply the process of visually demonstrating the correlation between your source image and your reference imagery.

Here is what this looks like in practice

You have an image from social media. You have identified a potential location. You now open Google Earth Pro or QGIS and you capture a screenshot of that location from the same approximate angle. Then, using any basic tool that lets you draw on images, you highlight the points of correlation.

You draw an arrow to the distinctive crack in the pavement visible in both images. You circle the unique arrangement of windows on a building. You highlight the matching street sign. You annotate every single point that proves your case.

Why is this so important?

Two reasons. First, it forces you to verify your own work. If you can not clearly highlight multiple matching points, you are not done yet. Second, this is how you present findings to clients, to colleagues, or in a report. You do not just say “this photo was taken at these coordinates.” You show them, with visual proof, exactly how you know.

The tools for this do not need to be fancy. QGIS is free and powerful. Google Earth Pro is free and familiar. Even basic screenshot tools with markup capabilities work fine. What matters is the rigor of your process, not the price of your software.

This is the standard. No guesses. No assumptions. Just methodical analysis documented with clear, visual proof. That is what separates a professional geolocator from someone playing around on Google Maps.

Lecture 2.2: Reverse Image Search is a Starting Point, Not a Conclusion

Let me be blunt. Most people think reverse image search is the entire game. You drop an image into Google Images, see if it pops up somewhere else, and call it a day. That is not investigation. That is step one.

Reverse image search is a starting point. It tells you where else an image has appeared. It can help you find a higher resolution version, an uncropped version, or an earlier posting date. All of that is useful. But it does not confirm anything on its own. You still need to verify what you find.

Now, the tool landscape for this is broader than most people realize. Each engine sees a different slice of the internet.

Google Lens and Google Images are the obvious starting points. Google’s index is massive, and Lens in particular has gotten good at identifying objects within images, not just matching the whole frame. If you have a photo of a building, Lens might tell you what building it is without needing to find that exact photo elsewhere. That is powerful.

Yandex is, in my experience, often superior to Google for facial matching and for finding images that originated in Eastern Europe or Russia. Yandex’s index covers parts of the web that Google does not crawl as deeply. If you are investigating something with a Russian or Eastern European connection, you check Yandex. No exceptions.

Bing is the underdog nobody talks about enough. Its image matching algorithm sometimes catches results that Google misses entirely. I do not know why. I just know I have found crucial matches on Bing that appeared nowhere else. Use it.

TinEye is old but still useful, especially for tracking when an image first appeared. TinEye indexes images and tracks their first appearance date, which helps with timeline analysis. The downside is its index is smaller than the big players, but for certain investigations, that timestamp data is worth the extra step.

Baidu is essential if your investigation touches China. Baidu’s image search covers the Chinese internet ecosystem, which is largely invisible to Western search engines. If your image might have originated on Weibo, WeChat, or Chinese forums, Baidu is where you go.

Here is a practical technique that will immediately improve your results: crop first, search second.

Most people drop an entire image into the search engine and hope for the best. That works sometimes. But when it does not, you need to isolate unique details. Crop the image down to a specific lamp post. A distinct logo on a shirt. A unique architectural feature. A piece of graffiti. Then search that cropped section alone.

Why does this work? Because the search engine stops getting distracted by the whole scene and focuses entirely on matching that one distinctive element. I have cracked cases by cropping an image down to a single street sign that was barely visible in the corner of the original photo. The full image returned nothing. The cropped sign returned an exact match.

Remember, reverse image search is a tool, not a result. Use it. Exhaust it. But do not stop there.

Lecture 2.3: EXIF, the Hidden Storyteller

Now we get into something that separates serious investigators from everyone else. EXIF data.

Every time a digital camera or smartphone takes a photo, it embeds information into the file. This is called metadata, and EXIF, which stands for Exchangeable Image File Format, is the standard that defines what gets stored. Most people have no idea this data exists. You are about to become someone who exploits it.

Let us talk about what metadata actually is. It is a data dictionary attached to the image file. Think of it as a hidden document that describes the photo in detail. And I do not just mean GPS coordinates, though those are obviously valuable. The full picture is much bigger.

Metadata can include the make and model of the device, the software version the device was running, the exact date and time the photo was taken, whether the flash fired, the shutter speed, the aperture, the ISO, and sometimes even the direction the camera was pointing if the device had a compass. It can tell you if the image was edited, what software was used to edit it, and when that edit happened.

Here is why this matters for an investigator

Let us say someone posts a photo online claiming it was taken on an iPhone last week. You extract the metadata and discover the device was actually a Samsung Galaxy from three years ago and the photo was modified in Photoshop last month. That is a deception you just caught, and you caught it because you checked what the file itself had to say.

Practical Extraction and Analysis

The tool for this job is ExifTool by Phil Harvey. It is command-line based, it is free, and it is the gold standard for metadata extraction. Every investigator should have it installed and know how to use it.

Basic usage is straightforward. You point ExifTool at an image file, and it dumps everything it finds. Here is what that looks like:

exiftool image.jpg

{ Note: Kali Linux is case-sensitive. Gaining proficiency at it will help you a lot in utilizing these command-line tools effectively }

That single command spits out every metadata field embedded in that file. The output can be overwhelming at first, but you will learn to scan it for the fields that matter most.

Make and Model — tell you what device captured the image. This is useful for attribution. If a suspect claims they do not own a particular phone model, but every image they post comes from that exact model, you have got a problem for them.

Software version is often overlooked — It tells you what operating system or firmware the device was running. This can help you identify if a device was jailbroken, if it was running outdated software with known vulnerabilities, or if the version matches a device known to be used by a particular individual.

Timestamps are critical for timeline analysis — The Date/Time Original field tells you exactly when the shutter was pressed. Compare this against alibis, against other events, against when the image was actually posted. Time gaps between capture and posting can be revealing.

Modify Date — tells you if and when the file was altered. If the modify date is different from the capture date, someone edited that image. Dig deeper.

GPS coordinates — are the obvious prize, and when they are present, they can give you an exact location. But here is what most people do not consider. Even without GPS, the timestamp alone can help with geolocation. If you know the photo was taken at 3 PM local time and you can see the position of shadows, you can estimate longitude. Combine that with other visual clues, and you are narrowing the map.

The Serial Number OSINT Trick

This is a technique that does not get enough attention, and it is incredibly powerful once you understand it.

Some camera manufacturers embed the device serial number directly into the EXIF data. This is not a bug. It is a feature for tracking and warranty purposes. But for an investigator, it is a gift.

Here is why

If you extract the serial number from one photo, you can then search for that exact serial number across other images. And because it is a unique identifier tied to a specific physical device, you can now link multiple photos to the same camera, even if those photos were posted across different platforms, under different usernames, at different times.

Think about what that means — A target posts photos on Instagram under one name, on a forum under another name, and on a dark web marketplace under a third name. If all those photos came from the same camera and the serial number is embedded, you have just connected three separate online personas to one physical device. That is attribution.

This is not theoretical. I have done it. Others in this field have done it. It is a technique that produces hard, undeniable links between seemingly unconnected accounts.

Case Study: The Smartphone and the Seized Laptop

Let me walk you through a real-world scenario so you understand how this plays out in an actual investigation.

Authorities seized a laptop from a suspect involved in a cybercrime case. On that laptop, they found a photo that appeared to be a screenshot of something incriminating. The suspect claimed the laptop was not his and he had no idea how that photo got there.

Investigators extracted the EXIF data from that photo. It was not a screenshot at all. It was a photo taken with a smartphone, and the metadata revealed the exact make, model, and serial number of the device.

They then obtained the suspect’s smartphone, extracted its internal serial number, and matched it to the serial number embedded in the photo. It was the same device. The photo had been taken with that specific phone, then transferred to the laptop. The suspect’s story fell apart immediately.

That is the power of metadata. It tells the story the suspect does not want told. Your job is to listen to what the file is saying.

Practical Exercise: The “Where in the World” Geolocation Capstone

Alright. You have absorbed the theory. You understand foreground analysis, background analysis, the checklist approach, and the annotation standard. Now it is time to prove you can actually do this.

This exercise is not a quiz. It is a simulation of what a real investigation demands. You are going to receive an image. Your job is to answer three questions with absolute precision. But more importantly, your job is to show your work.

The Scenario

An image has surfaced on an obscure forum. The user who posted it claims it was taken “somewhere in Europe” and offers no further details. The image itself appears to show a scene of some significance. Your task is to determine exactly where this image was captured, identify what incident is connected to that location, establish the timestamp of that incident, and confirm the country.

But here is the thing. Anyone can guess a country. Anyone can drop a pin randomly and hope it lands close. That is not what we do.

Your Deliverables

You will produce a concise intelligence report containing the following:

1. The Exact Location
Provide coordinates. Not a neighborhood. Not a city. I want latitude and longitude. The kind you can paste into Google Earth and land directly on the spot where the photographer stood. If you give me a city name without coordinates, you have not finished the job.

2. The Incident Behind the Image
This location has a story. Something happened there. It might be a crime scene. It might be the site of a protest. It might be connected to a historical event. Your job is to research the location and identify the specific incident that makes this image relevant. What happened at this place? Why does it matter? Provide a brief, factual summary with sources.

3. The Timestamp of the Incident
When did this incident occur? I want a date, and if the information is available, a time. Not when the image was posted. Not when someone wrote an article about it. The actual date and time the event took place. If you can not find an exact time, explain why, but give me the most precise date you can confirm.

4. The Country
This should be straightforward after everything above, but state it clearly. No ambiguity.

The Annotation Requirement

This is non-negotiable.

Alongside your written answers, you will provide an annotated comparison image. Take a screenshot of the original image and a screenshot of the same location from Google Earth Pro, Google Street View, or satellite imagery. Place them side by side. Then, using any markup tool you have, highlight the points of correlation.

Draw arrows. Circle matching structures. Label distinctive features. Show me the crack in the pavement visible in both. Show me the unique roofline. Show me the arrangement of windows. Show me at least three distinct matching points that prove your geolocation is correct.

If you submit coordinates without an annotated verification image, your work is incomplete.

What I am Looking For

I am not just testing your ability to find a location. I am testing your process. Your annotation tells me whether you actually worked through the clues or just got lucky. Your incident research tells me whether you understand that geolocation is only valuable when it provides context. Your timestamp tells me whether you can distinguish between when an image was captured and when an event occurred.

This is what a client would expect. This is what a court would demand. This is the standard.

The Image:

Submission Format

Your submission should follow this structure:

Location Coordinates: [Latitude, Longitude]
Country: [Country Name]
Incident Description: [Brief, factual summary with sources cited]
Incident Timestamp: [Date and time, with explanation of source]
Annotated Verification: [Side-by-side image with correlation points clearly marked]
Report to be submitted to cybershieldmentor@gmail.com

Take your time. Be methodical. Check your work. And remember, if you can not prove it, you do not have it yet.

Module 3: Email & Username Intelligence: The Digital Skeleton

If you have been paying attention so far, you know that every investigation needs a starting point. Sometimes you have a name. Sometimes you have a phone number. But very often, what you actually have is an email address or a username. And here is the thing most investigators do not fully appreciate: an email address is not just a way to contact someone. It is a skeleton key. Woven into that single string of characters is an entire digital life waiting to be mapped.

This module is about extracting every possible drop of intelligence from an email address or a username. We will start with the address itself, breaking it down to understand what it tells us before we even run a single search. Then we will move into verification techniques that reveal hidden recovery details without alerting the target. Finally, we’ll tackle username-driven attribution, where a single pseudonym becomes the thread that unravels a person’s entire online presence.

By the end of this module, you will not look at an email address the same way again.

Lecture 3.1: Email Deconstruction & Intelligence

Before you plug an email into any tool, any database, any search engine, stop. Look at the address itself. The structure of an email contains intelligence, and if you skip this step, you are leaving free information on the table.

Every email address has two parts: the local part, which is everything before the @ symbol, and the domain part, which is everything after it. Let us break both down.

Local-Part Analysis

The local part is chosen by the user or assigned by an organization. It is personal. It often reflects how the person sees themselves or how they want to be seen. That makes it a behavioral artifact, and behavioral artifacts are intelligence.

Start by categorizing what you are looking at

Is it a name-based pattern? Something like john.doe@, jdoe@, doe.john@, john.doe84@. If so, you now have a probable first name, last name, and possibly a birth year or significant number. Right out of the gate, with zero tools, you have extracted personal identifiers. Document everything. John. Doe. Possibly born in 1984. These become your pivot points later.

Is it a profession or interest-based handle? Something like cyberwolf.security@ or tokyo.photographer@. This tells you how the person identifies. They see themselves as a security professional or a photographer based in Tokyo. Whether that is true or aspirational does not matter yet. What matters is this gives you keywords to search, forums to check, and a psychological profile to build.

Is it a random alphanumeric string? Something like xz17q42@. This often indicates a throwaway account, a service-generated address, or someone with operational security awareness. Random strings do not happen by accident. If someone is using an address with no personal connection, ask yourself why. What are they trying to hide?

Is it a combination? Maybe john.xz17q42@. That is interesting. The local part starts personal, then becomes random. This could indicate a corporate naming convention mixed with an employee ID, or it could indicate someone who started with their real name and added obfuscation. Either way, it is a pattern worth noting.

Here is a practical example

You are investigating a phishing email that came from sarah.consulting.2023@. Right away, you know a few things. The name Sarah is likely fake or the operator’s real name. The word “consulting“ suggests a business facade. The number 2023 suggests the account was created that year. This tells you the account is likely purpose-built and recent. You are not dealing with someone’s decade-old personal inbox. You are dealing with a disposable operational asset. That is valuable context before you have run a single search.

Domain Analysis

Now shift your attention to the domain part. This tells you where the email lives, and that opens up a whole new investigation path.

Start simple. Is it a free provider like Gmail, Yahoo, Protonmail, or Outlook? If so, the domain itself will not tell you much about the user’s affiliation, but the choice of provider can. Protonmail suggests privacy consciousness. A legacy Yahoo address suggests an older account or an older user. Gmail is the default for most. These are small signals, but signals add up.

If the domain is custom, like @companyname.com, you now have an organizational affiliation. That is huge. You can investigate the company itself, find employees, map the corporate structure, and potentially identify your target through organizational context alone.

Now dig deeper into that domain. The first technical step is checking MX records, which stands for Mail Exchange records. These DNS records tell you which servers handle email for that domain. This can reveal whether the domain uses Google Workspace, Microsoft 365, or a self-hosted mail server. A self-hosted server might expose the organization’s IP address range, server software, and potential vulnerabilities. Even knowing they use Google Workspace tells you their login portal is at a standard URL, which can be useful later.

To check MX records, you can use command-line tools like dig or nslookup, or you can use any online MX lookup tool. The command is simple:

dig mx targetdomain.com

The output shows you the mail servers and their priority order. Read it. Understand it. Add it to your intelligence file.

Next, WHOIS history. Current WHOIS data is often redacted due to privacy protections, but historical WHOIS records are a different story. Tools like whois.domaintools.com let you look up historical registration data for a domain. You might find the name, address, phone number, and email of the person who registered the domain years ago, before privacy protections were in place or before they thought to enable them.

I have found personal phone numbers in WHOIS records from 2015 that still worked in 2024. People change their numbers less often than you would think. I have found home addresses. I have found alternative email addresses used during registration that led to entirely new investigation paths.

Associated IP address space is the final piece. When you look up a domain, find the IP addresses it resolves to. Then check what other domains are hosted on those same IPs. Reverse IP lookup tools can show you every website sharing that server. A target might have one domain you know about and five others you do not, all sitting on the same IP. That is how you uncover hidden infrastructure.

Lecture 3.2: The Forgotten Art of Verification & Password Reset Intel

Now let us talk about something most courses skip entirely. Before you dive into massive automated searches across hundreds of platforms, there is a quiet, precise, and extremely effective technique you need to master. I call it the “no-click” method, and it is all about using the password reset and account recovery flows built into major email providers to extract intelligence without ever alerting your target.

The “No-Click” Dork for Google and Yahoo

Here is how it works. When you go to Google’s account recovery page and enter an email address, Google asks you to confirm your identity. Before you do anything, Google often displays a partially obscured recovery email or phone number associated with that account. You will see something like j*****e@gmail.com or a phone number ending in **23.

You have not clicked anything. You have not triggered any notification. The target has no idea you are doing this. Yet you have just learned that their recovery email starts with a J and ends with an E, or that their phone number ends in 23. That is intelligence.

Now take it further. If you see j*****e@gmail.com, and you already suspect the target’s name is John Doe, you can make an educated guess that the recovery email is something like johndoe@gmail.com. You can then investigate that address separately. You have just pivoted from one email to another without sending a single alert.

Yahoo’s recovery flow works similarly. Microsoft’s does too, though they have tightened things in recent years. The key is to approach the recovery page, observe everything displayed on the screen, and document it carefully. You are not bypassing security. You are reading what the page voluntarily shows you before you authenticate. That is passive intelligence gathering at its finest.

A Practical Walkthrough

You have a target email: unknownuser@gmail.com. You navigate to Google’s account recovery page at accounts.google.com/signin/recovery. You enter the email.

What you may see: The next page may show “Get a verification code” with options to send to a recovery email or phone. The recovery email is partially redacted: m*****l@yahoo.com. You now know the target’s backup email is a Yahoo address, and you can see the first and last characters. If you know the target’s name is Michael, you just confirmed a connection. If you did not know the name, you now have a strong lead.

Nevertheless - have it in mind: Google has recently changed its recovery flow for many accounts. The option to send a code to a recovery email or phone number is no longer always displayed. Instead, you may only see an option to send a verification code directly to the target email address you just entered. This is less useful, but not a dead end.

When this happens, the page still confirms that the email address exists and is a valid Google account. If the email did not exist, Google would tell you immediately. The fact that Google offers to send a verification code to that address confirms the account is active. That is still intelligence.

“Create Account” Probing

This is a related technique that works across virtually every platform. When you attempt to create a new account using a target email address, most sites will tell you if that email is already registered. They do this to prevent duplicate accounts, but for an investigator, it’s a presence checker.

The process is simple

Go to a site’s sign-up page. Enter the target email. If the site throws an error like “An account with this email already exists,” you have just confirmed the target has an account there. If it proceeds to the next step asking for a password, the email is not registered.

Now, I need to be clear about the ethical boundary here. This should be done manually, sparingly, and only on major platforms relevant to your investigation. You are not running a script that tests 500 sites. You are checking a handful of key providers like Facebook, LinkedIn, Instagram, Twitter, Amazon, and a few others based on your investigative needs. This is about targeted intelligence, not mass data harvesting.

Why does this matter?

Because if you discover your target has an Amazon account under an email that seems otherwise inactive, you now have another platform to investigate. If they have a LinkedIn account, you have professional history. If they have an Instagram account, you have personal photos and social connections. Each confirmed registration is a new door to walk through.

The Forgot Password Technique — Manual Verification Across Social Media Platforms

After using automated tools like Holehe or BehindTheEmail to check where a target email is registered, you need to manually verify those results. Automated tools can return false positives. The Forgot Password technique gives you certainty.

Here is how it works across major platforms

The Concept

Every social media platform has a password reset flow. When you enter an email address and click “Forgot Password,” the platform tells you whether that email is registered. It does this to help the legitimate user recover their account. You are simply reading what the platform voluntarily displays.

You never click the verification link. You never reset the password. You never access the account. You only observe the response.

Platform-by-Platform Walkthrough

Facebook

Go to https://facebook.com/login/identify. Enter the target email address. Click “Continue.”

If the email is registered, Facebook displays the associated profile with a partially redacted recovery email or phone number. You will see the profile picture, display name, and something like:

Email to: j*****e@yahoo.com
Text to: +1 ******23

If the email is not registered, Facebook says “No search results.” You have confirmed the email is not linked to a Facebook account. Both outcomes are intelligence.

Instagram

Open the Instagram app or go to http://instagram.com/accounts/password/reset. Enter the target email address. Click “Continue.”

If the email is registered, Instagram displays a confirmation message and may show the associated username and profile picture. If the email is not registered, Instagram says “No user found.” Instagram does not show a redacted recovery email or phone, but it confirms the account exists and often reveals the username.

Twitter (X)

Go to https://x.com/account/begin_password_reset. Enter the target email address. Click “Search.”

If the email is registered, X displays the associated account with the profile picture, display name, and @handle. It may also show a partially redacted recovery email or phone number. If the email is not registered, X says "We couldn't find your account with that information."

Go to linkedin.com/uas/request-password-reset. Enter the target email address. Complete any CAPTCHA if prompted.

If the email is registered, LinkedIn sends a password reset link and may displays the associated profile name. If the email is not registered, LinkedIn says “We couldn’t find a LinkedIn account associated with this email address.”

Have in mind that this technique also work well on Snapchat and TikTok. The best is to know how to pivot from one platforms to another to produce actionable intelligence.

Telegram does not have a web-based password reset flow for email. Instead, password recovery happens through the app. However, you can check if a phone number or username is registered by searching within the app or using bots like @userinfobot.

The Workflow

Run Holehe or another automated tool to check the target email across multiple platforms.
For every platform that returns a positive result, manually verify using the Forgot Password technique.
Document the platform name, the response, and any revealed usernames, profile pictures, or redacted recovery details.
Cross-reference discovered usernames and profile pictures against other platforms.
Never click verification links. Never reset passwords. Never attempt to access the account.

Why This Matters

Automated tools are fast but imprecise. A false positive from Holehe could send you down the wrong path. The Forgot Password technique gives you confirmation directly from the platform itself. The platform tells you, with its own response, whether the email is registered. That is not a guess. That is verification.

Lecture 3.3: Username-Driven Attribution

Now we shift from email to usernames. This is where the investigation often becomes truly expansive, because while people might have a few email addresses, they often have dozens of accounts scattered across the internet, many of them tied to a single username or a predictable set of variations.

The Single Username is the Key

People are creatures of habit. When someone creates an online identity, they tend to reuse the same username or small set of usernames across multiple platforms. This is not laziness. It is human psychology. We like consistency. We like being recognizable. We like not having to remember fifty different login names.

This means a single username can unlock an entire digital footprint. But you need to understand how people create these names in the first place.

Some usernames are identity-based — john.doe, john_doe84, doe.john. These directly reflect the person’s real name. If you already know the target’s name from email analysis or other sources, generating these variations is straightforward.

Some usernames are persona-based — silentwolf, night_crawler_adventures, cyber_panther. These reflect an interest, a self-image, or a subculture affiliation. A username like silentwolf might indicate interest in wolves, nature, or a particular gaming community. cyber_panther suggests an interest in hacking culture or cybersecurity. These keywords become additional search terms and community indicators.

Some usernames are hybrid — john.silentwolf. This combines a real name with a persona. These are especially valuable because they bridge the gap between someone’s real identity and their chosen online persona.

When you encounter a username, spend time thinking about it before you start searching. What does this name say about the person who chose it? What communities might they belong to? What other variations might they use?

Permutation Engines: The Logic Behind the Script

This is where we move from theory to practice. If a target uses silentwolf_adventures on one platform, they might use silentwolf, silent.wolf, silent_w0lf, silentwolf_hiker, or the_silent_wolf on others. These are not random guesses. They follow predictable patterns.

Let me teach you the logic so you understand what a permutation engine is actually doing, whether you build one yourself or use an existing tool.

The patterns fall into categories

Character substitution — is replacing letters with similar-looking numbers or symbols. o becomes 0. e becomes 3. a becomes 4. i becomes 1. So silentwolf could become silentw0lf, s1lentwolf, or silentw0lf.

Separator variation — is changing how words connect. Underscores become periods become hyphens become nothing. silent_wolf becomes silent.wolf, silent-wolf, silentwolf.

Suffix and prefix addition — is appending or prepending numbers, years, or keywords. silentwolf becomes silentwolf84, the_silentwolf, silentwolf_official, silentwolf_adventures.

Word order reversal — is flipping the sequence. silentwolf becomes wolfsilent.

Truncation and abbreviation — is shortening the name. silentwolf becomes silent, swolf, silentw

A proper permutation engine applies these rules systematically to generate a list of candidate usernames — https://mailmeteor.com/email-permutator. The logic is rule-based, not random, because human creativity follows patterns. Once you understand the patterns, you can predict what variations a target is likely to use.

Here is a practical example. Target username: `dark_phoenix_88`

Immediate observations: “dark” and “phoenix” are persona words, likely indicating interest in mythology, gaming, or hacker culture. “88” is likely a birth year or a significant number. The underscores suggest the user is comfortable with that separator style.

Permutations to check:

darkphoenix88, dark.phoenix.88, dark-phoenix-88, darkphoenix1988, dark_phoenix, phoenix_dark_88, d4rk_phoenix_88, dark_ph03nix_88, the_dark_phoenix, dark_phoenix_official.

Each of those is a query waiting to happen. You can generate these manually, but the process is repetitive and eats time you should be spending on analysis. The smarter approach is to split the target username into its base components, feed them into a permutation engine or an LLM with a structured prompt, and let it generate the full list of rule-based variations for you.

Example given below:

Using the email permutation web-based tool — MailMeteor: https://mailmeteor.com/email-permutator

Using LLM: Gemini, ChatGPT, etc

Target Identity Email Permutation Analysis — simple logic

“As an OSINT investigator, I require a comprehensive email permutation matrix for the target identity ‘Chris Evans’ across major providers like Gmail and Yahoo to map and uncover the subject’s digital footprint.”

You can adjust the above to fit the context of your investigation.

OUTPUTS:

1. Core Structural Permutations

These patterns use standard naming conventions with common separators (., _, -, or no separator).

2. Common Appendices (Year / Numbers)

If the baseline names are taken, users frequently append birth years, graduation years, or sequential numbers.

Common Year Formats (Assuming 1970–2005 range)

Replacing YY with 2-digit years (e.g., 81, 92, 00) and YYYY with 4-digit years (e.g., 1981, 1995).

Once you have the output, your job is to run those usernames through your search tools { Epieos, Intelbase, BehindTheEmail }, and manually verify each hit for intelligence value. The machine generates the possibilities. You do the investigative thinking.

Practical Tooling: Going Beyond the Button

Now, there are tools that automate username searching across platforms. Sherlock, Maigret, WhatsMyName.app. These are useful, but I need you to understand something critical. The tool is not the investigator. You are!

Sherlock takes a username and checks it against a list of sites. Maigret does the same with more advanced features and better reporting. WhatsMyName.app is a web-based alternative with a large database of sites to check.

Here is the problem with how most people use these tools. They type a username, press enter, and then scroll through the results looking for green checkmarks. They find a list of “found” profiles and call it done. That is not analysis. That is data collection.

When you run one of these tools and get results, your real work is just beginning. You need to parse the output manually. Visit each found profile. Look at the content. Does the writing style match your target? Are the interests consistent? Are the profile pictures the same or similar? When was the account created? When was it last active? Does it link to other accounts or platforms?

A tool might tell you silentwolf exists on Reddit, Twitter, Instagram, and a hiking forum. That is a list. Your job is to determine whether those accounts all belong to the same person, and if so, what the connections are between them.

The tool saves you the time of manually typing silentwolf into fifty different signup pages. That is valuable. But the analysis, the attribution, the link-building. That is all you.

Lecture 3.4: Breach Intelligence — Turning Emails into Identities

You have the target email. You have verified it is active. You have found where it is registered. Now you need to find out who it belongs to. This is where breach data becomes an attribution engine.

What Breach Data Reveals

When a website is compromised, user records spill onto the internet. These records often contain:

Real names linked to email addresses.
Physical addresses.
Phone numbers.
IP addresses used during registration.
Dates of account creation.
Passwords (hashed or plaintext).
Linked usernames on that service.

A single breach record can collapse an anonymous email into a full identity.

Where to Search

Have I Been Pwned: http://haveibeenpwned.com — Enter the email. See every breach it appears in.
DeHashed: http://dehashed.com — Search by email, username, phone, or IP. Returns names, addresses, and more.
IntelX: http://intelx.io — Broader search across breaches, dark web, and document leaks.
LeakCheck: http://leakcheck.io — Email and username breach search.
SnusBase: http://snusbase.com — Free breach search with good coverage.
IntelBase - https://intelbase.is — Free Email and breach intel tool.

The Attribution Workflow

Enter the target email into HaveIBeenPwned. Note every breach it appears in and what data was exposed.
Search the email on DeHashed. Look for real names, addresses, phone numbers, and IP addresses.
Take any discovered name and search it on LinkedIn, Facebook, and Twitter to confirm the identity.
Take any discovered phone number and run it through the Phone Number OSINT techniques from Module 5.
Take any discovered IP address and geolocate it. Compare it to the target’s claimed location.
Cross-reference every data point. One source is a lead. Three sources confirming the same name is attribution.

What You Do Not Do

Do not use discovered passwords to access accounts. That is illegal everywhere.
Do not download or store bulk breach databases. Possession may violate laws in your jurisdiction.
Do not share breach data outside your investigation. The data is compromised. Treat it with care.

Practical Exercise: Operation SHADOW TRACE

Now it is time to put everything from this module into practice. This exercise is designed to test your ability to start with almost nothing and build a complete attribution picture.

Classification: TRAINING EXERCISE // OSINT-2026–042
Threat Vector: Anonymous Harassment / Cyberstalking
Target: Public Figure (Victim)
Subject: @Allen123 / @Allen3sop1 (Threat Actor)
Objective: Identify the real-world identity and location of the threat actor through progressive open-source intelligence techniques.

Intelligence Brief

A public figure has received a direct message from the locked X (Twitter) account @Allen123 containing the following threat:

“Last warning. Stop your public appearances, or I’ll make sure your next morning walk ends differently.”

The account presents a dead end for standard social media review. It is locked. It has zero followers. The profile image is a generic cartoon avatar. The bio reads: “My main account Allen123 got banned. Follow me on my new account.” The account follows only five others.

Intelligence further indicates the subject has become aware of investigative scrutiny. As a counter-surveillance measure, the active username has been rotated to @Allen3sop1. Despite this operational security maneuver, enumeration efforts have successfully leveraged the legacy handle Allen123 as the primary pivot point for historical cross-platform correlation.

“Digital breadcrumbs are the unintentional map of a person’s online life. Enumerating these accounts allows us to connect the dots between anonymous aliases and real-world identities, ensuring no part of the target’s digital presence remains siloed.”

It should be noted that evidence collection on this challenge is primarily grounded in attribution and stylometric analysis. Accordingly, all findings must be assessed through that lens to avoid false positive!

Your task is to unmask this individual

Phase 1: Initial Reconnaissance

An anonymous account with no public engagement and a locked profile offers nothing through standard review. You must collect foundational metadata passively, without interaction or authentication requests.

Mission: Enumerate the account’s unique numeric ID and exact creation timestamp to establish a temporal baseline.

Flag Format: OSINT{account_id_account_creation_timestamp}

Phase 2: Username Pivot & Cross-Platform Enumeration

Threat actors frequently recycle handles or variations across services. The suffix “123” may indicate a birth year, a significant date, or padding to secure a unique username.

Mission: Search major social platforms, forums, and code repositories for all profiles utilizing the string “Allen123” or logical derivatives.

Hint: Decode and analyse the strings { zfgqa.fbpvny } to reveal the specific platform/service to focus your enumeration.)

Flag Format: OSINT{target_platforms_found_@handles}

Phase 3: Visual Intelligence & Travel Pattern Analysis

Content from alternative platforms reveals the subject has inadvertently shared geolocatable imagery.

Mission: Analyze public media uploads to identify:

The specific park or trail where the subject habitually takes a “morning walk.”
The name of the hotel the subject booked and the prominent landmark visible directly opposite their room window.

Flag Format: OSINT{trail_location_coordinates_hotel_name_landmark_name}

Phase 4: Geospatial Analysis

A photograph taken from inside the subject’s hotel room provides a clear line of sight to a distinct architectural structure.

Mission: Using Google Earth Pro or QGIS, establish a precise visual line-of-sight between the hotel coordinates and the identified landmark. Calculate the straight-line ground distance from the subject’s observation point to the structure.

Flag Format: OSINT{hotel_name_distance}

Phase 5: Target Email Lookup

A clue left in a comment section suggests the subject maintains a personal blog or manifesto site expressing political views outside their main social channels.

Mission: Conduct deep web searches to uncover the personal email address associated with the subject’s alternative online presence.

Hint: The target email is encoded with a Caesar cipher. Decode it to reveal the real address — (target email domain is gmail.com).

Flag Format: OSINT{target_email_address}

Phase 6: Property Records & Identity Attribution

With the subject’s real name obtained, shift to public government records to confirm physical presence and demographic data.

Mission: Cross-reference the name against public record aggregators to establish a comprehensive identity profile.

Flag Format: OSINT{target_real_name_current_address_age_phone_number_property_relative}

Phase 7: Social Media Attribution & Visual Confirmation

A concrete link between the anonymous persona and the identified individual requires irrefutable visual or content-based correlation.

Mission: Compile a short-form evidence correlation report.

Correlation Sample — Example:
The cartoon image used as @Allen123’s profile header on X matches the SHA-1 hash and EXIF thumbnail data of a photograph posted to [Subject Name]’s Facebook timeline dated [Date]. This constitutes direct visual attribution; the subject reused proprietary personal imagery across both anonymous and verified accounts.

Report:

Evidence Item 1: ____________________________________
Evidence Item 2: ____________________________________
Evidence Item 3: ____________________________________

Phase 8: Timeline Synthesis & Attribution Report

Finalize the investigation into a coherent, evidence-based narrative suitable for legal or internal security referral.

Mission: Construct a chronological synthesis of events and produce a final attribution statement.

Timeline Synthesis:

Date____________________Event

_______________________________________________

Final Attribution Statement:

The anonymous X account @Allen123 is operated by [Subject Full Legal Name], DOB [MM/DD/YYYY], residing at [Full Address]. Attribution is established through: (1) Cross-platform username correlation linking X to [Alternative Platform], (2) Geospatial analysis confirming travel history consistent with hotel booking records, (3) Public property and voter registration records confirming identity and residence, and (4) Visual match of specific imagery between the anonymous account and the subject’s verified personal accounts.

Final Flag:

OSINT{target_real_name_country_current_location_account_handles_found_relative}

Intelligence Summary

Field_______________________Value

Subject Name ____________
Country of Residence ______________________
Current Location _____________________
Anonymous Handle ___ @Allen123
Linked Accounts ______________
Time to Attribution ___________________
Legal Status ___ Pending Referral

Submission Requirements

Completed phase flags (Phases 1–8).
Evidence correlation report (Phase 7).
Timeline synthesis and final attribution statement (Phase 8).
Entity graph visualization (link chart) mapping all discovered accounts and their connections to the identified individual.
Submit all deliverables via secure training email: cybershieldmentor@gmail.com

Disclaimer

This OSINT challenge is designed for educational and training purposes only. All scenarios, entities, email addresses, domains, and geospatial references are either fictional, reconstructed from publicly available information, or used solely as instructional examples within a controlled environment.

Happy ethical hunting, analysts.

Going Deeper: A Resource I Wrote for You

Before we close out this lecture on dorking syntax, I want to point you toward a resource I created specifically to deepen your understanding of what we just covered.

I wrote an article called How To Investigate A Person Of Interest In 2026, and I did not write it to give you a list of tools to memorize. I wrote it to teach you how to think. How to approach a target with logic instead of guesswork. How to see tools and operators not as commands, but as building blocks you can combine and recombine for effective intelligence collection.

In that piece, I break down the mental framework behind investigating a person of interest that surface what others miss. I walk through real examples and show the thought process behind each tools, because once you internalize that process, you stop needing cheat sheets. You start building your own methodologies, techniques, and tools tailored to whatever investigation is in front of you.

If you want to go beyond what we covered today and really sharpen your search game, take the time to study it.

Here is the link: https://preciousvincentct.medium.com/how-to-investigate-a-person-of-interest-in-2026-77dfaadbe7e7

Read it carefully. Practice the techniques. That is how you move from knowing merely about tools to mastering them for effective intelligence collection.

Module 4: Social Media Intelligence (SOCMINT): Deep Dive & Platform-Specific Tactics

Social media is where people live their lives out loud. They post their opinions, their locations, their relationships, their frustrations, their achievements. For an investigator, this is not just data. This is behavioral gold. Every platform has its own architecture, its own quirks, its own hidden data layers. Knowing how to exploit each one individually is what separates a SOCMINT operator from someone who just scrolls through profiles.

This module is built for mastery. We go platform by platform, covering exact techniques for user ID extraction, attribution, search methodology, and evidence collection. No theory without practice. No tool without understanding what it’s doing under the hood.

By the end, you will not need a checklist. You will know where to look because you understand how each platform structures its data and how users behave within it.

Lecture 4.1: Facebook — The Graph API and Beyond

Facebook is the most data-rich platform on the planet for OSINT investigators, and most people only scratch the surface. The key to Facebook intelligence is understanding that every users on the platform has a numeric ID, and that ID is globally unique, unchangeable, and often exposed in places users never check.

User ID Extraction: The Core Technique

Every Facebook profile, page, group, photo, comment, and like has a numeric ID. This ID never changes, even if the user changes their vanity URL, their name, or their profile picture. If you capture the ID once, you can track that entity forever.

Method One: View Page Source technique

Navigate to any Facebook profile. Right-click and select View Page Source. Inside that HTML, press Ctrl + F and search for profile_id or userID or simply "id":". You will find something like "profile_id":"100000123456789" { Example given in the image above }. That number is the target’s unchangeable Facebook ID. Copy it. Document it. It will outlast any username change.

Method Two: Vanity URL

This works when you only have a vanity URL. Facebook allows custom URLs like facebook.com/john.doe. Behind that friendly name is still a numeric ID. Use the Facebook ID finder tools available online {https://lookup-id.com} to automate this process, or use a simple API call to graph.facebook.com/john.doe which returns a JSON object containing the numeric ID. This is passive, and unfortunately, it is no longer working as before.

Method Three: Profile Picture URL Analysis — Explained with Examples

Let me walk you through exactly how to extract intelligence from a Facebook profile picture URL. This method works because Facebook stores images on its Content Delivery Network, and the file-naming structure embeds identifiers that are unique to each user. You just need to know how to read them.

Step 1: Open the Profile Picture

Method A: Right-Click (Quick, When Available)

Go to any public Facebook profile. Right-click directly on the profile picture and select “Open image in new tab.” Do not right-click and save. Do not screenshot. You want the direct URL to the image file itself, not a download, not a screen capture. If the option appears, click it, and the image will open in its own tab with the full CDN URL visible in the address bar. Copy that URL. That is your data.

Method B: Inspect Element (The Reliable Fallback)

Sometimes Facebook’s front-end code blocks the right-click option or overlays interactive elements on top of the profile picture. When that happens, the Inspect Element method gets you there anyway. Here is how.

First, right-click anywhere on the page background, not on the image itself. Select “Inspect” or “Inspect Element” from the menu. This opens the browser’s developer tools panel.

Now, look at the top left corner of that developer tools panel. You will see a small icon that looks like a dotted square with a cursor arrow. This is the element selector tool. You can also activate it with the keyboard shortcut Ctrl + Shift + C. Click that icon once. Your cursor is now in inspection mode.

Move your cursor over the target’s profile picture and click on it. The developer tools panel will jump to the specific line of HTML code that renders that image. You are looking for an attribute called xlink:href within an tag, or a standard src attribute within an tag. It will look something like this:

xlink:href=”https://scontent.flos5-1.fna.fbcdn.net/v/t39.30808-6/456789012_1016123456789_987654321_n.jpg?_nc_cat=111...”

Double-click the URL inside the quotation marks to select it fully. Copy it. That is your direct CDN link. Open it in a new tab, and you will see the exact same image file, isolated, with the full URL visible in the address bar. This is the URL you will analyze in Step 2.

Why This Method Matters

The Inspect Element approach bypasses any right-click restrictions Facebook might implement. It also gives you the raw URL directly from the page source, including any parameters Facebook appends. You do not need to rely on the browser’s context menu. You go straight to the code and pull what you need. That is the investigator’s mindset. When one path closes, you find the one the developers left open.

Step 2: Read the URL Structure

The URL you get will look something like this:

https://scontent.flos5-1.fna.fbcdn.net/v/t39.30808-6/456789012_1016123456789_987654321_n.jpg?_nc_cat=111&ccb=1-7&_nc_sid=abc123&_nc_ohc=xyz789&_nc_ht=scontent.flos5-1.fna&oh=00_AQHDKSLSJDKEI...

I know it looks like a mess. Let me break it down.

The Base URL Before the Question Mark:

https://scontent.flos5-1.fna.fbcdn.net/v/t39.30808-6/456789012_1016123456789_987654321_n.jpg

This is the important part. Everything after the question mark is tracking and session parameters. You can strip those. The core filename is:

You can strip those. The core filename is:

456789012_1016123456789_987654321_n.jpg

Step 3: Decode the Filename Structure

Facebook profile picture filenames follow a pattern of three numeric segments separated by underscores, ending with _n.jpg.

Let me use a real example from a test profile. Here is an actual Facebook profile picture filename:

123456789_987654321098765_654321098765432_n.jpg

Break it down

The first segment, 123456789, is the most valuable. In many cases, this is one of three things:

The user’s Facebook numeric ID directly.
A hash derived from the user’s ID that Facebook uses for CDN routing.
The photo’s unique object ID assigned by Facebook’s storage system.

The second segment, 987654321098765, is a random or sequential identifier Facebook assigns to the specific image crop or resolution version.

The third segment, 654321098765432, is another internal identifier tied to the CDN node or image processing batch.

The _n suffix indicates it is a normalized, processed version of the original upload.

Step 4: The Practical Application

Now, here is why this matters for an investigation.

Say you are tracking a target who uses different names across platforms. On Facebook they are “John Doe.” On Instagram they are “vintage_bike_77.” You suspect they are the same person, but you need evidence.

You extract the Facebook profile picture URL and get the filename:

100000987654321_456123789012345_789012345678901_n.jpg

You extract the Instagram profile picture using a tool like imginn.com {https://imginn.com}or by inspecting the page source for the property=”og:image” field. The Instagram CDN filename is:

100000987654321_456123789012345_789012345678901_n.jpg

They match. Exactly. Not similar. Not “looks alike.” The same file, same CDN, same internal identifiers. That is not coincidence. That is the same Facebook account linked to an Instagram profile. The user connected their Instagram to their Facebook account, and Facebook stores the profile picture across both platforms using the same internal object ID.

In some cases, that first numeric segment is the user’s raw Facebook ID. Let me show you how to verify this.

Take the first segment from the filename: 100000987654321. Now, construct a Facebook profile URL using that number directly:

facebook.com/100000987654321

OR 

https://www.facebook.com/100000987654321

OR

https://www.facebook.com/profile.php?id=100000987654321

If it redirects to the target’s vanity URL or profile page, you just confirmed the ID. If the user ever changes their vanity URL, deletes their account and returns, or blocks you, you still have this numeric link. You can still track them.

Even if Facebook changes the CDN structure tomorrow, the logic remains the same. Files stored on a CDN carry identifiers. Those identifiers connect back to the uploader. Learn to read them, and you add another passive extraction method to your toolkit.

Step 6: Documenting the Evidence

For your investigation report, capture the following:

The full CDN URL with timestamp of extraction.
The filename segments broken down and annotated.
If cross-platform, the matching filename from the second platform side by side.
Screenshot of both URLs with the matching segments highlighted.

This is not circumstantial. This is technical evidence. The same file hash, same CDN path, same internal object ID appearing on two separate platforms proves the accounts share a single upload source. That is attribution.

One More Thing

This technique also works for Facebook Pages and Groups. When you open the profile picture of a Page, the same filename structure appears. If an anonymous Page is spreading disinformation, extracting the profile picture filename and cross-referencing it with other known assets can tie that Page back to an individual operator. I have used this. It works.

Search Capabilities

Facebook’s internal search is deliberately limited. Google, Yandex, etc is your external search engines for Facebook. Use the dork site:facebook.com "public profile" "works at" to find profiles associated with specific companies. Layer additional operators. site:facebook.com "public profile" "lives in London" "works at Barclays". This pulls profiles that Facebook’s own search might hide.

The About section is a transparency goldmine. Facebook logs the history of username changes, profile picture updates, and contact information. The “Recent Profile Pictures” album is particularly important because it is undeletable. Even if a user removes all their current photos, the “Recent Profile Pictures” album retains every profile picture they have ever used, in chronological order. This is a behavioral timeline sitting in plain sight.

Practical Methodology:

Always extract the numeric ID first. It is your anchor.
Check the About section for transparency history and contact info.
Review “Recent Profile Pictures” for historical imagery.
Use Google dorks with site:facebook.com for external search.
Check public groups the target belongs to. Group membership is often visible and reveals interests, locations, and associations.

Lecture 4.2: LinkedIn — The Corporate Org Chart

LinkedIn is not a social network. Not for us. LinkedIn is an organizational mapping tool that happens to have a newsfeed. Every profile is a data point. Every job change is a timestamp. Every comment is a window into internal team dynamics and individual expertise.

Most investigators use LinkedIn wrong. They search a name, scroll the profile, and move on. That is surface-level. The real intelligence is in the hidden identifiers, the activity patterns, the cross-platform bridges, and the contact discovery tools that extract what LinkedIn tries to hide behind premium paywalls.

I am going to walk you through every technique, tool, and method you need to extract maximum intelligence from LinkedIn. Pay attention. This is dense, and every piece matters.

Part 1: Discrete Search via Google

LinkedIn limits what you see if you do not pay. They cap search results. They hide profiles outside your network. They notify users when you view them if you are logged in. Google does none of these things.

The Google dork is your external search engine for LinkedIn. The base query is:

site:linkedin.com/in “company name”

This returns every public LinkedIn profile associated with that company, current and former, without hitting LinkedIn’s internal search limits and without generating any profile view notifications. You are not on LinkedIn when you do this. You are on Google. That is passive.

Now refine. Add a title:

site:linkedin.com/in “company name” “security engineer”

Add a location:

site:linkedin.com/in “company name” “security engineer” “London”

Add a date range using Google’s date filter under Tools. This catches profiles that were indexed during a specific period, which can help you find people who recently joined or left.

Add boolean logic to broaden the net:

site:linkedin.com/in “company name” AND (“security” OR “cyber” OR “infosec”)

This returns anyone in the security space at that company, regardless of exact title wording.

The key insight here is that you are not searching people. You are searching Google’s index of LinkedIn. Google crawled those profiles. Google stored them. You are just asking Google to show you what it already has. This is not hacking. This is not bypassing. This is using the tool that LinkedIn itself allowed to index its public profiles.

Part 2: LinkedIn User ID Extraction

Every LinkedIn profile has a unique identifier embedded in the page source. This ID is not the vanity URL. It is not the public profile link. It is a numeric or alphanumeric string that LinkedIn assigns internally. Extracting this ID allows you to track a profile even if the user changes their name, vanity URL, or headline.

Here is the method

Navigate to any public LinkedIn profile. Right-click on the page background, not on any image or button. Select “Inspect” or “Inspect Element” to open the browser’s developer tools.

Now, inside the developer tools panel, press Ctrl + F to open the search bar within the HTML source. Search for the term urn:li:member: — You are looking for a line that contains something like:

“member”:”123456789”

urn:li:fsd_profile:ACoAABc12345

The number after member or the string after urn:li:fsd_profile: is the internal LinkedIn profile ID. This ID is globally unique. It never changes. If the user deletes their account and recreates it with the same name, this ID will be different. But for the life of that profile, this ID is constant.

Another method is to look at the page source for objectUrn. Search for:

“objectUrn”:”urn:li:member:123456789”

The numeric portion is the member ID.

However, there are a few things to keep in mind:

The exact field name is not fixed. Depending on LinkedIn’s frontend version and the endpoint, you might see objectUrn, entityUrn, trackingUrn, profileUrn, or other URN fields.
LinkedIn frequently changes its frontend implementation, so a field that exists today may not exist tomorrow.
Not every objectUrn you find refers to the profile you’re viewing. Some may identify posts, companies, comments, connection invitations, or other objects. You need to inspect the surrounding JSON to determine what object the URN represents.

For OSINT or debugging purposes, the approach is generally:

Open the profile you are authorized to view.
Inspect the page source or browser developer tools.
Search for terms like:

"objectUrn"
"entityUrn"
"profileUrn"
"urn:li:member:"
"urn:li:fsd_profile:"

4. Verify from the surrounding data (such as the profile’s name, headline, or other attributes) that the URN corresponds to the profile you’re examining.

Why does this matter? Because many third-party LinkedIn tools and APIs use this internal ID rather than the public profile URL. If you are building a target list, storing the internal ID ensures you can always reference the correct profile, even if the vanity URL breaks.

Part 3: LinkedIn Comment and Post ID Extraction

When a target comments on a LinkedIn post, that comment has its own unique ID. Extracting this allows you to track specific interactions, monitor threads, and map relationship networks.

Find a public post where the target has commented. Scroll to their comment. Right-click on the timestamp of the comment, the small text that says “3 days ago” or “1 week ago.” Select “Inspect Element.”

Inside the HTML, look for an attribute called data-urn or search for urn:li:activity: or urn:li:comment:. You will see something like:

urn:li:comment:(activity:7123456789,123456789)

The first number after activity: is the post ID. The second number is the comment ID. This tells you exactly which post they commented on and uniquely identifies that comment.

If you are tracking a disinformation campaign, these IDs let you map which accounts are commenting on which posts, whether they are interacting with each other, and whether they are amplifying specific narratives in coordination. You are not guessing. You are pulling hard identifiers.

Part 3 (Addendum): Converting LinkedIn Comment and Post IDs to Readable Timestamps

You extracted the comment ID. You have the post ID. That tells you who commented where. But there is another piece of intelligence embedded directly inside those numeric IDs that most investigators miss entirely: the timestamp.

LinkedIn encodes the creation time of posts and comments directly into their numeric IDs using the Unix epoch format in milliseconds. If you know how to extract and convert that number, you know exactly when that content was created, down to the millisecond.

Here is how it works

Step 1: Extract the Numeric ID

You already know how to find the comment ID from the HTML. You will have something like:

urn:li:comment:(activity:7123456789,123456789)

The second number, 123456789, is the comment ID. The first number, 7123456789, is the post ID. Both are numeric. Both encode a timestamp.

Step 2: Understand the Encoding

LinkedIn uses a format called “snowflake” or a variation of it, similar to how Twitter and Discord generate unique IDs. The ID is a 64-bit integer, and a portion of those bits represents the timestamp in Unix milliseconds.

The practical takeaway is this: you can extract the first 41 bits of the ID to get the timestamp. But you do not need to do bitwise math yourself. The simpler method works for most LinkedIn IDs because they are large enough to contain the timestamp in the higher-order bits.

Step 3: The Conversion Method

Take the numeric ID. Let us use a real-world example from a public LinkedIn comment:

Comment ID: 7256123456789012345

To extract the timestamp, you need to apply a bit shift operation that LinkedIn uses. The formula is:

Timestamp (Unix milliseconds) = ID >> 17

Then add the LinkedIn epoch offset. LinkedIn’s epoch starts at a different base than standard Unix epoch. The standard Unix epoch starts at January 1, 1970. LinkedIn’s internal epoch starts at January 1, 2017. This means you need to add the difference.

Here is the full formula:

Unix Timestamp (milliseconds) = (ID >> 17) + 1483228800000

Where 1483228800000 is the Unix timestamp in milliseconds for January 1, 2017, 00:00:00 UTC.

Step 4: Practical Conversion Without Manual Math

You do not need to do this by hand. There are tools that automate this.

One method is to create a Python script to run this for you.

Step 5: Manual Conversion Using Online Tools

If you do not want to run a script, use a browser-based approach.

First, go to a website that performs the bit shift calculation. You can use any online tool that supports bitwise operations. Enter the LinkedIn ID, apply >> 17, and note the result.

Then, add 1483228800000 to that result.

Now take the final number and go to a Unix timestamp converter like epochconverter.com. Paste the number in milliseconds. The site converts it to a human-readable date and time in UTC.

Step 6: Why This Matters

This technique gives you the exact creation time of a post or comment, not the relative “3 days ago” display that LinkedIn shows. Relative timestamps are vague. “3 days ago” does not tell you if the post was made at 2 PM or 2 AM. The Unix timestamp does.

In a disinformation investigation, you can now:

Establish the exact sequence of posts and comments across multiple accounts.
Identify coordinated activity by finding comments posted within seconds of each other from different accounts.
Reconstruct the timeline of a narrative as it was amplified.
Compare the creation timestamp against other known events to establish context.

This is not a rough estimate. This is forensic-level precision extracted from an ID that LinkedIn hands you in the page source.

Practical Example: Full Walkthrough

A target comments on a LinkedIn post. You inspect the element and find:

urn:li:comment:(activity:7123456789012345678,7256123456789012345)

The comment ID is 7256123456789012345.

You run the Python script or do the manual math:

ID: 7256123456789012345
ID >> 17: 55371093750000 (approximate)
Add epoch offset: 55371093750000 + 1483228800000 = 56854322550000

Convert 56854322550000 milliseconds to a date. It resolves to:

August 15, 2025, 14:32:30 UTC

You now know this comment was posted on August 15, 2025, at 2:32 PM UTC. Not “several months ago.” Not “around mid-August.” The exact second.

That is how you turn a numeric ID into a timestamp. Document it. Add it to your timeline. This is the level of precision professionals operate at.

Part 4: Activity Feed Analysis

The Activity feed on a LinkedIn profile is a behavioral goldmine. Every post, like, comment, and share is logged with a timestamp. This feed is often public even when other parts of the profile are restricted.

Open the target’s profile and click on “Activity” or scroll to the “Activity” section. Click “See all activity.” You now have a chronological feed of everything this person has done on LinkedIn.

First, analyze the timestamps. If someone consistently posts or comments between 11 PM and 4 AM Eastern Standard Time, they are either a night owl in North America or they are operating from a different timezone entirely. Cross-reference this with their stated location. Discrepancies are intelligence.

Second, analyze the content. Look at the technical depth of their comments. Someone who writes “Great insights!” on every post is not a practitioner. Someone who writes a paragraph about the specifics of AWS Lambda cold starts or the nuances of a particular NIST framework is revealing their actual hands-on knowledge. This tells you their real skill level.

Third, map the relationships. Click on the posts the target comments on. Who wrote the original post? Is it a colleague? A competitor? An industry influencer? Note who responds to the target’s comments. Note the tone. Supportive? Combative? Familiar? You are mapping internal team structures and external professional relationships from public interactions alone.

Part 5: Internal Team Mapping and Organizational Friction

When multiple employees from the same company comment on each other’s posts, you can infer reporting structures and team dynamics. A manager who consistently praises a specific employee’s posts is signaling mentorship or favoritism. An employee who never interacts with their supposed team lead is signaling distance or friction.

Comment chains where two employees from the same company disagree, especially on technical or strategic topics, reveal internal divisions. Note the language. Is the disagreement respectful or dismissive? Is one party pulling rank? These are signals about company culture, internal politics, and potential insider threat vectors.

This is not gossip. This is organizational intelligence. If you are investigating a company for fraud, for due diligence, or for insider threat assessment, knowing who is aligned with whom and where the fractures are is actionable intelligence.

Part 6: Email and Phone Number Discovery with ContactOut and SignalHire

LinkedIn does not want you to have direct contact information without a premium subscription. But the data exists elsewhere. ContactOut and SignalHire are two tools that aggregate publicly available contact data and link it to LinkedIn profiles.

ContactOut

ContactOut is a browser extension that overlays email addresses and phone numbers onto LinkedIn profiles. It works by cross-referencing the profile you are viewing against its database of publicly sourced contact information. When you install the extension and visit a LinkedIn profile, ContactOut displays any email addresses and phone numbers it has associated with that person.

The data comes from public sources. Corporate websites. Conference attendee lists. Academic publications. Press releases. Patent filings. SEC documents. All of it is open source. ContactOut just aggregates and surfaces it.

How To Use ContactOut

Install the extension on your investigation browser. Navigate to the target’s LinkedIn profile. Look for the ContactOut sidebar or icon. If data is available, it will display. Copy it. Verify it. Document where you found it.

SignalHire

SignalHire operates similarly but with a stronger focus on internal company data. It aggregates email patterns and phone numbers based on company domain formats. If a company uses the format firstname.lastname@company.com, SignalHire can often generate or verify the target’s email address based on that pattern.

SignalHire also provides a dashboard for managing multiple leads and exporting data. For an investigator building a target list across an organization, this is more efficient than looking up profiles one at a time.

Both tools have free tiers with limited lookups. Paid tiers unlock more data. For professional investigative work, the paid tier is a necessary operational expense.

Important Note on Methodology

These tools do not access private data. They do not breach LinkedIn’s security. They aggregate information that is already public, just scattered across the internet. Your job as an investigator is to verify everything they return. If ContactOut gives you an email, send a test email from a disposable address to see if it bounces. If SignalHire gives you a phone number, run it through a carrier lookup to confirm it is active and associated with the target’s geography.

The tool is the starting point, analyst. Verification is the work!

Part 7: Practical Methodology Summary

Here is your LinkedIn investigation workflow, step by step.

Google Dork the Organization. Start with site:linkedin.com/in "company name" and refine by title, location, and boolean combinations. Collect every relevant profile URL into a spreadsheet.
Extract the Internal ID. For each profile, open the page source or Inspect Element and extract the member ID. Store it alongside the public URL. This is your permanent identifier.
Analyze the Activity Feed. For high-value targets, review their activity chronologically. Note posting times for timezone analysis. Note comment content for technical skill assessment. Note interaction patterns for relationship mapping.
Map the Organization. Build a visual org chart based on titles, reporting relationships inferred from interactions, and tenure data from profile start dates.
Extract Contact Information. Run ContactOut and SignalHire on key profiles. Verify every email and phone number returned.
Cross-Reference Skills. Take the skills listed on the LinkedIn profile and search for matching usernames, forum posts, GitHub repositories, and subreddit activity. This bridges LinkedIn to the wider digital footprint.
Document Everything. Every ID, every email, every timestamp, every inferred relationship. If it is not documented, it did not happen.

Lecture 4.3: Instagram — The Locational and Relational Graph

Instagram looks simple. Photos, videos, stories that disappear. Most people scroll through it without thinking. You are not most people. To an investigator, Instagram is a mapping tool. It maps where someone goes, who they know, what they care about, and how they present themselves to different audiences.

The intelligence is not just in what they post. It is in the connections they do not realize they are exposing. The tagged photos they forgot about. The bio link that bridges to another platform. The profile picture that hashes to the same image on a LinkedIn account under their real name. The location tag on a story that places them in a city they claimed they never visited.

This lecture is about extracting every drop of that intelligence. I will walk you through each step as if you have never opened Instagram before. Follow this process, and you will never look at an Instagram profile the same way again.

Phase 1: Initial Reconnaissance and Documentation

Before you do anything else, open the target Instagram profile. Do not scroll yet. Do not click on photos. Just look at what is in front of you and document everything.

Open a blank document or your investigation notebook. Record the following:

Username exactly as displayed.
Display name (this can be different from the username and changed anytime).
Profile picture. Screenshot it. Save the image file separately.
Bio text. Copy it word for word, including emojis and line breaks.
Any links in the bio. Copy the full URL.
Number of posts, followers, and following at the time of your visit.
Whether the account is public or private.
Any highlights covers visible on the profile.

This takes sixty seconds. It creates a snapshot of the account at this moment in time. If the target later changes their bio, removes a link, or goes private, you have the original state documented. This is basic, and most people skip it. Do not skip it.

Phase 2: Bio Link Extraction and Cross-Platform Bridging

The bio link is one of the most valuable pieces of data on an Instagram profile. Instagram only allows one clickable link in the bio. Users get around this by using link aggregation services like Linktree, Beacons, or Milkshake, or they link directly to a single external platform.

Click the link. If it goes to a Linktree page, document every link on that Linktree. Users often list their YouTube, TikTok, OnlyFans, personal website, Discord server, and other platforms there. Each of those is a new investigation path.

If the link goes directly to a YouTube channel, you now have a Google account associated with the Instagram profile. Subscribe to that channel from a sock puppet account. Analyze the video content, the posting frequency, the comments the target leaves on their own videos.

If the link goes to a personal website, run a WHOIS lookup on the domain. Check the Wayback Machine for historical versions of the site. Look for contact pages, about pages, and any embedded email addresses.

If the link goes to an OnlyFans or similar subscription platform, note the username format. It may match or resemble the Instagram handle, or it may be a completely different alias. Either way, it is another pivot point.

Document every external platform you discover through the bio link. Each one is a new source of intelligence.

Phase 3: Profile Picture Extraction and Perceptual Hash Matching

The profile picture is small on Instagram. You cannot right-click and save it at full resolution through normal means. But you need the highest quality version available because you are going to run it through perceptual hash matching against other platforms.

Here is how to extract it

The profile picture on Instagram is displayed small. You cannot right-click and save it at full resolution through normal browser actions. But you need the highest quality version available because you are going to run it through perceptual hash matching against other platforms. Instagram stores the full-resolution profile picture URL directly in the page source. Your job is to pull it out.

Here Are Two Ways To Do It

Method A: Direct Source Search (Faster and More Reliable)

Open the target’s Instagram profile in a browser. Right-click anywhere on the page background and select “Inspect” or “Inspect Element” to open the developer tools panel.

Once the panel is open, press Ctrl + F to open the search bar within the HTML source. Type profile_pic_url and hit Enter. Instagram embeds the full-resolution profile picture URL in a JavaScript object within the page source. You will see a line that looks something like this:

“profile_pic_url”:”https://instagram.fxxx1-1.fna.fbcdn.net/v/t51.2885-19/123456789_0123456789_987654321_n.jpg”

Copy the entire URL inside the quotation marks. Open it in a new browser tab. The image loads at its highest available resolution. Right-click and save it to your investigation folder. Name the file with the target’s username and the date of extraction.

This method is faster because you go directly to the data you need without manually hunting through HTML elements.

Method B: Element Selector (Use When Source Search Fails)

If the profile_pic_url search does not return results, or if Instagram has restructured how they embed the image, the element selector method works as a fallback.

With the developer tools panel still open, look at the top left corner of that panel. You will see a small icon that looks like a dotted square with a cursor arrow. This is the element selector tool. You can also activate it with the keyboard shortcut Ctrl + Shift + C. Click that icon once. Your cursor is now in inspection mode.

Move your cursor over the target’s profile picture and click on it. The developer tools panel jumps to the specific line of HTML code that renders that image. You are looking for an attribute called src within an tag. It will look something like:

Copy the full URL from the src attribute. Open it in a new tab. Save the image.

What You Do With the Image

Once you have the profile picture saved, you generate a perceptual hash. Install the required Python library if you have not already:

pip install imagehash pillow

Then run this script:

from PIL import Image
import imagehash

# Load the saved profile picture
img = Image.open(”target_username_profile.jpg”)

# Generate perceptual hash
phash = imagehash.phash(img)

print(f”Perceptual Hash: {phash}”)

The output is a short alphanumeric string. This hash represents the visual fingerprint of the image. It survives resizing, minor cropping, and slight edits. If the same image appears on Facebook, LinkedIn, Twitter, or any other platform, the hash will match or be extremely close.

Now take that hash and compare it against profile pictures extracted from other suspected accounts. If the Instagram profile picture hashes to the same value as a LinkedIn profile picture under a real name, you just linked an anonymous Instagram account to a verified professional identity. That is attribution.

Phase 4: Tagged Photos — The Goldmine

Most investigators jump straight to the main profile grid. That is a mistake. The tagged photos section is separate from the main posts. It contains photos and videos that other users posted and tagged the target in. The target cannot delete these. They can only untag themselves, and most people forget to do that.

To access tagged photos on a desktop browser, go to the target’s profile and look at the tabs below the bio. You will see “Posts,” “Reels,” and a small icon that looks like a person inside a frame. That is the tagged photos tab. Click it.

On mobile, the tagged tab is located below the bio next to the posts grid, represented by the same person-in-frame icon.

Scroll through every tagged photo. For each one, ask yourself:

Who posted this? Is the uploader’s profile public?
Where was this taken? Is there a location tag?
When was this taken? Is there a timestamp or date reference in the caption or comments?
What is the target doing? Who else is in the photo?
Does the background reveal anything about the target’s habits, relationships, or locations?

I once found a target’s home address through a tagged photo. The target was careful. Their own profile had zero location tags. But a friend posted a group dinner photo, tagged the target, and added a location tag for the restaurant. That restaurant was two blocks from the target’s apartment. The friend’s caption mentioned “walking back to ****’s place after dinner.” The target never posted a single thing about that evening. They did not have to. Their friend did the work for me.

Tagged photos are the backdoor into a target’s real life. Use them.

Phase 5: Location Tag Analysis and Pattern-of-Life Mapping

Every Instagram post and story can carry a location tag. Even if the target does not manually add one, Instagram suggests locations based on GPS data. Many users accept these suggestions without thinking.

Go through the target’s posts one by one. For each post, check if there is a location tag below the username at the top of the post. Click that location tag. Instagram opens a page showing all public posts tagged at that location. This gives you two things.

First, it confirms the target was at that location at a specific time. The post timestamp tells you when.

Second, it shows you who else posts from that location. These are potential associates. People who frequent the same gym, the same coffee shop, the same park. Note their usernames. Check if the target follows them or interacts with their posts.

Now map the locations. Take every location tag and plot it on Google Earth or a simple map. Look for clusters. Does the target post frequently from a specific neighborhood? That is likely their home area. Do they post from a specific office building every weekday? That is likely their workplace. Do they post from a specific bar every Friday night? That is a pattern-of-life marker.

Combine this with the timestamps. If someone posts from a gym every weekday at 7 AM, you know their morning routine. If they post from an airport every other week, you know they travel frequently. Each location tag is a dot. Connect the dots, and you have a behavioral map.

Phase 6: Story Analysis and Temporary Content

Instagram Stories disappear after 24 hours. But highlights are saved Stories that the user chose to keep permanently visible on their profile. These are often organized into categories like “Travel,” “Food,” “Work,” or “Friends.”

Click through every highlight. Treat each highlight as a curated collection the target wants you to see. Look for:

Locations visible in the background.
Other people who appear regularly.
Screenshots of conversations or posts the target found important.
Events like birthdays, weddings, or work functions.

If the target has an active Story at the time of your investigation, view it from a sock puppet account that does not follow the target, if the account is public. If the account is private, you will need a sock puppet that the target has accepted as a follower. Never view a Story from your real account. Always use a properly maintained sock puppet.

Document the Story content quickly. Screenshot it. Stories vanish, and you may only have one chance.

Phase 7: Comment Analysis and Relationship Mapping

Comments are conversations. They reveal who the target interacts with, how they speak to different people, and what topics trigger engagement.

Go through the target’s posts. Read the comments. Note every user who comments regularly. These are the target’s inner circle. Note the tone. Is it friendly? Flirtatious? Professional? Argumentative?

Click on the profiles of frequent commenters. Are their accounts public? Do they post photos with the target? Do they share the same locations? You are mapping the target’s social graph through their interactions.

Also, read the comments the target leaves on other people’s posts. Instagram allows you to see comments someone has made on public posts through third-party tools or manual searching. If the target has a consistent commenting pattern on certain accounts, those accounts are part of their social orbit.

Phase 8: Instagram User ID Extraction & Validation

Every Instagram account has a permanent numeric User ID. The username can change. The display name can change. The User ID stays the same forever. If you capture this ID once, you can track the account through any rebranding.

Method 1: Page Source Extraction

Open the target’s Instagram profile. Right-click anywhere on the page background and select “View Page Source.” Press Ctrl + F and search for profilePage_. You are looking for a string like:

The number after the underscore is the User ID. Copy it. Store it.

Method 2: Using the Custom Instagram Parser Tool

I built a custom Python tool that automates this entire process. You feed it the Instagram page source code, and it extracts the User ID, profile picture URL, bio, external links, follower counts, business details, and more. It is faster than manual extraction and produces a structured JSON report for your evidence folder.

The tool is not included with this course, nevertheless:

python3 instagram_parser.py

Enter the path to your saved source code file. The tool outputs a complete intelligence report including the User ID.

Why the User ID Matters

The User ID is your permanent anchor. If the target changes their username from @oldhandle to @newhandle, you lose them if you are tracking by username alone. But if you have the numeric ID, you can verify the new handle belongs to the same account. You can also use the ID to pull profile data programmatically, track the account across time, and cross-reference against breach databases that include Instagram numeric IDs.

Phase 9: Google Dorking for Instagram — Finding What the Platform Hides

Let me be direct. There is no Google dork that bypasses Instagram’s privacy settings. You cannot type a query and magically see a private profile’s posts, messages, or internal account data. Anyone who tells you otherwise is either lying or confused about what a dork actually does.

What you can do is use Google dorks to find the public footprints that surround an Instagram account. When someone creates an online presence, they leave trails across multiple platforms. A bio link that leads to a personal website. A username that appears in a forum signature. An email address buried in an old blog comment. These are the threads Google can pull, and these threads lead you to intelligence Instagram itself will never show you.

The Dork Chain: Finding Public Footprints

The methodology is simple. You are not searching Instagram for private data. You are searching the entire indexed web for places where the target’s Instagram identity overlaps with other information.

Start with the username. If the target is @vintage_bike_77, the username itself is your first search term. But do not stop at searching the bare handle. People link their Instagram accounts in bios, forum signatures, blog posts, and comment sections. They write things like “Follow me on Instagram @vintage_bike_77“ or “DM me on IG: vintage_bike_77.”

Use These Dorks To Find Those Mentions:

“vintage_bike_77” “instagram”
“vintage_bike_77” “ig”
“vintage_bike_77” “DM me”
“vintage_bike_77” “follow me”

These queries return pages where the target’s Instagram handle is mentioned alongside those common phrases. You might find a forum profile, a blog comment, a Reddit post, or a YouTube channel description. Each result is a new platform to investigate.

Now, find public bios and links. Instagram profiles often include an email address in the bio for business inquiries. Even if the current bio does not show one, an older version might have been indexed by Google before the target removed it.

Use These Dorks:

site:instagram.com “vintage_bike_77” “gmail.com”
site:instagram.com “vintage_bike_77” “yahoo.com”
site:instagram.com “vintage_bike_77” “protonmail.com”
site:instagram.com “vintage_bike_77” “outlook.com”

These queries restrict Google’s search to Instagram’s domain and look for the username paired with common email domains. If the target ever included an email in their bio, and Google indexed that version of the page, it will appear in the results.

Extend This To Other Contact Information:

site:instagram.com “vintage_bike_77” “contact”
site:instagram.com “vintage_bike_77” “business”
site:instagram.com “vintage_bike_77” “WhatsApp”
site:instagram.com “vintage_bike_77” “Telegram”

Each query looks for a different type of contact detail the target might have publicly listed. Business inquiries. WhatsApp numbers. Telegram handles. Not everyone includes these, but when they do, you have just pulled contact information without ever interacting with the Instagram platform directly.

Cross-Platform Username Search

Instagram usernames are often reused across other platforms. A target who is @vintage_bike_77 on Instagram might use the same handle on Twitter, Reddit, GitHub, or niche forums. Google can find these faster than manually checking each platform.

Use This Dork To Search For The Exact Username Outside Of Instagram:

“vintage_bike_77” -site:instagram.com

The -site:instagram.com operator excludes Instagram results. What remains are pages on other platforms where that exact string appears. It could be a Twitter profile, a Reddit post, a GitHub commit, a forum signature, or a Pinterest board. Every result is a new lead.

Refine Further By Targeting Specific Platforms:

site:twitter.com “vintage_bike_77”
site:reddit.com “vintage_bike_77”
site:github.com “vintage_bike_77”
site:youtube.com “vintage_bike_77”
site:tiktok.com “vintage_bike_77”

These queries return results from individual platforms, giving you a cross-platform footprint map built entirely through Google.

Finding Indexed Comments and Interactions

Instagram comments are not easily searchable through Google, but if a target leaves comments on public blog posts, news articles, or forums using their Instagram handle as their display name, those comments get indexed.

Use This Dork:

“vintage_bike_77” “comment”
“posted by vintage_bike_77”

These queries surface comment sections where the target’s handle appears. You might find them debating on a news article, reviewing a product, or posting on a motorcycle forum. Each comment is a window into their interests, writing style, and sometimes their location.

Practical Workflow for Instagram Dorking

Here is the sequence I run for every new Instagram target:

"username" "instagram" — Find all pages mentioning the account.
site:instagram.com "username" "gmail.com" — Check for indexed email addresses.
site:instagram.com "username" "contact" — Check for other contact details.
"username" -site:instagram.com — Find cross-platform appearances.
site:targetplatform.com "username" — Drill into specific platforms where the handle appears.
"username" "comment" — Surface indexed comments and interactions.

Document every result. Even a single email address found through these dorks can become the pivot point for an entire email investigation, which you already know how to run from Module 3. The Instagram account is the starting point. Google dorks are how you find everything connected to it.

Phase 10: Tools for Instagram Investigation

You can do everything manually. But tools speed up the collection process. Here are the ones I use and trust.

Imginn.com is a web-based Instagram viewer. You paste a username, and it displays the profile, posts, stories, and tagged photos without requiring a login. It is useful for quick, passive viewing of public profiles. It also allows you to download images and videos directly.

Instasave.io lets you download individual Instagram photos and videos by pasting the post URL. Use this to preserve evidence before a target deletes a post.

4K Stogram is a desktop application that downloads entire Instagram profiles, including posts, stories, and highlights. It requires a login, so use a sock puppet account. It is useful for bulk evidence preservation.

Osintgram is a Python-based tool that runs in your terminal. It pulls profile data, followers, following lists, and location tags, and outputs structured reports. It requires a valid Instagram session, so again, use a sock puppet.

ExifTool should be used on every image you download. Even though Instagram strips most EXIF data on upload, sometimes metadata survives in screenshots or images shared via direct message. Always check.

Phase 11: Practical Investigation Workflow Summary

Here is the step-by-step process for every Instagram investigation.

Document the profile. Username, display name, bio, link, follower count, following count. Screenshot everything.
Extract the profile picture URL from the page source. Save the image. Generate a perceptual hash.
Extract the numeric User ID from the page source or using the custom Instagram parser tool. Validate it via multiple sources.
Follow the bio link. Document every external platform it connects to.
Open the tagged photos tab. Review every photo. Note uploaders, locations, and timestamps.
Review all highlights. Treat them as permanent curated content.
Analyze each post for location tags. Plot them on a map.
Read comments on the target’s posts. Identify frequent interactors.
Read comments the target leaves on other public posts. Map their social orbit.
Use tools like Imginn for passive viewing and 4K Stogram for bulk archiving.
Cross-reference everything with other platforms. The bio link, the profile picture hash, the locations, the writing style.

If you do all of this, you will know the target better than they know themselves. Not because you hacked anything. Because you paid attention to what they left in the open.

Lecture 4.4: Reddit — The Unfiltered Psyche

Reddit is different from every other platform we cover. Facebook is where people present their curated life. LinkedIn is where they wear their professional mask. Instagram is where they perform. Reddit is where the mask comes off.

On Reddit, people discuss their real problems. Their niche hobbies. Their financial struggles. Their unpopular opinions. They do this under usernames that are often completely disconnected from their real identities. This makes Reddit a psychological goldmine and an attribution challenge rolled into one.

The intelligence value is not in finding a name. It is in finding the person behind the username by mapping their interests, their writing patterns, their schedule, and their emotional state across months or years of unfiltered posting.

This lecture walks you through Reddit investigation from start to finish. Every tool, every technique, every step.

Phase 1: Initial Profile Reconnaissance

You have a username. Before you dive into archives and deleted content, you need to understand what is visible on the surface right now.

Open the target’s Reddit profile by navigating to reddit.com/user/USERNAME. Document everything you see.

Account Creation Date — Getting the Exact Timestamp

Reddit displays the account creation date in the sidebar as a relative or formatted date, something like “Created August 15, 2019” or “6 years ago.” That is useful, but it is not precise. You want the exact timestamp. Reddit stores it in the page source. Here is how to pull it.

Right-click anywhere on the page background, not on any image or button. Select “Inspect” or “Inspect Element” from the menu. This opens the browser’s developer tools panel.

Now, look at the top left corner of that developer tools panel. You will see a small icon that looks like a dotted square with a cursor arrow. This is the element selector tool. You can also activate it with the keyboard shortcut Ctrl + Shift + C. Click that icon once. Your cursor is now in inspection mode.

Move your cursor over the account creation date displayed in the sidebar and click on it. The developer tools panel will jump to the specific line of HTML code that renders that text. You are looking for a time tag or an attribute called datetime within the surrounding markup. It will look something like this:

The datetime attribute contains the exact UTC timestamp (Cake Day) of account creation: 2019-08-15T14:32:30.000Z. That is the precise second this account came into existence.

Here is how to decode that specific format, which is known as ISO 8601 UTC time:

2005-12-02: The date (YYYY-MM-DD), which matches December 2, 2005.
T: The separator that indicates the Time portion is about to start.
00:00:00.000: The exact time (Hours:Minutes:Seconds.Milliseconds). Because it is exactly midnight, it usually means Reddit’s database recorded the date but did not preserve the specific hour/minute of creation for that older account, or it defaulted to midnight.
Z: Stands for Zulu Time, which means Coordinated Universal Time (UTC).

Why does this level of precision matter? Because sometimes the exact creation time correlates with other events. An account created three minutes after another account was banned suggests the same operator. An account created during a specific incident window suggests it was purpose-built for that event. “Six years ago” does not give you that. 2019-08-15T14:32:30.000Z does.

What the Creation Date Tells You

An account created six years ago with consistent activity is an established persona. This is someone’s real online identity. They have invested time in it. They care about it.

An account created last week with zero karma is a burner. It was made for a specific purpose. Figure out what that purpose was by looking at where they posted.

An account created years ago but with no activity until recently is a sleeper. Someone created it, sat on it, and activated it later. That is a deliberate operational choice. Ask yourself why.

Document the exact timestamp. Note what it implies. Add it to your timeline.

Look at the total karma. This is the sum of post karma and comment karma. Low karma with high activity suggests the user is controversial or argumentative. High karma with moderate activity suggests the user posts content that resonates with communities.

Look at the trophy case. Reddit awards trophies for account milestones, verified email status, and participation in specific events. A verified email trophy confirms the user linked an email address to the account. That does not expose the email to you, but it tells you one exists and is tied to this persona.

Look at the active communities. The sidebar shows a list of subreddits the user is active in, sorted by engagement. Document every one. These are interest indicators.

Now, scroll through the visible posts and comments. Note the writing style. Is the user articulate or sloppy? Do they use proper punctuation or type in lowercase fragments? Do they use slang specific to a region? Do they mention their age, gender, location, occupation, or relationship status anywhere? Redditors leak personal details constantly, often buried in unrelated comments.

Document everything you find in this initial pass. This is your baseline.

Phase 2: Profile Analysis Tools

Manual scrolling gives you the surface. Profile analysis tools give you the patterns.

Redective is your first stop. Go to redective.com and enter the target username. Redective pulls the account creation date, total karma breakdown, submission history, comment history, most-used words, and hourly activity distribution. The hourly activity chart is particularly valuable. It shows you when the user is most active, broken down by hour. A user who posts exclusively between 9 AM and 5 PM US Eastern time on weekdays has a desk job in that timezone. A user who posts at 3 AM consistently might work night shifts or live in a different timezone than they claim.

Redditmetis is your second stop. Go to redditmetis.com and enter the username. This tool provides sentiment scoring across the user’s comment history, activity heatmaps by day and hour, and a breakdown of which subreddits receive the most engagement. The sentiment analysis tells you whether the user is generally positive, negative, or neutral in their interactions. The heatmap visualizes their posting schedule. A consistent Monday through Friday pattern with evenings and weekends free is the signature of someone posting during work hours.

Run both tools. Save the results. These are your pattern-of-life baselines.

Phase 3: Deep Post and Comment Search

Reddit’s native search is limited. It does not let you filter by date, score, or specific keywords within a user’s history. External tools close this gap.

Samac.io is a Reddit search engine. You can search by author, subreddit, keyword, score threshold, and date range. Use this to find specific comments the target made months or years ago that might not surface in a manual scroll. If you know the target is interested in motorcycles, search their username plus the keyword “Honda” to find every comment where they discussed that specific topic.

Reddit Comment Search at redditcommentsearch.com focuses specifically on comment history. Enter the target username and a keyword. The tool returns every comment the user has made containing that word, with direct links and timestamps. This is useful for finding every instance where the target mentioned a location, a person, or an event.

Better Reddit Search at better.redditsearch.io provides enhanced post search with filters for subreddit, flair, author, and date. Use this to search within specific subreddits for posts by the target that Reddit’s native search would miss.

The key with these search tools is to be specific. Do not just search a username and scroll. Search the username plus keywords related to your investigation: Locations. Hobbies. Political views. Employers. Products. Every keyword is a thread to pull.

Phase 4: Deleted Content Recovery — The Time Machine

This is where Reddit investigation gets powerful. Users delete posts and comments for a reason. They said something they regret. They revealed something they should not have. They got into an argument and tried to erase it. The deletion itself is a signal.

Reveddit at reveddit.com shows content removed by moderators or Reddit’s automated filters. This is not user-deleted content. This is content that someone else decided should not be visible. To use it, navigate to reveddit.com/user/USERNAME. Reveddit displays posts and comments that were removed, color-coded by removal type. Moderator removals appear in blue. Auto-mod removals appear in red. This tells you what the target posted that was deemed unacceptable, which is often exactly what you want to see.

PullPush.io is the heavy hitter. It maintains an archive of Reddit content that was indexed before deletion. When a user deletes a comment, PullPush often still has it. To search, use the API endpoint directly or the web interface. The format for searching comments by author is:

https://pullpush.io/search/comments?author=USERNAME

Replace USERNAME with the target. The results include the full comment text, the subreddit, the timestamp, and the post it was attached to, even if the comment is no longer visible on Reddit. This is how you recover what someone tried to hide.

Arctic Shift (Photon) at arctic-shift.photon-reddit.com is another historical archive. It allows searching by post ID, comment ID, or author. If you have a specific post URL that was deleted, Arctic Shift can often retrieve the original content.

Reddit Archive at redditarchive.com provides multi-filter archive access including deleted and banned posts.

For all deleted content recovery tools, the workflow is the same. Enter the username. Browse the recovered content. Read every deleted post and comment. Document anything that contradicts the target’s current narrative, reveals personal information, or connects to other platforms.

Phase 5: Scam and Threat Detection

If your investigation involves fraud, scamming, or malicious activity, Reddit has specific tools for checking a user’s reputation.

Universal Scammer List at universalscammerlist.com is a database of known Reddit scammers. Enter the target username or profile URL. If the user is listed, you will see the subreddit that banned them, the reason for the ban, and any associated alt accounts. This is critical for marketplace investigations or any case involving financial transactions on Reddit.

Snooper at snooper.reddit.com analyzes comment activity distribution to detect automation. Bots and spam accounts have different posting patterns than humans. Snooper flags accounts that exhibit bot-like behavior, which helps you determine whether you are investigating a real person or an automated persona.

Always run a scammer check if the target has any involvement in trading, selling, or financial discussions. Even if they are not the primary subject of your investigation, a scammer flag provides context about their credibility and behavior.

Phase 6: Subreddit Discovery and Interest Mapping

The subreddits a user participates in are the most direct indicators of their interests, and interests are what you cross-reference across platforms.

Subreddit at Subreddits.org is a searchable directory of over 3,000 subreddits. If the target mentions an interest but you do not know the relevant subreddit, search here. Find the community. Then search that community for the target’s username or writing patterns.

Reddit List at redditlist.com is a curated directory of popular and niche subreddits organized by category. Use this to understand the landscape of communities related to the target’s interests.

When you have mapped the target’s subreddits, categorize them. Group them by theme. Gaming subreddits. Finance subreddits. Location-specific subreddits. Relationship advice subreddits. Health-related subreddits. Each category tells you something about the person’s life.

Now cross-reference these categories against other platforms. If the target posts on r/cybersecurity and their LinkedIn lists a security role, that is a correlation. If they post on r/Manchester and their Instagram location tags are all in Manchester, that is a correlation. If they post on r/motorcycles and a forum you found through username search has the same user discussing carburetors, that is a correlation.

Each overlapping interest is one link in your attribution chain.

Phase 7: Timestamp and Timezone Analysis

Reddit timestamps are in Coordinated Universal Time. Every post and comment carries an exact UTC timestamp visible by hovering over the relative time display. “Posted 3 hours ago” becomes “2025–08–15 14:32:30 UTC” when you hover.

Collect timestamps across the target’s activity. Plot them on a 24-hour clock. Look for the active hours. A user who posts consistently between 8 AM and 4 PM UTC is likely in the UK or Western Europe. A user who posts between 2 PM and 10 PM UTC is likely on the US East Coast. A user who posts between 6 PM and 2 AM UTC is likely on the US West Coast.

Compare this against any stated location. If a user claims to live in New York but their posting hours align with London, something is inconsistent. Inconsistency is intelligence.

Phase 8: Cross-Platform Attribution

Reddit attribution is rarely direct. You will not find a Reddit profile that says “My name is John Doe and I work at Acme Corp.” What you will find is a pattern of interests, a writing style, a posting schedule, and occasional personal details that collectively point to one individual.

Here is the attribution workflow

Map all subreddits the target participates in.
Extract every personal detail mentioned across all posts and comments. Age, gender, location, occupation, education, relationship status, pets, vehicles, health conditions, everything.
Identify the target’s writing style. Sentence length, punctuation habits, common phrases, misspellings, slang.
Determine the target’s active hours from timestamp analysis.
Take all of this and cross-reference against LinkedIn, Facebook, Instagram, forums, and GitHub.
Look for a profile that matches in at least three categories: interests, writing style, and schedule.
When you find a candidate, look for a single piece of hard evidence. A Reddit comment mentioning a specific photo that appears on Instagram. A Reddit post about a work project that matches a LinkedIn job description. A Reddit username that matches a GitHub handle.

One match is a coincidence. Three matches is a pattern. Five matches is attribution.

Phase 9: Google Dorking for Reddit — Finding What Reddit’s Search Misses

Reddit has its own search. You already know the tools. Redective, Camas, PullPush. But those tools search Reddit’s internal data. Google searches Reddit from the outside, and it often finds things Reddit’s own engine buries or ignores.

Google indexes Reddit aggressively. Every public post, every public comment, every user profile page that was visible long enough gets crawled and stored. The advantage Google gives you is that its ranking algorithm surfaces content based on relevance, not just chronology. A Reddit comment from three years ago that Reddit’s search would bury on page fifty might appear on page one of Google because it matches your query exactly.

The dorking approach for Reddit is straightforward. You are using the site: operator to restrict results to Reddit’s domain, then layering keywords and operators to find specific content.

Finding A User’s Digital Footprint Across Reddit

Start with the username. If the target is wrench_rider_77, the basic dork is:

site:reddit.com “wrench_rider_77”

This returns every indexed page on Reddit where that exact string appears. That includes their profile page, their posts, their comments, and any post where someone else mentioned their username. This is broader than Reddit’s own user search, which only shows the profile and activity. Google shows you who is talking about them too.

Now, Exclude Their Own Profile To Find Mentions By Others:

site:reddit.com “wrench_rider_77” -inurl:user -inurl:u

The -inurl:user and -inurl:u operators remove the target’s own profile page and user directory from results. What remains are posts and comments where other users referenced their handle. Someone calling them out in an argument. Someone thanking them for advice. Someone linking to one of their posts. These are relationship indicators.

Finding Specific Content By A User

If you want to find posts or comments the target made containing specific keywords, combine the username with a search term:

site:reddit.com “wrench_rider_77” “Honda”
site:reddit.com “wrench_rider_77” “carburetor”
site:reddit.com “wrench_rider_77” “London”

Each query returns Reddit pages where the target’s username and the keyword both appear. This is functionally the same as using Reddit Comment Search, but Google’s index sometimes captures content that specialized tools miss, especially older content that was indexed before deletion.

Finding Deleted Content Via Google Cache

This is the most valuable Google dorking technique for Reddit. When a user deletes a post or comment, Reddit removes it from their servers. But if Google crawled that page before the deletion, the cached version still exists.

If you have a specific Reddit post URL that is now deleted, paste that URL directly into Google. If Google cached it, the search result will show a small green arrow next to the URL. Click that arrow and select “Cached.” Google displays the stored version of the page as it appeared on the day it was crawled. The deleted content is visible.

If You do not have the URL but know the username and a likely keyword, use this dork:

site:reddit.com “wrench_rider_77” “keyword”

Then, for any result that looks relevant but returns a deleted or removed page on Reddit, click the cached version instead. Google preserves what Reddit discards.

Finding Subreddit-Specific Intelligence

If you are interested in what a target posts within a specific subreddit, narrow the dork to that subreddit:

site:reddit.com/r/motorcycles “wrench_rider_77”
site:reddit.com/r/ukpersonalfinance “wrench_rider_77”

This returns the target’s activity within a single community, filtered by Google’s index. Combine this with keywords to find specific discussions:

site:reddit.com/r/motorcycles “wrench_rider_77” “carb tuning”

This query returns only posts and comments within r/motorcycles where the target discussed carburetor tuning. You are no longer searching broadly. You are drilling into a specific topic within a specific community.

Finding Email Addresses And Contact Details

Reddit users rarely post their email addresses publicly, but it happens. Sometimes in classifieds subreddits, buy-sell-trade communities, or when offering services.

Use These Dorks:

site:reddit.com “wrench_rider_77” “gmail.com”
site:reddit.com “wrench_rider_77” “yahoo.com”
site:reddit.com “wrench_rider_77” “protonmail.com”
site:reddit.com “wrench_rider_77” “email”
site:reddit.com “wrench_rider_77” “contact”
site:reddit.com “wrench_rider_77” “discord”

Each query looks for the username paired with a contact detail. Most will return nothing. That is expected. But when one returns a result, you have a direct line of communication or a new platform to investigate. That single hit justifies running all six queries.

Cross-Referencing Reddit With Other Platforms

A Reddit username often appears on other platforms. Use Google to find these cross-platform bridges:

“wrench_rider_77” -site:reddit.com

This excludes Reddit entirely and returns every other website where that exact username appears. Forums. Blogs. Twitter. GitHub. YouTube. Each result is a new platform to add to your investigation.

Refine By Platform:

site:twitter.com “wrench_rider_77”
site:github.com “wrench_rider_77”
site:youtube.com “wrench_rider_77”

These targeted queries confirm whether the handle exists on specific platforms without manually visiting each one.

Practical Workflow For Reddit Dorking

Here is the sequence I run for every Reddit investigation:

site:reddit.com "username" — Broad search for all indexed mentions.
site:reddit.com "username" -inurl:user -inurl:u — Find mentions by other users.
site:reddit.com "username" "keyword" — Find specific discussions by topic.
site:reddit.com/r/subredditname "username" — Drill into specific communities.
site:reddit.com "username" "gmail.com" — Check for exposed contact details.
"username" -site:reddit.com — Cross-platform handle discovery.
For any dead Reddit links found during investigation, check Google Cache for the deleted content.

Document every result. Reddit content disappears. Users delete posts. Subreddits go private or get banned. Google’s cache and index are your backup. Use them before the trail goes cold.

Quick Reference: Reddit Dorking Commands

Objective_________________Dork

All indexed mentions: site:reddit.com "username"
Mentions by other users: site:reddit.com "username" -inurl:user -inurl:u
User activity by keyword: site:reddit.com "username" "keyword"
Activity in a specific subreddit: site:reddit.com/r/subreddit "username"
Exposed email addresses: site:reddit.com "username" "gmail.com"
Cross-platform handle search: "username" -site:reddit.com
Specific platform check: site:twitter.com "username"
Deleted content recovery: Paste dead URL into Google → Click “Cached”

Phase 10: Practical Investigation Workflow Summary

Here is the step-by-step Reddit investigation process

Open reddit.com/user/USERNAME. Document account creation date, karma, trophy case, and active subreddits.
Run the username through Redective and Redditmetis. Save the activity patterns and sentiment analysis.
Search the username on Reveddit and PullPush. Recover every deleted post and comment.
Use Samac.io and Reddit Comment Search with specific keywords to find relevant content.
Check the Universal Scammer List if the investigation involves fraud or marketplace activity.
Map all subreddits to interest categories.
Analyze posting timestamps for timezone and schedule patterns.
Cross-reference interests, writing style, schedule, and personal details against other platforms.
Document every correlation. One is a coincidence. Five is attribution.
Preserve everything. Screenshots, timestamps, archive links. Reddit content disappears. Your evidence folder should not.

This is Reddit investigation. Not scrolling. Not guessing. Systematic extraction, recovery, and cross-platform correlation. Master this, and you can build a psychological profile from nothing but a username.

Lecture 4.5: X (Formerly Twitter) — The Real-Time Signal

X is fast. People react to events within seconds. They argue, they share, they leak information without thinking. For an investigator, X is a live intelligence feed that never stops broadcasting.

But X is also messy. Accounts appear and disappear. Tweets get deleted. Usernames change. Content scrolls past and vanishes into the noise. Your job is to cut through that noise, extract the hard data, and preserve evidence before it disappears.

This lecture covers every technique you need, from pulling the hidden numeric ID that never changes, to extracting the exact account creation timestamp, to surgical search queries that find exactly what you are looking for, to recovering tweets someone thought they had erased.

Part 1: User ID Extraction — The Anchor That Never Changes

Every X account has two identifiers. The username, which is the @handle everyone sees, and the numeric user ID, which is the internal identifier X uses behind the scenes.

The username can change. Someone can switch from @Allen123 to @Allen3sop1 overnight. If you are tracking based on the handle alone, you lose them.

The numeric user ID never changes. It is assigned when the account is created. It stays with that account forever. If you capture the numeric ID once, you can track that account through any number of username changes, deactivations, and reactivations.

How To Extract It

Method 1: View Page Source

Open any X profile in a browser. Right-click anywhere on the page background and select “View Page Source.” This opens a new tab with the raw HTML of the page.

Press Ctrl + F to open the search bar. Type rest_id and hit Enter. You are looking for a line that looks like this:

That number is the numeric user ID. It is globally unique. Copy it. Store it in your investigation file alongside the current @handle and the date of extraction.

Part 1 (Addendum): Validating the Extracted User ID

You pulled a number from the page source. You believe it is the numeric user ID. Before you build your investigation around it, validate it. Never trust a single extraction without confirmation.

Method 1: The Custom URL Validation

Construct this URL using the ID you extracted:

https://x.com/intent/user?user_id=123456789

Replace 123456789 with the numeric ID you found. Paste the full URL into your browser and press Enter.

If the ID is valid, X redirects you to the account’s profile page. You will see the current @handle, display name, bio, and profile picture. The account loads. The ID is confirmed.

If the ID is invalid, X shows an error page or redirects to the home page. That means the number you extracted is not a real user ID, or the account has been permanently deleted and purged from X’s systems.

Method 2: Cross-Check with the Current @Handle

If you have both the numeric ID and the current @handle, validate by opening both URLs side by side:

https://x.com/intent/user?user_id=123456789
https://x.com/@current_handle

Both should resolve to the same profile page. If they do, you have double confirmation. The ID is valid, and it maps to the expected account.

Method 3: The API Endpoint (If You Have Access)

If you have an X developer account and API key, query the API directly:

https://api.x.com/2/users/123456789

A successful response returns the full user object including the current username, display name, and creation date. An empty response means the ID is invalid or the account is gone.

Why Validation Matters

A wrong user ID leads you to the wrong person. You might attribute tweets to an innocent account. You might submit a report with incorrect evidence. Validation takes ten seconds and prevents catastrophic errors.

Documenting the Validation

When you confirm an ID is valid, document:

The numeric ID.
The current @handle it resolves to.
The date you validated it.
The method used (custom URL, API, cross-check).

This record goes in your investigation file. If the @handle changes next month, you still have the ID and proof it was correct at the time of your investigation.

That long number is the account creation timestamp in Unix epoch format, expressed in milliseconds. It represents the exact moment the account was registered on X’s servers.

Converting Epoch To Human-Readable Date

The number you extracted is not directly readable. You need to convert it. Go to a Unix epoch converter tool. I recommend epochconverter.com. Paste the number you found into the input field. Make sure the tool is set to interpret the value in milliseconds, not seconds. If the number is 13 digits long, it is milliseconds. If it is 10 digits, it is seconds. X uses milliseconds.

Click “Timestamp to Human Date.” The tool outputs the exact date and time in UTC, your local time, and a relative format like “6 years ago.”

Example:

Validating The Result

Now, compare what you just extracted against the profile’s displayed “Joined” date. The profile might show “Joined March 2015.” Your extracted timestamp says March 12, 2015. These align. You are on the right track.

If the profile shows “Joined March 2015” and your extracted timestamp converts to August 2017, something is off. Either you pulled the wrong data field, or the platform is displaying inaccurate information. Always validate. Trust the source code over the displayed text.

Why This Matters

The account creation timestamp is a cross-referencing tool. If you find a Facebook account and an X account that you suspect belong to the same person, compare their creation dates. If one was created in March 2015 and the other in April 2015, that proximity is a correlation point. Most people create their social media accounts around the same period in their lives. It is not proof on its own, but combined with other evidence, it strengthens your attribution.

It is also an intent indicator. An account created the day before a major event, used to post about that event, and then abandoned was purpose-built. That tells you the operator planned their activity. An account created years ago with consistent activity is a genuine persona. The timestamp gives you context. Keep digging!

Method 2: Online Conversion Tools

If you do not want to dig through page source, use a service like commentpicker.com. Paste the @handle into the search bar. The site returns the numeric ID instantly with additional timestamp. This works for most accounts and is faster than manual extraction when you have multiple targets to process.

Method 3: API Access

If you have an X developer account and an API key, you can query the API directly. The endpoint users/by/username/:username returns the full user object including the rest_id . This is the programmatic approach for bulk lookups, but it requires authentication and is not passive.

For most investigations, Methods 1 and 2 are all you need.

Why This Matters

I want you to understand the practical application, not just the technique. Let me give you a real scenario.

You are tracking an account that posts harassment and then changes its handle every few weeks to avoid detection. You extracted the numeric ID on day one. On day thirty, the handle has changed three times, but every time you plug that numeric ID into your tracking tools, it resolves to the same account. The target thinks they are evading you. They are not. You have the anchor.

Document the numeric ID. It is the single most important piece of metadata you will collect from an X profile.

Part 3: Advanced Search Operators — The Surgical Toolkit

Most people search X by typing a word into the search bar and scrolling. That is like walking into a library and reading every book to find one sentence. The advanced search operators are your card catalog. They let you specify exactly what you want, from whom, within what timeframe, and with what type of content.

Here is every operator you need to know, explained with practical examples

from: — Tweets From a Specific Account

This restricts results to a single user.

from:Allen123

Every tweet in the result set was posted by @Allen123. Use this as your base operator, then layer others on top.

to: — Tweets Directed at a Specific Account

This finds tweets that were sent as replies to a specific user.

to:Allen123

Use this to see who is talking to your target, even if the target has not responded.

since: and until: — Date Range Filtering

These operators restrict results to a specific date range using the format YYYY-MM-DD.

from:Allen123 since:2025-01-01 until:2025-06-01

This returns every tweet from @Allen123 posted between January 1 and June 1, 2025. You just narrowed down years of potential content to a five-month window. Use this to focus on a specific incident period, a known travel window, or any time-frame relevant to your investigation.

geocode: — Location-Based Searching

This searches for tweets posted within a radius of specific coordinates.

geocode:51.5074,-0.1278,10km

This finds tweets posted within 10 kilometers of central London. The format is latitude, longitude, and radius with the unit (km or mi).

Combine this with other operators:

from:Allen123 geocode:40.7128,-74.0060,5km since:2025-03-01 until:2025-03-15

This finds any tweet posted by @Allen123 within 5 kilometers of New York City during the first two weeks of March 2025. If the target claims they were in another country during that period, and this query returns results, you have a discrepancy.

filter:media — Tweets Containing Images or Video

from:Allen123 filter:media

This returns only tweets that include photos or videos. This is how you find geolocatable content without scrolling through text. Every image is a potential location clue.

filter:links — Tweets Containing URLs

from:Allen123 filter:links

This returns only tweets that include hyperlinks. Use this to map what articles, videos, or external content the target shares. It tells you what information sources they consume and what narratives they amplify.

Combining Operators for Surgical Precision

The real power is in combining these operators into a single query that returns exactly what you need.

from:Allen123 to:SomeJournalist since:2025-04-01 until:2025-04-30 filter:media

This returns every image @Allen123 sent as a reply to @SomeJournalist during April 2025. You are not scrolling through a timeline. You are pulling a specific slice of data tailored to your investigation question.

Another example:

from:Allen123 geocode:34.0522,-118.2437,15km since:2025-01-01 filter:links

This returns every link @Allen123 posted while physically in Los Angeles during 2025. If the target claims to have never visited LA, and this query returns geotagged tweets from within the city, you have evidence to the contrary.

Learn these operators. Practice combining them. The search bar is not for casual browsing. It is a query interface for a massive database. Write your queries with precision, and X will give you exactly what you ask for.

Part 4: Reconstructing Deleted Tweets

Tweets disappear for many reasons. The user deletes them. The account gets suspended. The content violates platform policy and is removed. But deletion is not erasure. The internet caches things. Your job is to find those caches.

Method 1: Google Cache

When Google indexes a tweet, it stores a snapshot. If the original tweet is deleted, the cached version may still exist.

Take the tweet URL. It looks like this:

https[:]//x.com/Allen123/status/123456789

Now search that exact URL on Google. If Google cached the tweet before deletion, the search result will include a small green arrow next to the URL. Click that arrow. Select “Cached.” Google displays the stored version of the page, including the tweet text, timestamp, and sometimes the media preview.

Method 2: Wayback Machine

The Internet Archive at archive.org crawls and stores snapshots of web pages. Paste the tweet URL into the Wayback Machine search bar. If the tweet was archived, you will see a calendar of snapshots. Click any date to view the tweet as it existed at that moment.

The Wayback Machine does not capture every tweet. Popular accounts and high-engagement tweets are more likely to be archived. But when a snapshot exists, it is gold.

Method 3: Third-Party Archives

Several services aggregate and store X data at scale.

tweetdeleter is primarily a tool for users to manage their own tweet history, but it also surfaces deleted content that was indexed before removal. Search the username or tweet text.

Academic datasets like DocNow and Social Feed Manager capture large volumes of X data for research purposes. These are not always user-friendly, but if your investigation involves a high-profile account or a significant event, academic archives may have preserved what the user tried to delete.

Method 4: Screenshot Searches

If the tweet was controversial enough to get deleted, someone probably screenshotted it before it went down. Search the tweet text in quotes on Google Images. Search the username plus keywords from the tweet. Search the tweet URL on Reddit and other forums where people share and discuss posts.

The text might be gone from X, but it lives on in screenshots posted to other platforms. Find those screenshots.

Practical Workflow for Deleted Content Recovery

Start with the tweet URL. Check Google Cache.
Paste the URL into the Wayback Machine. Check for snapshots.
Search the tweet text in quotes on Google. Check cached results.
Search the username and keywords on third-party archives.
Search for screenshots of the tweet on Google Images and Reddit.

If the tweet was public for any length of time, one of these methods will surface it. The internet does not forget. It just buries things. Your job is to dig.

Part 5: Additional Tools for X Investigation

Beyond the built-in search operators, several external tools enhance your collection capabilities.

Nitter is a privacy-focused frontend for viewing X content without an account. It allows you to browse profiles, search tweets, and view media without logging in. Multiple Nitter instances exist. If one is down, find another. Use it for passive viewing when you do not want to interact with the platform directly.

Twint was a Python-based scraping tool that pulled tweet data without API authentication. It is no longer actively maintained due to X’s API changes, but forks and alternatives exist. If you need bulk historical data, explore snscrape, which scrapes social networks including X and outputs structured data.

Social Bearing at socialbearing.com provides tweet analytics, sentiment analysis, and engagement metrics for specific search queries or user timelines. Use it to visualize posting frequency and interaction patterns.

Tweet Beaver at tweetbeaver.com offers several utilities including user ID lookup, follower analysis, and conversation threading. It is useful for quick lookups without touching the X interface.

Part 6: Practical Investigation Workflow Summary

Here is your step-by-step process for every X investigation.

Navigate to the target profile. Extract the numeric user ID via page source or commentpicker.com. Document it.
Note the account creation date from the profile. Check the exact timestamp using inspect element if available.
Run a broad search using from:USERNAME to establish a baseline of the target’s posting behavior.
Narrow the search with since: and until: operators to focus on the timeframe relevant to your investigation.
Use filter:media to pull all images and videos. Review each for geolocation clues.
Use filter:links to identify what external content the target shares.
Use geocode: combined with date operators to find location-specific activity.
Use to: to map who the target interacts with.
For any deleted tweets, run the recovery workflow: Google Cache, Wayback Machine, third-party archives, screenshot search.
Cross-reference findings with other platforms. The numeric ID, the writing style, the locations, the shared links, all of these bridge to Facebook, Instagram, Reddit, and LinkedIn.
Preserve everything. Screenshots, URLs, timestamps, extracted IDs. X content disappears. Your evidence file should not.

This is X investigation at the professional level. Not scrolling endlessly. Not guessing. Systematic extraction of hard identifiers, surgical search queries that return exactly what you need, and recovery methods that bring back what someone tried to erase. Master this, and you control the signal.

Lecture 4.6: GitHub Recon — The Developer’s Digital Shadow

GitHub is not social media in the traditional sense. But for an investigator, it is one of the richest intelligence sources available. Developers live on GitHub. They write code, document projects, collaborate with teams, and accidentally expose things they should not. Every repository is a window into how a person or organization operates. Every commit is a timestamped action tied to an email address. Every profile is a potential attribution bridge.

This lecture is a complete walkthrough of GitHub reconnaissance. By the end, you will know how to find users, map organizations, extract hidden emails, discover leaked credentials, determine exactly when an account was created, and automate large parts of the process. No theory without practice. Every technique comes with the exact command or query you need.

Part 1: Understanding the GitHub API — Your Primary Data Source

GitHub provides a rich, public API that returns structured JSON data for users, organizations, repositories, commits, and more. This API is your primary collection tool. You do not need authentication for public data. You just need to know the endpoints.

The base URL is https://api.github.com. Every query you run builds on this.

The tool you will use most often is curl, which fetches data from a URL directly from your terminal, paired with jq, which formats the JSON output so you can read it.

If you do not have curl installed, install it. If you do not have jq installed, install it. These are non-negotiable tools for GitHub OSINT.

sudo apt install curl jq

Now you are ready.

Part 2: User Profile Reconnaissance

Every GitHub user has a public profile accessible through the API. The endpoint is:

https://api.github.com/users/[username]

Replace [username] with the target’s handle. Let me walk you through a real example. Suppose the target is techenthusiast167.

Open your terminal and run the first or using your browser for the second:

curl -s "https://api.github.com/users/techenthusiast167"

OR

https://api.github.com/users/techenthusiast167

The -s flag keeps the output clean by suppressing progress bars. The command returns a JSON object. It is dense. You want to filter it to see only the fields that matter for your investigation.

Run this instead:

curl -s "https://api.github.com/users/techenthusiast167" | jq '{username: .login, name: .name, company: .company, location: .location, email: .email, blog: .blog, bio: .bio, public_repos: .public_repos, followers: .followers, following: .following, created_at: .created_at}'

This returns exactly what you need:

Username: The handle you searched.
Name: The real name the user provided.
Company: The organization they claim affiliation with.
Location: Self-reported location.
Email: Publicly listed email, if they added one.
Blog: Personal website or social media link.
Bio: Free-text description. Often contains contact details, interests, or other handles.
Public Repos: Number of public repositories.
Followers/Following: Network size indicators.
Created At: The exact account creation timestamp.

Document every field. The email, blog, company, and location are direct attribution data. The bio often contains Twitter handles, personal websites, or other platform usernames.

Part 3: GitHub User ID Extraction — The Numeric Anchor

Every GitHub account has two identifiers. The username, which is the handle everyone sees like techenthusiast167, and the numeric user ID, which is GitHub’s internal identifier.

The username can change. GitHub allows users to rename their accounts, and when they do, the old username becomes available for anyone else to claim. If you are tracking a target by username alone, a rename can break your investigation.

The numeric user ID never changes. It is assigned when the account is created and stays with that account permanently. If you capture the numeric ID, you can track that user through any number of username changes.

Method 1: API Extraction via Curl

The GitHub API returns the numeric ID in every user profile response. You have already pulled user data with curl. You just need to look at the id field.

curl -s "https://api.github.com/users/techenthusiast167" | jq '{username: .login, id: .id, created_at: .created_at}'

The output looks like this:

That id field, 123456789, is the numeric user ID. It is globally unique. No other account on GitHub has that number. Copy it. Store it in your investigation file alongside the current username and the date of extraction.

To pull just the ID on its own:

curl -s "https://api.github.com/users/techenthusiast167" | jq -r '.id'

This returns the raw number with no quotes, ready to use in your next query.

Method 2: Browser Extraction

If you prefer not to use the command line, you can get the numeric ID directly from your browser.

Navigate to the API endpoint directly:

https://api.github.com/users/techenthusiast167

This returns the full JSON profile in your browser. Press Ctrl + F and search for "id". The first result will show the numeric ID. It is right there in plain text, no authentication required.

Use Firefox or install a JSON Formatter extension for Chrome to make the output collapsible and readable.

Method 3: Avatar URL Analysis

GitHub stores user avatars on a CDN, and the avatar URL often contains the numeric user ID. This is useful when you only have the avatar image and need to work backward to find the account.

Right-click on any GitHub user’s avatar and select “Open image in new tab.” The URL will look something like:

https://avatars.githubusercontent.com/u/123456789?v=4

The number after /u/ is the numeric user ID. In this example, 123456789 is the ID. The ?v=4 parameter is just a version counter and can be ignored.

If you have a GitHub avatar URL saved from a screenshot, a forum post, or a cached page, you can extract the numeric ID directly from the URL. Then construct the API call to pull the full profile:

https://api.github.com/user/123456789

This returns the complete user profile for whatever username currently holds that ID. If the user changed their username yesterday, this API call still finds them today.

Customizing the URL to Return User Data via ID

Once you have the numeric ID, you can query the GitHub API using that ID instead of the username. The endpoint is

https://api.github.com/user/[ID]

Replace [ID] with the numeric ID you extracted.

Example:

curl -s "https://api.github.com/user/123456789" | jq '.'

Note: you can as well do this via your browser without using the curl command:

Example:

https://api.github.com/user/123456789

This returns the full user profile for whatever account currently owns that ID. If the user renamed their account from oldhandle to newhandle, the API returns newhandle. You have tracked them through the name change.

To combine everything into one clean command that takes a username and returns the numeric ID plus the avatar URL:

curl -s "https://api.github.com/users/techenthusiast167" | jq '{username: .login, id: .id, avatar: .avatar_url}'

Output:

Why This Matters for an Investigator

The numeric user ID gives you persistence. Usernames change. People rebrand. They create new personas and abandon old ones. The numeric ID is the anchor that ties it all together.

Here is a practical scenario. You are investigating a developer who goes by @hackerx on GitHub. You extract the numeric ID: 987654321. Six months later, @hackerx no longer exists. The account was renamed to @securityresearcher. Your old notes point to a dead profile. But if you stored the numeric ID, you run:

curl -s "https://api.github.com/user/987654321" | jq '.login'

And GitHub returns securityresearcher. You found them.

The avatar URL is another breadcrumb. If a target uses the same avatar on GitHub, Twitter, and a forum, the numeric ID embedded in the GitHub avatar URL connects the GitHub account to that specific image. When you run perceptual hash matching across platforms, the GitHub avatar URL becomes one more confirmed node in your attribution map.

The numeric ID also helps with breach correlation. Some data breaches and leaked databases include GitHub numeric IDs alongside email addresses and usernames. Having the ID lets you search those datasets with higher precision than a username alone.

Practical Workflow for ID Extraction

Pull the user profile: curl -s "https://api.github.com/users/username" | jq '.'
Extract the numeric ID from the id field.
Extract the avatar URL from the avatar_url field.
Store both alongside the current username and the date of extraction.
Construct the ID-based API URL: https://api.github.com/user/[ID] for future lookups.
If the username ever goes dead, query the ID-based URL to find the new username.

Part 4: Account Creation Date Detection

The created_at field from the API gives you the exact timestamp the account was registered. This is not an estimate. It is the precise second.

To pull just the creation date:

curl -s "https://api.github.com/users/techenthusiast167" | jq -r '.created_at'

The Z at the end means UTC. This timestamp never changes. It is your temporal anchor for cross-referencing against other platforms.

If you want to calculate how old the account is in days:

creation_date=$(curl -s "https://api.github.com/users/techenthusiast167" | jq -r '.created_at')
account_age=$(( ($(date +%s) - $(date -d "$creation_date" +%s)) / 86400 ))
echo "Account age: $account_age days"

This tells you exactly how long this persona has existed. A new account with suspicious activity is a red flag. An old account with consistent activity is an established identity.

Part 5: Repository Enumeration

Repositories are where the intelligence lives. Every repo tells you what the user builds, what languages they know, and what problems they are working on.

To list all public repositories for a user:

curl -s "https://api.github.com/users/techenthusiast167/repos" | jq '.[].full_name'

This returns the full name of each repository in owner/repo format. Pick one and drill deeper.

To get detailed information about a specific repository:

curl -s "https://api.github.com/repos/techenthusiast167/repo-name" | jq '{description: .description, language: .language, stargazers_count: .stargazers_count, forks_count: .forks_count, open_issues_count: .open_issues_count, created_at: .created_at, updated_at: .updated_at}'

This tells you what the project does, what language it is written in, how popular it is, and when it was created and last updated. An actively maintained repository indicates ongoing development. A repo created two years ago with no updates is abandoned.

For broader lookup, simply use:

https://api.github.com/repos/techenthusiast167/repo-name

Part 6: Commit Email Extraction

This is one of the most valuable techniques in GitHub OSINT, and most investigators overlook it entirely.

Every time a developer makes a commit, Git records the author’s name and email address in the commit metadata. This is how Git tracks who wrote what. GitHub displays commits on the web interface, but it hides the raw email behind a privacy relay address that looks like username@users.noreply.github.com. That relay address is useless for investigation.

The raw commit data, however, still contains the original email if the developer did not configure Git to use the private relay. Many developers never change their default Git configuration, so their personal email is embedded in every commit they have ever made. Your job is to extract it.

Here are three methods, ordered from most efficient to most surgical.

Method 1: Curl Extraction (Primary Method — Bulk Collection)

This is the most reliable approach. It pulls structured JSON directly from the GitHub API, which you can filter and save for your evidence file. It works on every public repository.

Run this command in your terminal:

curl -s "https://api.github.com/repos/[owner]/[repo]/commits" | jq '.[].commit.author.email'

Replace [owner] with the username or organization name, and [repo] with the repository name.

Example:

The output is a clean list of every email address associated with commits in that repository.

If the developer used multiple email addresses across different commits, you will see all of them. Each one is a pivot point for further investigation.

To get more context with each email, pull the author name alongside it:

curl -s "https://api.github.com/repos/techenthusiast167/my-project/commits" | jq '.[] | {name: .commit.author.name, email: .commit.author.email, date: .commit.author.date}'

Unique email extraction (No Duplicates)

curl -s "https://api.github.com/repos/techenthusiast167/my-project/commits" | jq '.[].commit.author.email' | sort -u

This returns:

{
  “name”: “John Doe”,
  “email”: “johndoe@gmail.com”,
  “date”: “2024-08-15T14:32:30Z”
}

You now have the committer’s full name, their real email address, and the exact timestamp of each commit. This is attribution gold. Save this output directly into your investigation file.

Method 2: Browser Shortcut (Quick Look — No Terminal Required)

If you are not on a machine with curl installed, or you just want a fast glance without opening the command line, use your browser.

Navigate to:

https://api.github.com/repos/[owner]/[repo]/commits

Replace [owner] with the username or organization name, and [repo] with the repository name.

Example:

https://api.github.com/repos/techenthusiast167/my-project/commits

This opens a raw JSON page containing every commit on the default branch. The page is plain text, but all the data is there.

Now, press Ctrl + F and search for "email". Every match is a commit author’s email address embedded in the JSON. You will see lines like:

Scroll through the results. Each email is tied to a specific commit with a timestamp and a committer name. You can pull every email address ever used in that repository without cloning anything, without running a single command, just by reading the API output in your browser.

To make this even easier, use Firefox, which natively formats JSON with collapsible trees. If you are on Chrome, install a JSON Formatter extension. With formatted JSON, you can expand each commit object, navigate to commit → author → email, and the email is right there.

This method is fast, passive, and requires zero setup. Bookmark the API URL pattern. It will save you time on every GitHub investigation.

Method 3: The .patch Method (Deep Dive on a Single Commit)

If you need to preserve a single commit as evidence, or if the API is not returning the data you expect, the .patch method gives you the raw, unprocessed commit output.

First, get the SHA hash of the specific commit you want. Use Method 1 to list all commit SHAs:

curl -s "https://api.github.com/repos/techenthusiast167/my-project/commits" | jq '.[].sha'

This returns a list of commit hashes. Pick one.

Now, append .patch to the commit URL and fetch it:

curl -s "https://github.com/techenthusiast167/my-project/commit/abc123def456.patch"

The output is a raw patch file. At the very top, you will see a line like:

That is the committer’s real name and email address. Not the GitHub-provided noreply.github.com relay. The actual email they configured in Git.

You can also open this URL directly in your browser. Navigate to:

https://github.com/[owner]/[repo]/commit/[sha].patch

The browser displays the raw patch as plain text. Press Ctrl + F and search for From:. The email is right there. Screenshot it. Save the page as evidence.

What You Do With The Email

Every email address you extract becomes a new investigation thread. Plug it into your email intelligence workflow from Module 3. Run it through Google dorks, Epieos, Intelbase, BehindTheEmail, etc. Search it across social media platforms. Check it against breach databases like HaveIBeenPwned, DeHashed, and IntelX.

A single commit email can unravel an entire digital footprint. I have found personal Facebook accounts, LinkedIn profiles, and personal websites starting from nothing but a GitHub commit email. The developer never thought anyone would look. That is exactly why you do.

Part 7: Followers, Following, and Social Network Mapping

GitHub profiles include follower and following lists. These reveal professional relationships, team structures, and collaboration networks.

To see who a user follows:

curl -s "https://api.github.com/users/techenthusiast167/following" | jq '.[].login'

OR

curl -s "https://api.github.com/users/techenthusiast167/following?per_page=100" | jq '.[].login'

To see who follows them:

curl -s "https://api.github.com/users/techenthusiast167/followers" | jq '.[].login'

OR

curl -s "https://api.github.com/users/techenthusiast167/followers?per_page=100" | jq '.[].login'

The ?per_page=100 parameter ensures you get up to 100 results per request instead of the default 30. If the user follows more than 100 accounts, you need to handle pagination. The API includes a Link header in the response with the URL for the next page. You can check it with:

curl -s -I "https://api.github.com/users/user/following?per_page=100"

Look for the Link header in the output. It contains the URL for the next page of results.

If You Still Get an Empty Response

Some users have zero followers or follow zero accounts. If the command returns nothing, that means exactly that. The user is not following anyone, or no one follows them.

Map these connections. If a target follows several employees of the same company, they likely work there or have a professional relationship with them. If multiple accounts follow each other in a small cluster, you have identified a team or a collaboration group.

Part 8: Organization Intelligence

Organizations on GitHub have their own profile pages and member lists. If your target lists a company on their profile, check if that company has a GitHub organization.

To pull organization profile data:

curl -s "https://api.github.com/orgs/companyname" | jq '{name: .name, description: .description, blog: .blog, email: .email, location: .location, public_repos: .public_repos}'

To list all public members of an organization:

curl -s "https://api.github.com/orgs/companyname/members" | jq '.[].login'

Validation of results:

This returns every GitHub user who publicly lists themselves as a member of that organization. You now have a list of potential employees. Cross-reference these handles against LinkedIn, Twitter, and other platforms to build a corporate directory from the outside.

Rate Limiting

GitHub allows 60 unauthenticated requests per hour. If you exceed that, the API returns a 403 error with a message about rate limiting. Check your current rate limit status:

curl -s "https://api.github.com/rate_limit" | jq '.rate'

This shows your remaining requests and when the limit resets. If you are hitting the limit, wait, or use a personal access token to increase your quota to 5,000 requests per hour.

Part 9: Advanced Curl: All-in-One Intelligence Extraction

You can pull a target’s entire GitHub footprint with a single command. This returns profile details, organizations, repositories, and commit emails all at once.

Replace username with the target GitHub handle and run:

echo "=== PROFILE ===" && curl -s "https://api.github.com/users/username" | jq '{username: .login, name: .name, company: .company, location: .location, email: .email, blog: .blog, bio: .bio, twitter: .twitter_username, hireable: .hireable, public_repos: .public_repos, followers: .followers, following: .following, created_at: .created_at}' && echo "=== ORGANIZATIONS ===" && curl -s "https://api.github.com/users/username/orgs" | jq '.[] | {org: .login, description: .description}' && echo "=== REPOSITORIES ===" && curl -s "https://api.github.com/users/username/repos?per_page=100&sort=pushed" | jq '.[] | {repo: .full_name, language: .language, pushed_at: .pushed_at, description: .description}' && echo "=== COMMIT EMAILS (Latest Repo) ===" && repo=$(curl -s "https://api.github.com/users/username/repos?per_page=1&sort=pushed" | jq -r '.[0].full_name') && curl -s "https://api.github.com/repos/$repo/commits?per_page=10" | jq '.[] | {author: .commit.author.name, email: .commit.author.email, date: .commit.author.date}'

What This Returns in One Run:

Full profile: username, real name, company, location, email, blog, bio, Twitter handle, hireable status
Account creation timestamp and last update timestamp
All public organizations the user belongs to
All public repositories with language and last push date
Commit author names and real email addresses from the most recently pushed repository

Save this as a bash script. Run it on any username. The intelligence lands in your terminal in seconds. No clicking. No manual lookups. One command. Everything.

Part 10: Advanced Code Search

GitHub’s search is powerful, but you need to know the operators.

Go to https://github.com/search and type your query directly into the search bar. Use the operators you already know:

Search by User or Organization:

user:johndoe “keyword”
org:companyname “keyword”
repo:owner/repo “keyword”

Example:

Search by File Extension:

extension:env “DATABASE_URL”
extension:json “password”
extension:yml “secret”
extension:pem “PRIVATE KEY”

Search by Filename:

filename:.env
filename:config.json
filename:docker-compose.yml

Search by Path:

path:.github/workflows
path:src/config
path:database

Search for Credentials and Secrets:

“api_key” org:companyname
“password” user:techenthusiast167
“AWS_ACCESS_KEY” extension:env
“ghp_” org:companyname
“xoxb-” org:companyname

These queries find API keys, tokens, passwords, and configuration files that developers accidentally committed to public repositories. The ghp_ prefix is for GitHub personal access tokens. The xoxb- prefix is for Slack bot tokens. Finding either in a public repo is a critical security exposure.

Combine operators for precision:

org:companyname extension:env “DATABASE_URL”

This finds every .env file in every repository belonging to the target organization that contains a database connection string. One query, and you have the keys to their database.

Part 11: Automated Reconnaissance Tools

Manual searching works, but automated tools scale your collection.

TruffleHog scans repositories for high-entropy strings, which are often API keys and passwords.

trufflehog git https://github.com/user/repo --json --verify > scan_results.json

The --verify flag tests each found credential to confirm it is still active. Use this only on repositories you are authorized to investigate.

Gitleaks uses pattern-based detection to find secrets.

gitleaks detect --source=/path/to/repo -v

GitRob automates organization-wide scanning.

gitrob target-organization

These tools find what manual searching misses, but they are not a replacement for understanding the search operators. Run the tools, then verify their findings manually. Automated scanners produce false positives. Your brain is the final filter.

Part 12: Gists Investigation

Gists are code snippets that users share publicly. They are separate from repositories and are often overlooked during investigations.

To list all public gists for a user:

curl -s "https://api.github.com/users/johndoe/gists" | jq '.[].html_url'

Gists often contain configuration snippets, notes, API examples, and sometimes credentials. A developer who is careful with their repositories might be careless with their gists. Check them.

Part 13: Activity Timeline and Pattern-of-Life Analysis

The events endpoint shows a user’s recent public activity:

curl -s "https://api.github.com/users/techenthusiast167/events" | jq '.[].type'

OR

https://api.github.com/users/techenthusiast167/events

This returns event types like PushEvent, CreateEvent, WatchEvent, and ForkEvent, each with a timestamp. Analyze this timeline to understand when the user is active.

A user who pushes code every weekday between 9 AM and 5 PM UTC has a consistent work schedule in that timezone. A user who commits at 3 AM on weekends has different patterns. This is pattern-of-life intelligence.

Part 14: Practical Investigation Workflow Summary

Here is the complete GitHub investigation sequence:

Profile Pull: curl -s "https://api.github.com/users/username" | jq '.' — Document name, ID, company, location, email, blog, bio, and creation date.
Repository Enumeration: curl -s "https://api.github.com/users/username/repos" | jq '.[].full_name' — List all public repos.
Repository Analysis: For each repo, pull description, language, stars, forks, and update history.
Commit Email Extraction: For key repos, pull commits and append .patch to commit URLs to extract real email addresses.
Social Network Mapping: Pull followers and following lists. Map professional connections.
Organization Investigation: If the user lists a company, pull the org profile and member list.
Code Search: Run targeted queries for file types, credentials, and sensitive configurations.
Gists Check: List and review public gists.
Activity Analysis: Pull events to establish active hours and pattern-of-life.
Automated Scanning: Run TruffleHog or Gitleaks on high-value repositories for automated secret detection.
Cross-Platform Correlation: Take the email, location, company, and social links found on GitHub and cross-reference them against LinkedIn, Twitter, Reddit, and Instagram.
Document Everything: Save all API responses as JSON files with timestamps. Screenshot key findings. Build your evidence package.

Part 15: Quick Reference Commands

Objective___________________Command

User profile:curl -s "https://api.github.com/users/username" | jq '.'
Creation date only:curl -s "https://api.github.com/users/username" | jq -r '.created_at'
List repos:curl -s "https://api.github.com/users/username/repos" | jq '.[].full_name'
Repo details:curl -s "https://api.github.com/repos/owner/repo" | jq '.'
Extract commit emails Append :.patch to commit URL
Followers:curl -s "https://api.github.com/users/username/followers" | jq '.[].login'
Following:curl -s "https://api.github.com/users/username/following" | jq '.[].login'
Organization profile:curl -s "https://api.github.com/orgs/orgname" | jq '.'
Org members:curl -s "https://api.github.com/orgs/orgname/members" | jq '.[].login'
List gists:curl -s "https://api.github.com/users/username/gists" | jq '.[].html_url'
User events:curl -s "https://api.github.com/users/username/events" | jq '.[].type'
Gitleaks scan:gitleaks detect --source=/path/to/repo -v

Part 16: Legal and Ethical Boundaries

Everything covered in this lecture uses publicly available data. The GitHub API returns information that users and organizations chose to make public. You are not bypassing authentication. You are not exploiting vulnerabilities.

That said, there are lines you do not cross.

Respect rate limits: GitHub allows 60 unauthenticated requests per hour. Use authenticated requests with a personal access token for 5,000 requests per hour if you have a legitimate developer account.
Do not use found credentials: If you discover an API key or password, document it and report it through responsible disclosure. Using it is illegal.
Do not harass or dox individuals based on GitHub data: The fact that someone’s email is public in a commit does not give you the right to target them.
Store collected data securely: GitHub profiles change. Save what you need, but protect it.

Professional investigators operate within the law. Your reputation depends on it.

This is GitHub reconnaissance at the professional level. Not browsing. Not guessing. Systematic API-driven collection, targeted code search, and automated scanning where appropriate. Master this, and you add a powerful new dimension to every investigation you run.

Lecture 4.7: YouTube OSINT — The Video Investigator’s Toolkit

YouTube is the second largest search engine on the planet. People upload their lives, their opinions, their locations, and their skills to this platform every second of every day. For an investigator, YouTube is not just a video library. It is a behavioral archive, a geolocation goldmine, and an attribution tool all rolled into one.

Most people watch videos. You are going to dissect them. This lecture covers every practical technique you need to extract intelligence from YouTube channels, videos, and the metadata that surrounds them.

YouTube is the second largest search engine on the planet. People upload their lives, their opinions, their locations, and their skills to this platform every second of every day. For an investigator, YouTube is not just a video library. It is a behavioral archive, a geolocation goldmine, and an attribution tool all rolled into one.

Part 1: Channel Reconnaissance — The Initial Pass

Every YouTube channel has a public face. Before you touch any tool, open the channel page and document what is visible.

Look at the channel name. This may be a real name, a pseudonym, or a brand. Note it exactly as displayed.

Look at the handle. YouTube assigns every channel a unique @handle like @JohnDoe. This handle is often reused across platforms. Document it.

Look at the channel description. Users frequently list contact emails, social media links, website URLs, and business inquiries here. Copy every link and email address. These are direct attribution bridges.

Look at the channel creation date. This is displayed under the “About” tab. An older channel with consistent uploads is an established identity. A new channel with a handful of videos is a burner or a fresh persona. Note it.

Look at the total video count, subscriber count, and view count. These numbers tell you the channel’s reach and activity level. A channel with thousands of subscribers and regular uploads is a significant online presence. A channel with three videos and ten subscribers is not.

Scroll through the video list. Note the upload frequency. Note the content themes. Note the locations visible in thumbnails. Thumbnails are often pulled directly from the video and can contain geolocatable imagery before you even click play.

Part 2: User ID Extraction — The Unchangeable Identifier

Every YouTube channel has a unique, unchangeable numeric Channel ID. The @handle can change. The channel name can change. The Channel ID stays the same forever. Extract it.

Method 1: Page Source (Manual Extraction)

Open any YouTube channel page. Right-click anywhere on the page background and select “View Page Source.” Press Ctrl + F and search for channel_id or externalId. You are looking for a line like:

“channel_id”:”UCxxxxxxxxxxxxxxxx”

OR:

“externalId”:”UCxxxxxxxxxxxxxxxx”

The value starting with UC is the Channel ID. It is globally unique. Copy it. Store it. This ID lets you track the channel through any rebranding.

Method 2: Browser URL Trick

If the channel has a custom URL like youtube.com/@JohnDoe, the Channel ID is hidden behind the handle. To reveal it, click on any video on the channel. Scroll down to the comments section. Right-click on the channel name in a comment left by the channel owner and select “Inspect Element.” Look for an attribute like data-channelid or a link containing /channel/UCxxxxxxxxxxxxxxxx. That is the ID.

Method 3: The Share Channel Option (Fastest Method — No Tools Required)

If you want the Channel ID without touching the page source, without opening developer tools, and without making a single API call, this is the method you use. It takes less than five seconds and works on every YouTube channel.

Open the target YouTube channel. Look at the channel banner area. On the right side, you will see a button labeled “More info” or a small arrow pointing downward next to the channel name. Click it.

A dropdown menu appears with several options. Scroll down until you see “Share channel.” It has a curved arrow icon pointing to the right. Click on it.

A small popup window appears with two options:

Share channel — This copies a link to the channel.
Copy channel ID — This copies the Channel ID directly to your clipboard.

Click “Copy channel ID.” A small confirmation message appears at the bottom of the screen: “Channel ID copied to clipboard.”

That is it. You now have the target’s unchangeable Channel ID. Open a notepad, paste it, and store it in your investigation file.

Method 4: Using the API

YouTube’s Data API returns the Channel ID directly. The endpoint is:

https://www.googleapis.com/youtube/v3/channels?part=id&forUsername=USERNAME&key=YOUR_API_KEY

You need an API key from Google Cloud Console, but the free tier allows thousands of queries per day. This method is fast and reliable for bulk lookups.

Part 2 (Addendum): Validating the YouTube Channel ID

You pulled a string from the page source that looks like a Channel ID. It starts with UC followed by a string of characters. But how do you know it is real? You validate it. Never trust a single extraction without confirmation.

YouTube Channel IDs follow a predictable URL structure. Every valid Channel ID resolves to a working channel page. Here is how to test it.

Take the Channel ID you extracted. Let us say it is UCxxxxxxxxxxxxxxxx. Construct this URL:

https://www.youtube.com/channel/UCxxxxxxxxxxxxxxxx

Paste it into your browser. If the ID is valid, the page loads and displays the channel. You will see the channel name, the banner, the video grid, everything. The ID is confirmed.

If the ID is invalid, YouTube returns a 404 page with the message “This page isn’t available.” That means the string you extracted is not a real Channel ID, or the channel has been terminated. Either way, document it. A terminated channel is still intelligence. It tells you the account existed and was removed.

Part 3: Channel Metadata Deep Dive

YouTube stores extensive metadata about every channel. Most of it is visible on the About tab, but some of it is buried in the page source or accessible through third-party tools that aggregate the data for you.

The About Tab — Manual Collection

Click the “About” tab on any channel. Document the following:

Description: Copy the full text. Look for emails, URLs, other social media handles.
Details: This section sometimes includes a business inquiry email and a location. Copy both.
Links: Custom links to websites, social media, and merchandise stores. Click every one.
Join Date: The exact month and year the channel was created.
Total Views: Lifetime view count for the entire channel.
Featured Channels: Other channels the user endorses or is connected to.

Page Source Metadata Extraction

Right-click on the channel page background. Select “View Page Source.” Search for these keywords to find hidden data:

keywords — YouTube stores channel-level keywords in the metadata. These reveal what topics the channel owner thinks their content is about.
description — The full description text, sometimes including older versions that were edited out of the current About tab.
og:title and og:description — Open Graph meta tags used for social sharing. These often contain clean, structured text.
canonical — The canonical URL of the channel, which includes the Channel ID.
image_src — The channel’s high-resolution profile image URL

Document everything you find.

Part 4: Video Metadata Analysis

Every video on YouTube carries its own metadata. This includes the upload timestamp, the title, the description, the tags, the category, and sometimes the location where the video was recorded.

Method 1: The Video Page Source

Open any video. Right-click on the page background and select “View Page Source.” Search for these fields:

publishDate or datePublished — The exact upload timestamp in ISO format.
keywords — The tags the uploader assigned to the video. These reveal the topics and communities the content targets.
description — The full video description, including links and text that may have been edited after upload.
location — Rare, but some videos contain geolocation data embedded in the metadata if the uploader enabled it.

Method 2: The YouTube Metadata Tool

A faster, cleaner way to pull all this data is to use the free web tool at: https://mattw.io/youtube-metadata

Paste any YouTube video URL into the search bar and click Submit. The tool returns a structured page with:

Video title, description, and tags.
Exact upload timestamp.
Channel ID and channel title.
Video duration, category, and privacy status.
Thumbnail URLs at multiple resolutions.
Whether the video is unlisted, private, or public.
Caption availability and language.

This tool aggregates data from YouTube’s public APIs and page source into one readable screen. It saves you from manually digging through HTML. Use it for every video you investigate.

Part 5: Video and Image Download via Source Code, Inspect Element, Browser Extensions

You may need to preserve a video or thumbnail as evidence. Downloading is straightforward, but there are multiple methods depending on what you need.

Downloading Thumbnails

YouTube generates thumbnails at multiple resolutions. Every video has a default thumbnail URL pattern:

https://img.youtube.com/vi/[VIDEO_ID]/0.jpg
https://img.youtube.com/vi/[VIDEO_ID]/1.jpg
https://img.youtube.com/vi/[VIDEO_ID]/2.jpg
https://img.youtube.com/vi/[VIDEO_ID]/3.jpg
https://img.youtube.com/vi/[VIDEO_ID]/maxresdefault.jpg

Replace [VIDEO_ID] with the video ID from the URL. For example, if the video URL is youtube.com/watch?v=abc123def45, the video ID is abc123def45.

0.jpg is the auto-generated thumbnail, usually showing a frame from the video.
1.jpg, 2.jpg, 3.jpg are alternate auto-generated frames.
maxresdefault.jpg is the highest resolution custom thumbnail the uploader provided.

Open any of these URLs in your browser. Right-click and save the image. These URLs are public and require no authentication.

Downloading Videos via Inspect Element

YouTube does not provide a direct download link on the video page, but the video file URL is embedded in the page source.

Open the video page. Right-click and select “Inspect Element.” Go to the Network tab in the developer tools panel. Refresh the page. In the filter bar, type videoplayback. Look for requests to URLs containing videoplayback in the domain. These are the direct video stream URLs.

Click on one of these requests. In the Headers tab, copy the full Request URL. Open that URL in a new tab. The video file plays directly. Right-click and select “Save video as” to download it.

Alternatively, use command-line tools like yt-dlp:

You may need to preserve a video or thumbnail as evidence. Downloading is straightforward, but there are multiple methods depending on what you need.

sudo apt install yt-dlp

yt-dlp -h

Proceed:

yt-dlp https[:]//www.youtube.com/watch?v=abc123def45

This downloads the highest quality version available. yt-dlp is the successor to youtube-dl and is actively maintained. Install it and keep it updated.

Downloading Subtitles and Closed Captions

Subtitles are a goldmine for text analysis. YouTube auto-generates captions for most videos, and uploaders sometimes provide their own.

To download subtitles using yt-dlp:

yt-dlp --write-subs --sub-langs all https[:]//www.youtube.com/watch?v=abc123def45

This saves all available subtitle tracks. The resulting text files contain every word spoken in the video, which you can search, analyze, and cross-reference against other platforms.

Downloading Videos via Browser Extensions (Quick Alternative)

If you prefer a graphical interface, browser extensions handle the download process for you. Install one of these:

Video DownloadHelper — Available for Firefox and Chrome. Detects video streams on the page and offers one-click download.
SaveFrom.net Helper — Adds a download button directly below the YouTube video player.

These extensions work by intercepting the video streams as the page loads. They are simpler than command-line tools, but they can break when YouTube updates its delivery system. Use them for quick downloads, but keep yt-dlp as your fallback.

If you cannot install software and cannot use browser extensions, web-based services work as a last resort. Use these with caution. They are third-party sites, and you should never enter any personal credentials.

y2mate.com — Paste the video URL, select format, download.
savefrom.net — Paste the URL, click download.
9xbuddy.com — Similar functionality.

These sites are functional but often filled with ads and pop-ups. Use an ad blocker. Do not click anything that asks you to install software. The download link is usually a small text button after processing.

Part 6: Email Extraction from Channels

YouTube channels often list a business inquiry email in the About section. This email is public and intended for contact, but for an investigator, it is a direct attribution link.

To find it, go to the channel’s About tab. Look for a section labeled “For business inquiries” or “Details.” The email is displayed there if the channel owner added one.

Once you have the email, run it through your Module 3 email intelligence workflow. Search it on breach databases. Check social media platforms. Cross-reference it against LinkedIn, GitHub, and forums. A YouTube channel email is often the same email used to register accounts across the web.

Part 7: Geolocation from YouTube Content

YouTube videos can reveal location through intentional tags and unintentional background details.

Geotags

Some videos include a location tag set by the uploader. This is visible on the video page below the title, next to the view count. It might say something like “Recorded at Central Park, New York.” This is self-reported and may be inaccurate, but document it anyway.

Background Analysis

Apply the image geolocation techniques from Module 2. Watch the video frame by frame using the comma (,) and period (.) keys to move backward and forward one frame at a time. Look for:

Storefronts and business names.
Street signs and road markings.
License plates.
Distinctive architecture or landmarks.
Language on signs and posters.
Vegetation and climate indicators.

Screenshot key frames. Run them through reverse image search. Plot confirmed locations on a map. One video can reveal where a person lives, works, and spends their free time.

Part 8: Cross-Platform Attribution

The YouTube @handle is often reused on other platforms. Search the handle on Twitter, Instagram, Reddit, GitHub, and TikTok. Search the channel name as a plain text string in Google with quotes.

The channel description links are direct bridges. If the channel links to a Twitter profile, an Instagram account, or a personal website, each of those is a new investigation path.

The email you extracted from the About tab is a pivot point. Search it everywhere.

The visual content of the videos themselves can bridge platforms. If a YouTube video shows the same room, same face, or same event as an Instagram post, you have a connection. Screenshot both. Document the correlation.

Part 9: Practical Investigation Workflow Summary

Open the channel. Document the name, handle, description, creation date, and subscriber count.
Extract the Channel ID from the page source or using the API.
Click the About tab. Copy the description, business email, location, and external links.
Run the channel through https://mattw.io/youtube-metadata/ for structured data.
Open individual videos. Extract the video ID, upload timestamp, tags, and description.
Download thumbnails using the img.youtube.com/vi/[VIDEO_ID]/ pattern.
Download subtitles using yt-dlp --write-subs for text analysis.
Analyze video frames for geolocation clues.
Extract emails from the About tab and page source.
Cross-reference the handle, email, and external links across all other platforms.
Preserve everything. Screenshots, downloaded videos, metadata exports, and your investigation notes.

Part 10: Quick Reference

Objective________________Method

Channel ID extraction: View Page Source → search for externalId or channelId
Structured metadata:https://mattw.io/youtube-metadata/
Thumbnail download: https://img.youtube.com/vi/[VIDEO_ID]/maxresdefault.jpg
Video download:yt-dlp [URL]
Subtitle download:yt-dlp --write-subs --sub-langs all [URL]
Email extraction: About tab → Details section → or search page source for @gmail.com
Geolocation analysis: Frame-by-frame review, reverse image search on screenshots
Cross-platform search: Search @handle and email on Twitter, Instagram, Reddit, GitHub

This is YouTube investigation. Not just watching videos. Extracting hard data, mapping connections, and building attribution from the content people publish to the world. Master this, and every YouTube channel becomes an intelligence source.

Lecture 4.8: Telegram OSINT — Investigating the Encrypted Messenger

Telegram is not just a messaging app. It is a massive ecosystem of public channels, groups, and bots. People share files, discuss topics openly, run businesses, and build communities, all on a platform that most investigators ignore because they think it is too private.

Yes, Telegram offers end-to-end encryption for secret chats. But public channels and groups are not encrypted. They are open. They are indexed. They are searchable. And they contain a staggering amount of intelligence for anyone who knows how to look.

This lecture covers every practical technique you need to find channels, extract user data, map networks, recover deleted content, and use Telegram’s own infrastructure against itself for intelligence collection.

Part 1: Understanding Telegram’s Structure

Before you start any investigation, you need to understand how Telegram organizes its content. There are four types of entities you will encounter.

Users are individual accounts. Each has a unique numeric ID, a username (optional), a display name, and a phone number (hidden unless shared). The username, if set, is public and searchable.

Groups are private or public chat spaces. Public groups have a username and can be joined freely. Private groups require an invite link. Group members are visible to all members.

Channels are one-way broadcast tools. The channel owner posts content. Subscribers read it. Channels can be public (searchable, joinable) or private (invite only). Public channels are indexed by Telegram’s search and external tools.

Bots are automated accounts that perform functions. Investigative bots can pull user data, download channel content, generate invite links, and more.

The key insight is this: public channels and groups are not private. They are broadcast platforms and open forums. Treat them as such.

Part 2: Account and User Reconnaissance

You encounter a Telegram username. It looks like @targetuser. Before you do anything else, document what is visible.

Open Telegram. In the search bar at the top, type the username. If the account is public, the profile appears. You will see:

Display Name: The name the user chose. This may be real or fake. Document it either way.
Username: The @handle. This is your primary identifier.
Bio: Free-text description. Users often list other social media handles, contact emails, or personal details here. Copy every word.
Phone Number Visibility: If the user has chosen to make their number visible, it appears here. This is rare, but when it happens, it is gold.

If the account does not appear in search, the user has either set their account to private, hidden their username from search, or blocked you. That is intelligence in itself.

Part 3: User ID Extraction — The Permanent Anchor

Every Telegram account is assigned a permanent numeric User ID at creation. This ID never changes. The username can change. The display name can change. The phone number can change. The User ID remains the same for the life of the account.

For an investigator, this is the anchor. If a target changes their @handle from @targetuser to @newhandle, you lose them if you are tracking by username alone. But if you extracted the numeric ID, you can verify the new handle belongs to the same account.

The User ID also appears in message metadata, forwarded messages, and bot responses. When you scrape a channel and see the same numeric ID appearing across different usernames over time, you know it is the same person operating under different aliases.

Here are the methods to extract it.

Method 1: @userinfobot

Search for @userinfobot in Telegram. Start a chat. Forward any message from the target user to the bot. It responds with:

User ID: 123456789
First Name: John
Username: @targetuser

The numeric User ID is now yours. Copy it. Store it.

Method 2: Get Chat_ID & User_ID

This bot returns the raw JSON data for any message, user, or channel you forward to it. Search for Get Chat_ID & User_ID. Forward a message from the target. The bot replies with a JSON dump that includes the sender’s full profile data.

Look for:

“from”: {
    “id”: 123456789,
    “first_name”: “John”,
    “last_name”: “Doe”,
    “username”: “@targetuser”
}

The id field is the numeric User ID. This is the most complete user data you can pull from a single bot interaction.

Method 3: @getidsbot

Search for @getidsbot. Start a chat. Forward a message from the target. The bot returns the User ID, chat ID, and message ID in one clean response. It is fast and straightforward.

Why the User ID Matters

Here is exactly how the User ID adds value in real investigations.

Tracking Through Username Changes: A target uses @hackerx. You extract the User ID: 987654321. Three months later, @hackerx disappears. The account now goes by @securityresearcher. You forward a message from the new handle to @userinfobot. The bot returns the same User ID: 987654321. Confirmed. Same account. Same person. The name change did not fool you.
Cross-Referencing Across Groups: A user appears in multiple public groups under different usernames. You extract the User ID from messages in each group. The IDs match. You now know these separate personas belong to one individual. The usernames were a distraction. The ID told the truth.
Linking to Other Data Sources: Some data breaches and leaked databases include Telegram User IDs alongside email addresses and phone numbers. Having the numeric ID lets you search those datasets with precision. If a breach contains User ID 123456789 tied to johndoe@gmail.com, you just linked an anonymous Telegram account to a real email address.
Automated Monitoring: You can write scripts using Telethon that monitor a User ID for activity. Even if the username changes, the script tracks the ID. When the target joins a new group, posts in a channel, or changes their profile, you get an alert. The ID is the constant that makes long-term monitoring possible.

Workflow Rule: Every time you encounter a new Telegram account, extract the numeric User ID immediately. Store it alongside the current username and the date of extraction. The username is temporary. The ID is forever.

Part 4: Phone Number Discovery

Telegram accounts are tied to phone numbers. The number is private by default, but several techniques can reveal it or confirm it.

Method 1: Contact Sync Exploitation

This is the most well-known technique. Telegram allows users to sync their phone contacts with the app. If you add a phone number to your phone’s contacts and that number is registered on Telegram, the account appears in your Telegram contacts list.

Create a sock puppet Telegram account. Save the target phone number to your device contacts under a fake name. Open Telegram. Navigate to Contacts. If the number is registered on Telegram, the account appears with its display name, username, and profile picture. You just confirmed the phone number is tied to that account.

This does not notify the target. It is passive. But do this only from a properly maintained sock puppet, never from your personal device.

Method 2: WHOIS Lookup on Linked Domains

If the target lists a website in their Telegram bio, run a WHOIS lookup on that domain. The registrant’s phone number may be in the WHOIS record. Cross-reference it using Method 1.

Method 3: Cross-Platform Leakage

Many users link their Telegram account to other platforms. Check the target’s Twitter bio, Instagram bio, Facebook About section, and personal website for a Telegram link. If they publicly connect their Telegram to a named account elsewhere, they have just bridged the anonymity gap.

Part 5: Channel and Group Intelligence

Public channels and groups are searchable. You can find them through Telegram’s internal search, Google dorks, and specialized indexing services.

Telegram Internal Search

Open Telegram. Tap the search bar. Type a keyword. Telegram returns matching users, groups, and channels. This is the most direct method. It is limited to what Telegram chooses to show you, but it is fast.

Google Dorks for Telegram

Telegram channels have public web previews. Google indexes these pages.

Use these dorks to find channels and groups by keyword:

site:t.me “keyword”
site:t.me “gmail.com”
site:t.me “location”
site:t.me “phone”

To find channels related to a specific topic:

site:t.me “osint” channel
site:t.me “cybersecurity” channel

To find invite links shared publicly:

site:t.me “joinchat”
site:t.me “+”

The t.me/+ prefix is used for private group invite links. If someone shared a private invite link publicly on a website, forum, or social media, Google indexes it. This is how you find supposedly private groups.

Specialized Telegram Search Engines

Several third-party services index Telegram channels and make them searchable outside the app.

Telegago: https://cse.google.com/cse?cx=006368593537057042503:efxu7xprihg — A Google Custom Search Engine specifically for Telegram.
Telemetr.io: https://telemetr.io — Channel analytics, search, and statistics. Find channels by keyword, see subscriber growth, and view top posts.
TGStat: https://tgstat.com — Another channel analytics platform with search, rankings, and post discovery.
TelegramDB: https://telegramdb.org — A searchable database of public Telegram channels and groups.

Use these tools when Telegram’s internal search is insufficient or when you need to discover channels by topic rather than exact username.

Part 6: Message and Content Scraping

Once you find a channel or group, you need to collect its content. Manual scrolling is slow. Automated tools are faster.

Method 1: Telethon (Python Library)

Telethon is a Python library that interacts with Telegram’s API. It requires a Telegram account and an API key from my.telegram.org. Set up a sock puppet account, get your API credentials, and install Telethon:

pip install telethon

Then use a simple script to download messages from a channel:

from telethon import TelegramClient

api_id = YOUR_API_ID
api_hash = ‘YOUR_API_HASH’

client = TelegramClient(’session_name’, api_id, api_hash)

async def main():
    channel = await client.get_entity(’@channelname’)
    messages = await client.get_messages(channel, limit=1000)
    for message in messages:
        print(message.sender_id, message.date, message.text)

with client:
    client.loop.run_until_complete(main())

This downloads the last 1,000 messages from the channel, including sender IDs, timestamps, and message text. Adjust the limit as needed. The sender_id is the numeric User ID discussed in Part 3, which means you can track users across username changes directly from your scraped data.

If you are new to Telethon and want a full walkthrough from setup to execution, John Hammond has a practical video guide that covers everything step by step:

Quick Help: How to Scrape Telegram with Python:

Watch it. Follow along. You will have a working scraper in under thirty minutes.

Method 2: Export Chat via Telegram Desktop

If you have access to a group or channel, Telegram Desktop allows you to export the entire chat history. Open Telegram Desktop. Go to the channel or group. Click the three-dot menu. Select “Export chat history.” Choose the data you want to export (messages, photos, videos). Telegram generates a JSON or HTML file with the complete history.

This is useful for preserving evidence from a group you have already infiltrated.

Part 7: Bot-Assisted Investigation

Telegram bots are automated tools built into the platform. Many are designed for investigation.

User Information Bots

@userinfobot: Returns user ID, first name, last name, and username.
@Get Chat_ID & User_ID: Returns full JSON profile data for any forwarded message.
@getidsbot: Returns user ID, chat ID, and message ID.
@tgscan_bot: Takes a username and returns related accounts, shared groups, and profile history.

Channel and Group Analysis Bots

@ChannelActivityBot: Analyzes channel engagement and subscriber activity.
@telebrezebot: Checks if a specific username appears in any public channel or group.
@TgStatBot: Provides channel statistics, growth trends, and post analytics.

Search and Discovery Bots

@telescoper_bot: Searches for users across Telegram by username, name, or phone number (if public).
@SangMataInfo_bot: Tracks username changes. Enter a username, and the bot shows previous usernames associated with that account. This is how you discover a target’s old handles.

Email and Data Leak Bots

@mailsearcher_bot: Searches for an email address across Telegram’s public channels and groups. If the email appears in any message, the bot finds it.
@UniversalSearchBot: General keyword search across Telegram’s public content.

Use these bots from your sock puppet account. Never from your personal account.

Part 8: Browser Extensions for Telegram Investigation

Telegago Custom Search Engine

Telegago is a Google CSE that indexes Telegram content. Add it to your browser as a custom search engine, or visit the link directly. Use it to search Telegram without opening the app.

URL: https://cse.google.com/cse?cx=006368593537057042503:efxu7xprihg

Save Telegram (Extension)

The Save Telegram browser extension adds a download button to Telegram Web for photos, videos, and documents. Install it, open Telegram Web, and download channel media with one click.

Chrome: https://chromewebstore.google.com/detail/save-telegram

Firefox: https://addons.mozilla.org/en-US/firefox/addon/save-telegram/

TG Content Downloader — Telegram Downloader

This browser extension is specifically designed for bulk downloading content from Telegram channels and groups. Unlike Save Telegram which handles individual files, TG Content Downloader allows you to select multiple messages and download all attached media at once.

Install the extension from your browser’s extension store. Open Telegram Web. Navigate to the target channel or group. The extension adds download buttons next to each message containing media. Click to download individual files, or use the bulk selection feature to queue multiple downloads. Photos, videos, documents, voice messages. All saved to your local machine with original filenames and timestamps.

Chrome: https://chromewebstore.google.com/detail/tg-content-downloader

Important Note on Operational Security

All browser extensions for Telegram Web require you to be logged into a Telegram account. Use your sock puppet account for this. Never log into Telegram Web with your personal account while running investigative extensions. Keep your investigation environment separate, just as you would for any other platform.

Part 9: Geolocation from Telegram Content

Telegram allows users to share their live location or static location pins. In public groups and channels, these are visible to all members.

When you encounter a location pin, click it. Telegram opens a map view. The coordinates are visible in the URL when opened in Telegram Web or by inspecting the element.

Users also post geolocatable images. Apply the techniques from Module 2. Look for background landmarks, street signs, and business names in photos shared on channels. Screenshot them. Run reverse image search. Cross-reference with satellite imagery.

Part 10: Practical Investigation Workflow Summary

Search the target username in Telegram. Document the display name, bio, and any linked accounts.
Forward a message from the target to @userinfobot or @GetChatID&UserIDBot to extract the numeric User ID.
Run the username through @SangMataInfo_bot to discover previous usernames.
Search the username on Google with site:t.me "username" to find public mentions.
Use Telemetr.io and TGStat to find channels the target owns or participates in.
Use Telegago to search for the target’s username, email, or phone number across indexed Telegram content.
If the target lists a website, run a WHOIS lookup for contact details.
Scrape relevant channels using Telethon or snscrape to collect message history.
Download shared media. Analyze images for geolocation clues.
Cross-reference the username, email, and phone number against other platforms.
Document everything. Save screenshots, exported chat histories, and bot responses.

Part 11: Quick Reference

Objective_______________Method/Tool

Extract User ID:@userinfobot, @GetChatID&UserIDBot, @getidsbot
Find previous usernames:@SangMataInfo_bot
Search Telegram via Google@:site:t.me "keyword"
Custom search engine: Telegago CSE
Channel analytics:telemetr.io, tgstat.com
Message scraping: Telethon (Python)
Email search in channels:@mailsearcher_bot
Phone number confirmation: Contact sync technique via sock puppet
Channel export: Telegram Desktop → Export chat history
Username cross-reference:@tgscan_bot, @telebrezebot

Lecture 4.9: TikTok OSINT — Investigating Short-Form Content

TikTok has over a billion active users. It is not just dance videos. People post their locations, their homes, their workplaces, their opinions, and their relationships. They do it in short, digestible clips that most investigators scroll past without a second thought.

That is a mistake.

TikTok videos contain geolocatable backgrounds, exposed personal details, and links to other platforms. TikTok profiles carry usernames that are often reused across Instagram, Twitter, and YouTube. TikTok bios include email addresses and external links. Ignoring TikTok means leaving a massive source of behavioral data untouched.

This lecture walks you through every practical technique for investigating TikTok profiles and content. No theory. Just what works.

Part 1: TikTok Profile Structure — What Is Publicly Visible

Before you touch any tool, understand what TikTok gives you for free on any public profile.

Open a TikTok profile in your browser. No login required for public accounts. You will see:

Username: The @handle. Often reused across platforms. Your first pivot point.
Display Name: Can be different from the username. May contain a real name or alias.
Bio: Up to 80 characters. Users frequently list other social media handles, contact emails, or personal details here. Copy every word.
Profile Picture: The circular avatar. You can open it in a new tab and save the full-resolution version for reverse image search.
Following Count: Number of accounts this profile follows.
Follower Count: Number of accounts following this profile.
Like Count: Total likes across all videos. This is public even if individual liked videos are private.
Video Count: Total number of videos posted.
Pinned Video: The video the user chose to feature at the top of their profile. This is what they want you to see first.
External Links: Any URL in the bio. This may lead to a Linktree, personal website, YouTube channel, or Instagram profile. Each is a new investigation path.

Document all of this before you go deeper. Screenshot the profile. Save the profile picture. Copy the bio. This is your baseline.

Part 2: Extracting the Numeric TikTok User ID using View Page Source

Every TikTok account has a unique, unchangeable numeric User ID. The username can change. The display name can change. The User ID stays the same forever.

Open the target TikTok profile. Right-click on the page background and select “View Page Source.” Press Ctrl + F and search for “userInfo”: . You are looking for a line that looks like:

“userInfo”:{”user”:{”id”:”6345820253489857518”

That number is the numeric User ID. It is globally unique. Copy it. Store it.

Part 2 (Addendum): Finding a TikTok User-ID with Comment Picker — No Source Code Required

If you want the User ID without touching the page source, use Comment Picker’s TikTok ID tool.

Go to: https://commentpicker.com/tiktok-id.php

Enter the target TikTok @username. Click the button. The tool returns the numeric User ID instantly.

This is the fastest method. No page source. No inspect element. No console. Just type the username and get the ID. Use this when you need quick results across multiple profiles without the technical overhead.

Part 3 (Addendum): Resolving the Numeric User ID to a Username — The URL Pivot

You extracted a numeric User ID. Now you need to know what username it currently belongs to. TikTok does not let you search by ID in the app, but the platform resolves IDs internally. Here is how to use that.

TikTok structures its sharing URLs to accept either the username or the numeric ID. Paste this directly into your browser:

https://www.tiktok.com/share/user/target_user_id

Replace the target_user_id with the User-ID you extracted.

If the account is active and public, TikTok’s web server automatically redirects this URL to the target’s current handle. Your address bar will change to:

https://www.tiktok.com/@username

You now have the current username. If the account has changed handles multiple times, this URL still resolves to the latest one. The numeric ID is the anchor. This URL proves it.

Why This Matters

If you stored a numeric User ID from an investigation months ago and the target has changed their username, these methods still find them. The handle changes. The ID does not. This is how you track a TikTok account through rebranding.

Part 3: Finding the Account Creation Date

TikTok does not display the account creation date publicly. But you can find it.

Method 1: First Video Upload Date

Scroll to the very bottom of the profile’s video list. The oldest video gives you an approximate creation date. If the first video was posted in March 2020, the account was created around that time. This is not exact but it is a solid estimate.

Method 2: Comment Picker — Instant Creation Timestamp

Comment Picker, the same tool used for User ID extraction, also returns the exact account creation timestamp. No source code required.

Go to: https://commentpicker.com/tiktok-id.php

Enter the target TikTok @username. Click the button. Alongside the numeric User ID, the tool displays the account creation date in a readable format.

This is the fastest method. You get the User ID and the creation date in one step. Document both. The creation timestamp is a temporal anchor. You can cross-reference it against account creation dates on other platforms to build correlation. An account created on TikTok in March 2020 and an Instagram account with the same handle created in February 2020 is a strong link.

Part 4: Downloading Videos Without Watermarks

TikTok stamps every video with a watermark showing the username. For investigation, you want the clean version. Several methods work.

Method 1: yt-dlp (Recommended)

yt-dlp downloads TikTok videos without watermarks in the highest available quality.

Install:

pip install yt-dlp

Download a single video:

yt-dlp https[:]//www.tiktok.com/@username/video/123456789

Download all videos from a profile:

yt-dlp https://www.tiktok.com/@username

Download with metadata:

yt-dlp --write-info-json https://www.tiktok.com/@username

Each video saves alongside a JSON file containing the caption, hashtags, upload timestamp, and music used.

Method 2: Online Downloaders

If you cannot install yt-dlp, use a web-based tool:

snaptik.app — Paste the video URL. Downloads without watermark.
ttdownloader.com — Similar functionality.
https://tikinsights.com/tools/parse — Similar functionality.

These work for individual videos. For bulk collection, yt-dlp is the only practical option.

Part 5: Extracting Video Thumbnails via Inspect Element

Every TikTok video has a thumbnail image. You can extract it without any third-party tools.

Step 1: Open the Target Profile

Navigate to the TikTok profile you are investigating. Scroll until you find the video whose thumbnail you want.

Step 2: Open Inspect Element

Right-click on the page background, away from any video or button. Select “Inspect” or “Inspect Element” from the menu. The browser’s Developer Tools panel opens.

Step 3: Activate the Element Selector

Look at the top left corner of the Developer Tools panel. You will see a small icon that looks like a dotted square with a cursor arrow. This is the element selector tool. Click it once. Your cursor is now in inspection mode.

Step 4: Click on the Target Video

Move your cursor over the video whose thumbnail you want. Click on the video. The Developer Tools panel jumps to the specific line of HTML that renders that video element.

Step 5: Locate the Thumbnail URL

Look for an img tag or a div element with a style attribute containing a background-image property. The thumbnail URL will be embedded there. It will look something like:

Or:

Step 6: Copy and Open the URL

Click on the URL inside the HTML to select it fully. Copy it. Open a new browser tab. Paste the URL into the address bar. Press Enter.

The thumbnail image loads in full resolution. Right-click on the image and select “Save image as” to save it to your investigation folder.

Why Thumbnails Matter

The thumbnail is the frame the uploader chose to represent their video. It often shows the most important visual element. A face. A location. A document. A product. You can run the thumbnail through reverse image search without downloading the entire video. This saves time and bandwidth while still producing intelligence.

Part 6: Extracting Video Metadata

Every TikTok video carries metadata. Extracting it gives you timestamps, hashtags, and music data.

Method 1: Page Source Extraction

Open the video page. Right-click on the page background and select “View Page Source.” Press Ctrl + F and search for createTime or create_time. You will find a Unix timestamp:

“createTime”:”1692123456”

Copy that number. Go to epochconverter.com. Paste the number into the input field. The tool converts it to a human-readable date and time in UTC. This is the exact moment the video was uploaded.

Method 2: Bellingcat TikTok Timestamp Tool (Works Even If the Video Is Deleted or Private)

If the page source method does not return a timestamp, or if the video has been deleted, set to private, or you are blocked by TikTok’s web firewall, use the Bellingcat tool.

TikTok embeds the Unix generation time directly into the binary bits of every Video ID using a Snowflake structure. This means the timestamp is mathematically encoded in the video URL itself. You do not need to access TikTok’s servers to extract it.

Tool: Bellingcat TikTok Date Extractor

Link: https://bellingcat.github.io/tiktok-timestamp

How to use:

Copy the full TikTok video URL from your browser. Example:

https[:]//www.tiktok.com/@username/video/7234567890123456789

2. Paste the URL into the input field on the Bellingcat tool.

3. Click “Get uploaded date.”

The tool mathematically decodes the bits embedded in the Video ID and returns the exact upload timestamp down to the second in UTC. No API calls. No authentication. No connection to TikTok’s servers. It works entirely in your browser.

Method 3: Manual Mathematical Breakdown — Understanding the Snowflake ID

If you want to understand what the Bellingcat tool is doing under the hood, or if you want to decode a timestamp manually without any tools, here is the step-by-step mathematical process.

Every TikTok Video ID is a 64-bit Snowflake integer. The first 31 bits of that integer encode the timestamp. The remaining 33 bits encode sequence data. By isolating the first 31 bits and converting them back to decimal, you get the Unix timestamp in seconds.

Step 1: Convert the Video ID to Binary

Take the numeric Video ID from the URL. For example:

7248147125599859971

Convert this decimal number to its 64-bit binary representation using a conversion tool.

Go to: https://www.rapidtables.com/convert/number/decimal-to-binary.html

Paste the Video ID into the input field. Click “Convert.” The tool returns the binary equivalent:

0110010010010111110111000101010001101101...

Step 2: Isolate the First 31 Bits

The Snowflake structure dictates that the oldest bits, the ones on the far left, hold the time data. Slice out the first 31 characters of that binary string:

Full 64-bit string: 0110010010010111110111000101010001101101...

First 31 bits extracted: 0110010010010111110111000101010

Step 3: Convert the 31-bit Binary Back to Decimal

Take that isolated 31-bit string and convert it back into a standard base-10 integer:

Binary: 0110010010010111110111000101010

Decimal Result: 1687698986

Step 4: Translate the Unix Timestamp

The resulting integer 1687698986 is a standard Unix timestamp, the number of seconds that have elapsed since January 1, 1970.

When you parse 1687698986 through a standard calendar converter like epochconverter.com, it outputs exactly:

Greenwich Mean Time (GMT): Sunday, June 25, 2023, 13:16:26 UTC

Why These Methods Matter

The timestamp is extracted from the Video ID itself, not from TikTok’s servers.
It works even if the video has been deleted.
It works even if the account is private.
It works even if TikTok’s web firewall has blocked you.
You get an exact UTC timestamp you can use in timelines and reports.

From yt-dlp JSON Output

When you use yt-dlp --write-info-json, the resulting JSON file contains additional metadata:

upload_date — Exact date in YYYYMMDD format.
timestamp — Unix timestamp.
description — Full video caption.
hashtags — Every hashtag used.
track — Music or sound used.
duration — Video length in seconds.

Read the JSON file directly or parse it with a script. Every field is intelligence.

Part 7: Geolocation from TikTok Videos

TikTok does not have built-in location tags like Instagram. But videos reveal location through content.

Background Analysis

Apply the same geolocation techniques from Module 2. Look at:

Storefronts and business names visible in the background.
Street signs, license plates, and road markings.
Distinctive architecture, landmarks, and skylines.
Language on signs, posters, and product labels.
Vegetation and climate indicators.

Pause the video. Use the comma (,) and period (.) keys to move frame by frame in a browser or media player. Screenshot key frames. Run them through Google Lens and Yandex Images.

Stitching and Duet Locations

TikTok’s Stitch and Duet features let users respond to other videos. The original video may have been filmed in one location. The response may show a different one. Compare backgrounds. You may find two locations connected through a single interaction.

Location Clues in Captions and Hashtags

Users tag locations in captions even without a formal geotag. Search captions for city names, neighborhood names, and venue names. Hashtags like #LondonLife or #NYC are self-reported but still useful as leads.

Part 8: Finding Linked Accounts from TikTok Bios

TikTok bios often contain links to other platforms. These are direct attribution bridges.

Direct Links

Click any link in the bio. It may go to:

A Linktree or Beacons page listing multiple social media accounts.
A YouTube channel.
An Instagram profile.
A personal website.
A business page.

Each destination is a new platform to investigate. Document every link.

Username Cross-Reference

If the TikTok bio says “IG: @sameusername,” go to Instagram and check that handle. If it exists and the content matches, you have a cross-platform connection. Do the same for Twitter, YouTube, and Snapchat. TikTok users frequently reuse handles.

Profile Picture Reverse Search

Download the TikTok profile picture. Run it through Google Lens and Yandex Images. If the same image appears on LinkedIn, Twitter, or a forum, you have another cross-platform link. This is how you connect an anonymous TikTok account to a named profile elsewhere.

Part 9: Analyzing Hashtag Participation for Network Mapping

Hashtags group content by topic. They also group people.

Finding Related Accounts

Click on a hashtag the target uses. TikTok shows all public videos with that tag. Browse the videos. Look for other accounts posting similar content. These are potential associates, collaborators, or members of the same community.

Tracking Hashtag Campaigns

If a target participates in a hashtag campaign, search that hashtag across platforms. A hashtag used on TikTok may also appear on Instagram, Twitter, and YouTube. This reveals cross-platform activity and a wider network of participants.

Part 10: TikTok-Specific Search Operators and Dorks

TikTok has an internal search bar, but Google indexes TikTok content too.

Google Dorks for TikTok

site:tiktok.com “username”

site:tiktok.com “@username”

site:tiktok.com “username” “gmail.com”

site:tiktok.com “username” “instagram”

These find TikTok profiles, mentions in video descriptions, and any email addresses or social media handles publicly listed.

TikTok Internal Search

Use TikTok’s search bar. Type a username, a hashtag, or a keyword. TikTok returns accounts, videos, sounds, and hashtags. This is the most direct way to find content by topic.

Searching by Sound

Every TikTok video uses a sound. Click on the sound from any video. TikTok shows every other video using that same audio. This is how you find all content within a trend or audio meme. If a target uses a specific sound, browse the other videos using it. You may find associates or discover additional accounts operated by the same person.

Part 11: Practical Investigation Workflow Summary

Open the TikTok profile. Document the username, display name, bio, follower count, following count, like count, and video count.
Extract the numeric User ID from the page source or console.
Estimate the account creation date from the oldest video or cross-reference with other platforms.
Download the profile picture. Save it. Run it through reverse image search.
Click every link in the bio. Document all external platforms.
Download key videos using yt-dlp. Save metadata with --write-info-json.
For bulk collection, run yt-dlp https://www.tiktok.com/@username.
Extract video metadata: upload timestamps, captions, hashtags, and music.
Analyze video frames for geolocation clues. Screenshot and reverse search key frames.
Search the username on Google with site:tiktok.com "username".
Cross-reference the username, profile picture, and linked accounts across Instagram, Twitter, YouTube, and other platforms.
Document everything. Screenshots, downloaded videos, metadata files, and your analysis.

Part 12: Quick Reference

Objective______________Method

Extract User ID: View Page Source → search for id or use commentpicker.com/tiktok-id.php
Resolve User ID to username:https://www.tiktok.com/share/user/[ID]
Find account creation datecommentpicker.com/tiktok-id.php or oldest video estimate
Download single video:yt-dlp [video URL]
Download all videos from profile:yt-dlp https://www.tiktok.com/@username
Extract video metadata:yt-dlp --write-info-json
Extract upload timestamp from Video IDPage source (createTime), bellingcat.github.io/tiktok-timestamp, or Python script using >> 33
Download video thumbnail: Inspect Element → element selector → click video → copy image URL
Profile picture extraction: Right-click → Open image in new tab → Save
Frame-by-frame video analysis: Period (.) forward, Comma (,) backward in browser or E key in VLC
Reverse image search: Google Lens, Yandex Images, TinEye, Bing Images
Find linked accounts: Bio links, username cross-reference across platforms
Hashtag network mapping: Click hashtag → browse videos using same hashtag
Google dork for TikTok:site:tiktok.com "username"

This is TikTok OSINT. Not scrolling endlessly. Systematic extraction of identifiers, timestamps, thumbnails, video frames, and connections from the platform everyone underestimates. Master this, and you add a billion-user intelligence source to your toolkit.

Lecture 4.10: Bluesky OSINT — Investigating the Decentralized Network

Bluesky is the new player in the social media landscape. Built on the AT Protocol, it looks like Twitter but works differently under the hood. It is decentralized. It is open. And because it is built by developers who value transparency, it exposes far more data through public APIs and page source than most platforms ever have.

For an investigator, Bluesky is a gift. User IDs are permanent and publicly accessible. Account creation dates are embedded in the page source. Posts are indexed and searchable. Images are easy to extract. The platform was designed for openness. Your job is to use that openness for intelligence gathering.

This lecture covers everything from basic profile reconnaissance to advanced image extraction. Every technique is practical. Every method works today.

Part 1: Understanding Bluesky’s Structure

Bluesky uses the AT Protocol, which is fundamentally different from Twitter’s architecture.

Key concepts:

DID (Decentralized Identifier): Every user has a unique DID that looks like did:plc:abcdef123456. This is the permanent identifier. The handle can change. The DID never does.
Handle: The username people see, like @username.bsky.social. Users can also set custom domain handles like @username.com. Handles can change. DIDs cannot.
PDS (Personal Data Server): Where user data is stored. The platform is decentralized, so data lives on different servers.
Public API: Bluesky’s API is open. No authentication required for public data. This makes automated collection straightforward.

Part 2: Profile Reconnaissance — The Surface Level

Start with what is visible on the profile page.

Open the target’s Bluesky profile in your browser:

https://bsky.app/profile/username.bsky.social

Document everything:

Display Name: May contain a real name or alias.
Handle: The @username. Often reused across platforms.
Bio: Free-text description. Users list other social media handles, contact emails, locations, and affiliations here. Copy every word.
Banner Image: The header image at the top of the profile.
Profile Picture: The avatar.
Follower Count: Number of accounts following the target.
Following Count: Number of accounts the target follows.
Post Count: Total number of posts.
Pinned Post: The post the user chose to feature. This is what they want you to see first.
Joined Date: Sometimes displayed on the profile. If not visible, you will extract it from the page source.

Screenshot everything. This is your baseline.

Part 3: User ID Extraction — The DID

Every Bluesky account has a DID. It looks like did:plc:abcdef123456. This never changes. The handle can change. The DID is permanent. Extract it.

Method 1: Page Source

Open the target profile. Right-click on the page background. Select “View Page Source.” Press Ctrl + F and search for did:plc:. You will find a line like:

content=”did:plc:abcdef123456”

That is the DID. Copy it. Store it.

Method 2: The DID Resolver

Every Bluesky DID resolves to a DID document that contains the account’s public metadata. Open your browser and navigate to:

https://plc.directory/did:plc:abcdef123456

Replace the DID with the one you extracted. The page returns a JSON object containing the handle, the public signing key, and the PDS endpoint. This is the technical backbone of the account. Document everything.

Method 3: Third-Party Tools

PDSls at https://pdsls.dev is a Bluesky directory and search tool. Enter a handle or DID. It returns the account’s DID document, associated records, and metadata. Use it when you need a clean, structured view of the account’s technical profile without digging through raw JSON.

Method 4: Validating the DID via Direct Profile URL

Once you have extracted the DID, you can validate it and navigate directly to the account’s profile by pasting the DID into Bluesky’s profile URL structure:

https://bsky.app/profile/did:plc:yf6hctt2ug3qyfty4in64yob

Replace the DID with the one you extracted. Open the URL in your browser.

If the DID is valid, Bluesky loads the profile page directly. You will see the display name, handle, bio, follower count, and all posts. This confirms the DID is real and resolves to an active account.

If the account has changed its handle multiple times, this URL still resolves to the current profile. The handle may change. The DID never does. This is how you track a Bluesky account through rebranding. Store the DID-based URL alongside the current handle in your investigation file.

Part 4: Account Creation Date Extraction

Bluesky embeds the account creation timestamp in the page source and in the DID document.

Method 1: Page Source

Open the target profile. View Page Source. Search for dateCreated”:. You will find:

“dateCreated”:”2023-05-15T10:30:00.000Z”

This is the exact ISO 8601 timestamp of account creation. Convert it to your local time if needed. This is precise, not an estimate.

Method 2: Analyzing the DID Audit Log

Every Bluesky account is tied to a unique Decentralized Identifier (DID). For accounts using the standard did:plc format, you can uncover a permanent, tamper-proof history of the account, including its exact creation time by querying the public PLC Directory.

Step 1: Locate the DID: Extract the target account’s unique did:plc:... identifier.

Step 2: Access the Audit Log: Insert the target’s DID into the following URL format:

https://plc.directory/[TARGET_DID]/log/audit

Replace [TARGET_DID] with the actual DID you extracted from the target.

Step 3: Review the JSON Payload: Opening this URL returns a public audit log. The very first entry in the JSON array represents the account’s creation (the genesis operation), which includes a server-verified createdAt ISO timestamp:

[
  {
    “type”: “plc_operation”,
    “createdAt”: “2023-05-15T10:30:00.000Z”,
    “alsoKnownAs”: [
      “at://username.bsky.social”
    ],
    “services”: {
      “atproto_pds”: {
        “type”: “AtprotoPersonalDataServer”,
        “endpoint”: “https://bsky.social”
      }
    }
  }
]

This is the same timestamp. It is permanent. It never changes. Document it.

Why This Matters

The creation timestamp is a temporal anchor. Cross-reference it against account creation dates on Twitter, Instagram, GitHub, and other platforms. An account created on Bluesky in May 2023 and a Twitter account created in April 2023 with the same handle is a correlation point. The timestamp builds your attribution case.

OSINT Tip: Because the PLC Directory operates as a public transparency log, this timestamp is cryptographically validated on the server side. It provides an indisputable timeline for when the account was initialized, making it impossible for a user to spoof or hide their true creation date.

Part 5: Bio Analysis and Cross-Platform Attribution

The Bluesky bio is a text field. Users often list other social media handles, contact emails, and personal details here.

What to Look For:

Other platform handles: “IG: @username”, “Twitter: @username”, “GitHub: username”
Email addresses: Rare but sometimes included for business inquiries
Locations: “London”, “NYC”, “Berlin”
Occupations: “Security Researcher”, “Journalist”, “Developer”
Pronouns and personal details

Cross-Referencing the Handle

Take the Bluesky handle. Search it on Twitter, Instagram, TikTok, GitHub, and Reddit. Users who migrate to Bluesky often bring their existing handles with them. A match is a direct platform bridge.

Cross-Referencing the Display Name

Some users use their real name as their display name. Search it on LinkedIn, Facebook, and Google. Cross-reference with other platforms.

Part 6: Banner and Profile Image Extraction

Bluesky stores the banner image and profile picture as publicly accessible URLs embedded in the page source.

Method 1: Page Source

Open the target profile. View Page Source. Search for og:image. You will find:

The content attribute contains the direct URL to the profile banner. Open the URL in a new tab. The full-resolution image loads. Right-click and save.

Method 2: Inspect Element

Right-click on the profile picture or banner image on the profile page. Select “Inspect” or “Inspect Element.” The Developer Tools panel opens, highlighting the HTML that renders that image.

Look for the src attribute within the img tag. It will look like:

Copy the full URL. Open it in a new tab. Save the image at full resolution.

Alternatively, use the element selector tool. Click the dotted square icon at the top left of the Developer Tools panel (Ctrl + Shift + C). Move your cursor over the profile picture or banner. Click on it. The HTML jumps to the correct line. Copy the URL.

Method 3: PDSls

Search the handle on https://pdsls.dev. The tool displays the avatar and banner URLs directly in the profile view. Copy them from there without touching the page source.

What You Do With the Images

Run the profile picture and banner through Google Lens, Yandex Images, and TinEye. If the same image appears on Twitter, Instagram, or LinkedIn, you have a cross-platform attribution bridge. The banner image often contains additional intelligence. A banner showing a city skyline is a location clue. A banner with text may contain contact details or affiliations.

Part 7: Post Analysis — Extracting Timestamps

Every Bluesky post has an exact timestamp. The interface shows relative time (“7mo” for seven months ago). You need the exact timestamp.

Navigate to the target’s profile. Scroll to the post you want to analyze. Click on the relative timestamp, such as “7mo” or “2d.” The page expands to show the exact date and time in a tooltip or by navigating to the post’s detail view. The URL changes to something like:

22:02 · 30 Dec 2025

The full timestamp is displayed on this page. Document it.

Part 8: Extracting Posted Images via Network Tab and Chrome Extension

This technique extracts every image posted by the user in bulk using the browser’s Network tab.

Step 1: Navigate to the target’s Bluesky profile page.

Step 2: Open Developer Tools (F12 or Ctrl + Shift + I). Click the Network tab.

Step 3: In the filter bar, type img to show only image-related network requests.

Step 4: Refresh the page (F5). The Network tab populates with requests.

Step 5: Look for requests to URLs containing cdn.bsky.app/img. These are the user’s posted images. Each image the user has posted that loads on the page appears as a separate request.

Step 6: Scroll down the profile to load more posts. As new posts load, new image requests appear in the Network tab. The more you scroll, the more images populate.

Step 7: To download an image, you can double click on the image request line and it will pop up the image in a new tab. Or simply click on the request line, navigate to “preview” and right-click on the image to save it.

Extracting All Loaded Images at Once

To extract every image currently loaded in the Network tab without downloading them one by one:

Method 1: HAR Export

Step 1: After scrolling to load the desired posts, right-click anywhere inside the Network tab.

Step 2: Select “Save all as HAR with content.” This saves a HAR (HTTP Archive) file containing every request, including all loaded images, as base64-encoded data.

Step 3: Use a HAR viewer or a Python script to extract the images from the HAR file. Save the HAR file and process it offline. Every image that loaded during your session is recoverable.

Method 2: Chrome Extensions for One-Click Downloads

If you prefer a graphical approach without touching the Network tab or console, use a dedicated Bluesky scraper extension.

Bluesky Media Downloader

Install from the Chrome Web Store:

https://chromewebstore.google.com/detail/bluesky-media-downloader/odebdafkpnmipmdangfpfbhdamhdocdb

Navigate to the target profile, click the extension icon, customize your settings, switch to bulk mode, set your max posts per run, and click “Start Bulk Download” — every image saves directly to your machine with no Network tab, no console, and no command line.

Install, click, download. Use this when speed and simplicity are the priority.

Part 9: Using PDSls for Deeper Intelligence

PDSls at https://pdsls.dev is a directory and inspection tool for the AT Protocol. It gives you structured access to account data without touching the page source.

Search by Handle or DID

Enter a Bluesky handle or DID. The tool returns:

The full DID document
Avatar and banner URLs
Associated PDS endpoint
Public records and collections

Browse Account Records

PDSls lets you browse the account’s public records, including posts, likes, and follows. This is API-level access through a clean web interface. No coding required.

Find Related Accounts

Some accounts link to other DIDs through their records. PDSls surfaces these connections. If the target has linked a website domain to their Bluesky account, PDSls shows the verification record. This is a direct bridge to the domain’s WHOIS data and ownership information.

Part 10: Google Dorking for Bluesky

Bluesky profiles and posts are indexed by Google. You can use dorks to find profiles, posts, and public mentions without touching the Bluesky app.

Find Bluesky Profiles by Username or Display Name

site:bsky.app “username”
site:bsky.app “display name”

Find Bluesky Profiles with Specific Keywords in Bio

site:bsky.app “security researcher”
site:bsky.app “osint”
site:bsky.app “investigator”

Find Posts Containing Specific Keywords

site:bsky.app “keyword”
site:bsky.app “email”
site:bsky.app “@gmail.com”

Find Posts from a Specific User

site:bsky.app “username” “keyword”

Find Bluesky Handles Mentioned on Other Websites

“bsky.app” “username”
“@username.bsky.social”
“did:plc:”

This last dork finds pages outside Bluesky where a DID or handle is referenced. It surfaces forum posts, blog comments, and social media bios where the target listed their Bluesky account.

Cross-Engine Search

Run the same dorks on Yandex and Bing. Google indexes Bluesky well, but different engines catch different results. A post invisible to Google may appear on Bing.

Part 11: Practical Investigation Workflow Summary

Open the target Bluesky profile. Document the display name, handle, bio, follower and following counts, and post count.
Google dork the handle and display name. Run site:bsky.app "username" and "@username.bsky.social" across Google, Yandex, and Bing. Find external mentions and indexed posts.
Extract the DID from the page source or PDSls. This is the permanent identifier.
Pull the account creation timestamp from the page source or DID document.
Save the profile picture and banner image. Run them through reverse image search.
Analyze the bio for other platform handles, locations, and contact details.
Cross-reference the handle and display name across Twitter, Instagram, TikTok, GitHub, and LinkedIn.
Click on relative post timestamps to reveal exact dates. Or extract timestamps from the page source.
Use the Network tab to extract all posted images in bulk. Save as HAR for offline processing.
Use Inspect Element to extract individual images with precision.
Run PDSls searches for structured account data and related records.
Document everything. Screenshots, extracted IDs, timestamps, and your analysis.

Part 12: Quick Reference

Objective__________Method

Extract DID (User ID): Page Source → search for did:plc:
Resolve DID to metadata:https://plc.directory/did:plc:...
Account creation timestamp: Page Source → createdAt or DID document
Banner image extraction: Page Source → og:image or Inspect Element
Post timestamp extraction: Click relative time or Inspect Element → datetime
Bulk image extraction: Network tab → filter img → Save as HAR
Structured account data: https://pdsls.dev
Google dork for Bluesky:site:bsky.app "username"
Find external mentions:"@username.bsky.social" or "did:plc:"
Cross-platform handle search: Search handle on Twitter, Instagram, TikTok, GitHub
Reverse image search: Google Lens, Yandex, TinEye

This is Bluesky OSINT. The platform was built for transparency. It gives you permanent identifiers, public APIs, and page source metadata that other platforms hide. Use that openness. Extract the DID. Pull the timestamps. Download the images. Cross-reference everything.

A quick note: nearly every piece of intelligence you gather via View Page Source can also be gathered via Inspect Element. The same data is there. The same URLs. The same timestamps. The same DIDs. If you prefer the visual element selector over searching raw HTML, use Inspect Element. If you prefer scanning the full source at once, use View Page Source. Both paths lead to the same intelligence. Choose whichever works faster for you.

This is what investigation looks like when the platform does not fight back.

Lecture 4.11: Discord OSINT — Investigating the Chat Platform

Discord is not just a chat app for gamers. It is where communities form, where developers collaborate, where activists organize, and where threat actors operate. Servers dedicated to everything from cryptocurrency trading to open source intelligence exist alongside private invite-only groups. People share files, link their other social accounts, and post messages they assume are semi-private.

Most investigators ignore Discord because it feels closed. It is not. Public servers are accessible. User IDs are permanent. Connected accounts are visible. Invite links are indexed. There is intelligence on Discord for anyone willing to look.

This lecture covers every practical technique for investigating Discord users and servers. No theory. Just what works.

Part 1: Understanding Discord’s Structure

Discord is organized differently from other platforms. You need to understand the architecture before you investigate.

Users: Individual accounts. Each has a username, a display name, a numeric User ID, a profile picture, and optional connected accounts.
Servers: Communities that contain channels. Servers can be public (anyone can join via invite link) or private (invite only).
Channels: Text or voice spaces within a server. Messages in public channels are visible to all server members.
Messages: Text, images, files, and links posted in channels. Messages in public servers can be viewed by anyone who joins.
Direct Messages (DMs): Private conversations between users. You cannot access these without compromising an account. Do not try.

The key insight is this: public servers and the users within them leave traces that are visible without authentication.

Part 2: Extracting the Permanent Discord User ID

Every Discord user has a permanent numeric User ID. The username can change. The display name can change. The User ID never does. This is your anchor.

Step 1: Enable Developer Mode

Open Discord. Go to User Settings (the gear icon next to your username). Scroll down to Advanced in the left sidebar. Toggle Developer Mode to ON. This unlocks the ability to copy IDs.

Step 2: Copy the User ID

Navigate to the target user’s profile. You can do this by clicking their name in a server, in a direct message list, or in a friend list. Once on their profile, click the three-dot menu in the top right. Select Copy User ID.

The ID is now on your clipboard. It looks like:

123456789012345678

This is the permanent identifier. Store it.

Step 3: Validate the User ID

Discord has a native URL format that targets a specific User ID. Construct a direct link to the user profile using the web URL format:

https://discord.com/users/USER_ID_HERE

Replace the USER_ID_HERE with the User ID you extracted. Open this URL in your browser.

If the ID is valid, Discord loads a profile card showing the user’s public information: current username, display name, avatar, and badges. You have confirmed the ID is real and resolves to an active account.

If the ID is invalid or the account has been deleted, Discord shows an error or a blank profile.

Alternative: Deep-Link for the Discord App

Using Discord-id-lookup

To open the profile directly in the Discord desktop app instead of a browser:

discord://-/users/USER_ID_HERE

This forces the Discord app to open and display the target’s profile card.

Alternative: Third-Party Lookup

If you want to fetch publicly available profile data outside of Discord entirely, use:

https://discord.id — Set your bot token, paste the User ID. Returns avatar URL, banner URL, creation date, and public flags without opening Discord.
https://www.nicheprowler.com/tools/discord/discord-id-lookup — paste the User ID. Returns avatar URL, banner URL, creation date, and public flags without opening Discord.

Part 3: Finding the Account Creation Date via Snowflake ID

Discord uses the same Snowflake ID structure as TikTok. The User ID encodes the account creation timestamp in its first bits.

Method 1: Discord Lookup Websites

Several websites decode Discord Snowflakes automatically.

Go to https://www.nicheprowler.com/tools/discord/discord-id-lookup — Paste the User ID. The site returns:

Account creation date and time in UTC.
The exact timestamp down to the second.

This is the fastest method. No math required.

Method 2: Manual Snowflake Decoding

Discord Snowflakes do store the time elapsed since Discord’s epoch (January 1, 2015), shifted by 22 bits. To get the exact Unix timestamp in seconds, the mathematically correct formula is:

Step-by-Step How to Do It Properly:

Bit-shift the ID: Right-shift the Discord User ID by 22 bits (or divide it by 4194304 and discard the remainder/decimal). This extracts the milliseconds since Discord’s epoch.
Add the Epoch: Add 1420070400000 (Discord’s epoch in milliseconds) to that number. This gives you the Unix timestamp in milliseconds.
Convert to Seconds: Divide the total by 1000 to get the timestamp in seconds, which you can then paste into EpochConverter.

Let us do this with an actual Discord User-ID:

The Math Breakdown:

Discord Snowflake ID: 357121971798016000
Bitwise Right-Shift ( >> 22): Shifting the binary bits to the right by 22 is mathematically equivalent to dividing the number by 2 raise to power 22 (which is 4,194,304) and discarding any remainder.
357121971798016000 / 4194304 = 85144512061
Add Discord’s Epoch: Now we add Discord’s custom epoch offset (1420070400000 milliseconds).
85144512061 + 1420070400000 = 1505214912061
Convert to Seconds: Divide the resulting Unix millisecond timestamp by 1,000.
1505214912061 / 1000 = 1505214912.061 seconds

The Result:

If you take the integer part — 1505214912—and paste it into epochconverter.com, it will output the exact second the account was created:

GMT: Tuesday, September 12, 2017 11:15:12 AM
Relative Time: September 12, 2017

Method 3: Python Script

You can automate the Snowflake decoding with a simple Python script. No dependencies required.

from datetime import datetime, timezone

snowflake = 123456789012345678
timestamp_ms = (snowflake >> 22) + 1420070400000
timestamp_s = timestamp_ms / 1000
utc_date = datetime.fromtimestamp(timestamp_s, tz=timezone.utc)
print(f”Account created: {utc_date.strftime(’%Y-%m-%d %H:%M:%S UTC’)}”)

Replace “123456789012345678” with the real Discord User ID. The script prints the exact account creation timestamp. This is the permanent temporal anchor for your investigation.

Part 4: Finding Connected Accounts

Discord allows users to link external accounts to their profile. These are visible to anyone who shares a server with the user, and sometimes to anyone who can view the profile.

What Can Be Connected:

Spotify (shows what the user is listening to)
Xbox
Steam
GitHub
Twitter (X)
Reddit
YouTube
Twitch
Battle.net
League of Legends
Epic Games
PayPal (rare)

How to View Connected Accounts

Click on the target’s profile in Discord. Look for linked accounts displayed as icons near their username. Click each icon. Discord opens the connected profile.

A linked Steam account shows their Steam profile URL. A linked GitHub shows their GitHub username. A linked Twitter shows their Twitter handle. Each of these is a direct cross-platform attribution bridge.

Document every connected account. Cross-reference the handles against other platforms.

Part 5: Finding Public Server Invite Links

Public Discord servers are accessible via invite links. These links are shared on social media, forums, Reddit, and websites. Google indexes them.

Google Dorks for Discord Servers

site:discord.gg “keyword”
site:discord.gg “osint”
site:discord.gg “cybersecurity”
site:discord.gg “ukraine”
site:discord.gg “crypto”

Replace keyword with the topic or community you are investigating. Each result is an invite link to a public server.

Find Servers by Username Mentions

“username” site:discord.com
“username#0000” site:discord.com
“@username” site:discord.gg

These find forum posts, blog comments, and social media bios where the target listed their Discord username or a server invite link.

Discord Server Listing Sites

Several websites index public Discord servers:

https://disboard.org — Search by keyword or category. Largest public server directory.
https://discordservers.com — Curated server listings.
https://top.gg — Server discovery with search.

Search for keywords, topics, or community names. Each listing includes an invite link.

Part 6: Server Reconnaissance — What You Can See

Once you join a public server with your sock puppet account, document what is visible.

Server Information

Click the server name at the top. You see:

Server name and description.
Server rules.
Member count (online and total).
Server boost level.
Creation date (visible in the server settings for some servers).

Channel Listing

The left sidebar shows every channel in the server. Channels are organized into categories. Read the channel names and descriptions. They tell you what the community discusses and where sensitive conversations might happen.

Member List

The right sidebar shows all members currently online, organized by role. Roles tell you the server hierarchy. Look for:

Administrators and Moderators: These users control the server.
Custom Roles: Roles with names like “VIP,” “Verified,” “Staff,” or “Contributor” reveal the server’s structure.
Bots: Servers use bots for moderation, music, and automation. Note the bots present. Some bots log messages or provide lookup functionality you can use.

Messages

Scroll through public text channels. Read what people post. Look for:

Personal details shared casually (locations, occupations, relationships).
Links to external profiles (Twitter, GitHub, Instagram).
Files and images that can be downloaded and analyzed.
Pinned messages (important announcements or resources).

Part 7: Extracting Profile Pictures and Banners

Discord profile pictures and server icons are accessible, but right-clicking and copying the image URL no longer works reliably. Discord now loads images dynamically. You need to extract them through the browser’s Developer Tools.

Extracting a User’s Profile Picture

Step 1: Open Discord in your browser at https://discord.com. Log into your sock puppet account. Navigate to the target user’s profile by clicking their name in a server or friend list.

Step 2: Open Developer Tools (F12 or Ctrl + Shift + I). Click the Network tab.

Step 3: In the filter bar, type avatar to show only avatar-related requests.

Step 4: Refresh the page (F5). The Network tab populates with requests.

Step 5: Look for requests to URLs containing cdn.discordapp.com/avatars/. These are the user’s profile pictures. Discord loads multiple sizes. Find the one ending in .png or .webp with the largest file size. That is the full-resolution version.

Step 6: Click on the request. In the Headers tab, copy the full Request URL. Open it in a new browser tab. Right-click and save the image.

Alternative: Filter by Image Type

If filtering by avatar returns too many results, switch to the Img filter instead. This shows only image files. Scroll through the loaded images. Find the ones from cdn.discordapp.com/avatars/. Click and save.

Extracting a Server Icon

The process is identical for server icons.

Step 1: Navigate to the target server in Discord.

Step 2: Open Developer Tools. Go to the Network tab.

Step 3: In the filter bar, type icon or cdn.discordapp.com/icons/.

Step 4: Refresh the page. Discord loads the server icon.

Step 5: Look for requests to URLs containing cdn.discordapp.com/icons/. Click the request. Copy the full URL. Open in a new tab. Save the image.

Alternative: Img Filter

Switch to the Img filter in the Network tab. Every image Discord loaded for that page appears. Find the server icon from the list. Download it.

What You Do With the Images

Once saved, run the profile picture or server icon through:

Google Lens: https://lens.google.com
Yandex Images: https://yandex.com/images
TinEye: https://tineye.com

If the same image appears on Twitter, Instagram, GitHub, or a forum, you have a cross-platform attribution bridge. A server icon that matches a website’s logo links the Discord server to that domain.

Part 8: Google Dorks for Discord Users and Servers

site:discord.com “username”
site:discord.gg “servername”
site:disboard.org “keyword”
“username#0000”
“discord.gg” “keyword”

Run these across Google, Yandex, and Bing. Find forum posts, social media bios, and public server listings where the target’s Discord presence is mentioned.

Part 9: Ethical Boundaries

Discord is a semi-private platform. Many servers are invite-only. Some content is behind authentication walls.

What Is Acceptable:

Viewing public server listings and joining public servers.
Extracting User IDs and profile pictures from public profiles.
Decoding Snowflake IDs for creation timestamps.
Viewing linked accounts that the user chose to display publicly.
Documenting messages in public channels you legitimately joined.

What Is Not Acceptable:

Using compromised accounts to access private servers.
Attempting to view direct messages.
Scraping messages at scale from servers without permission.
Impersonating another user to gain access.
Using bots to automate data collection in violation of Discord’s Terms of Service.

If a server requires an invite you were not given, you stop. If a user has set their profile to private, you respect that boundary. Discord’s platform rules prohibit unauthorized scraping. Operate within the terms.

Part 10: Practical Investigation Workflow Summary

Enable Developer Mode in Discord.
Copy the target’s User ID from their profile.
Decode the creation timestamp using discord.id or the Snowflake formula.
Document all connected accounts visible on the profile. Cross-reference each to other platforms.
Save the profile picture. Run reverse image search.
Google dork the username and any known server names.
Search disboard.org and discordservers.com for servers related to the target’s interests.
Join relevant public servers with a sock puppet account.
Document server information, member roles, and visible messages.
Extract server icons and reverse image search them.
Cross-reference every username, handle, and connected account across platforms.
Document everything. Screenshots, User IDs, timestamps, and your analysis.

Part 11: Quick Reference

Objective______________Method

Enable Developer Mode: User Settings → Advanced → Developer Mode
Extract User ID: Profile → three-dot menu → Copy User ID
Decode creation timestamp:discord.id or Snowflake formula
Find connected accounts: View target profile → linked icons
Find public servers:site:discord.gg "keyword", disboard.org
Extract profile picture: Right-click → Copy Image URL
Reverse image search: Google Lens, Yandex, TinEye
Server reconnaissance: Join public server → document channels, roles, messages
Google dork for Discord:site:discord.com "username", site:discord.gg "keyword"

This is Discord OSINT. The platform wants you to think everything is private. It is not. User IDs are permanent. Connected accounts bridge to other platforms. Public servers are open. Invite links are indexed. Extract what is visible, cross-reference everything, and build your attribution from the fragments people leave behind.

END OF VOLUME 1
You have successfully completed the core identity, geospatial, and social media footprint frameworks. The curriculum continues immediately with infrastructure targeting, dark web enumeration, automated scripting, and intelligence reporting.
CLICK HERE TO ACCESS VOLUME 2: TECHNICAL INTELLIGENCE & ATTRIBUTION:

GITHUB OSINT

D4RK_INTEL — Sun, 01 Feb 2026 09:32:17 GMT

Introduction: GitHub as an OSINT Goldmine
Methodology Framework
User & Organization Discovery
Repository Intelligence Gathering
Advanced Code Search Techniques
Metadata & Historical Analysis
Quick Investigation Commands
GitHub Account Creation Date Detection Methods
Automated Reconnaissance Tools
Legal & Ethical Considerations
Case Studies & Real-World Examples
Best Practices & Reporting

1. Introduction: GitHub as an OSINT Goldmine

GitHub has evolved beyond a simple code repository into a comprehensive digital footprint of organizations and individuals. For OSINT investigators, it represents an unparalleled source of intelligence containing:

Technical infrastructure details
Employee information and organizational structure
Development methodologies and technology stacks
Accidental exposures of sensitive data
Historical changes and project evolution
Collaboration networks and partnerships

The platform’s extensive API and search capabilities make it an essential component of modern digital investigations.

2. Methodology Framework

Systematic Reconnaissance Approach

Phase 1: Target Identification
Phase 2: User & Organization Profiling
Phase 3: Repository Enumeration
Phase 4: Code Analysis & Pattern Recognition
Phase 5: Metadata Collection
Phase 6: Correlation & Analysis
Phase 7: Reporting & Documentation

User & Organization Discovery

Individual User Intelligence

Basic Profile Information:

API Endpoint for User Data

https://api.github.com/users/[username]

Returns comprehensive profile including:

- Name, bio, location, company
- Public repositories count
- Followers/following networks
- Account creation date
- Social media links
- Hireable status

Examples:

https://api.github.com/users/techenthusiast167

Enhanced User Investigation:

Repository enumeration:

https://api.github.com/users/[username]/repos

Social connections mapping:

https://api.github.com/users/[username]/followers

https://api.github.com/users/[username]/following

Activity timeline:

https://api.github.com/users/[username]/events

Gists investigation:

https://api.github.com/users/[username]/gists

Organizational Intelligence Gathering

Company Structure Analysis:

Organization profile:

https://api.github.com/orgs/[orgname]

Team member enumeration:

https://api.github.com/orgs/[orgname]/members

Repository portfolio:

https://api.github.com/orgs/[orgname]/repos

Team structure:

https://api.github.com/orgs/[orgname]/teams

> Requires authentication

Advanced Organizational Insights:

Employee count and roles through commit patterns
Development team structure and hierarchy
Technology stack preferences
Project management methodologies
External collaborations and partnerships

4. Repository Intelligence Gathering ”repository-intelligence”

Comprehensive Repository Analysis

Basic Repository Search:

Keyword-based repository discovery:

https://api.github.com/search/repositories?q=[keyword]

Returns critical information:
- Repository names and descriptions
- Primary programming languages
- Star and fork counts (popularity indicators)
- Last update timestamps
- License information
- Open issue counts

Repository Content Enumeration:

# Directory structure exploration:
https://api.github.com/repos/[owner]/[repo]/contents

Branch analysis:
https://api.github.com/repos/[owner]/[repo]/branches 

Contributor identification:
https://api.github.com/repos/[owner]/[repo]/contributors

Release history:
https://api.github.com/repos/[owner]/[repo]/releases

Directory structure exploration:

Critical Repository Elements to Examine

Configuration files (.env, config.json, settings.py)
Documentation (README.md, technical specifications)
CI/CD pipelines (.github/workflows, .gitlab-ci.yml)
Dependency files (package.json, requirements.txt)
Database schemas and migration scripts
API documentation and integration examples

5. Advanced Code Search Techniques

Precision Search Operators

Target-Specific Searching:

User/Organization targeting

user:[username] [search_term]
org:[orgname] [search_term]
repo:[owner/repo] [search_term]

Example: Search for API keys in specific organization

org:targetcorp “api_key”

user:d4rk_intel “webrecon”

File-Based Intelligence Gathering:

File extension filtering:

extension:env “DATABASE_URL”
extension:json “password”
extension:yml “secret”
extension:pem “PRIVATE KEY”

Filename pattern matching:

filename:.env.example
filename:config.xml
filename:docker-compose.yml
filename:travis.yml

Path-specific searching:

path:.github/workflows
path:src/config
path:database

Sensitive Data Discovery Patterns

Credentials & Authentication:

API keys and tokens:

“api_key”, “apikey”, “api-key”
“secret”, “password”, “token”, “auth”
“aws_access_key”, “aws_secret”
“ghp_”, “xoxb-”, “sk-”

Database connections:

“DATABASE_URL”, “DB_PASSWORD”
“MONGODB_URI”, “REDIS_URL

OAuth and social media:

“FACEBOOK_APP_SECRET”, “TWITTER_API_KEY”
“GOOGLE_CLIENT_SECRET”

Infrastructure Exposure:

Cloud service configurations:

AWS Key pattern
“AKIA[0-9A-Z]{16}” 

“herokuapp.com”
“firebaseio.com”

Internal network references:

“192.168.”, “10.”, “172.16.”
“internal”, “localhost”, “staging”

6. Metadata & Historical Analysis ”metadata-analysis”

Commit History Investigation

Email Extraction & Attribution:

Extract commit emails from repositories:

https://api.github.com/repos/[owner]/[repo]/commits

Advanced email intelligence platform:

https://ghintel.secrets.ninja/

Historical Pattern Analysis:

Development team working hours and patterns
Project milestone timelines
Code ownership and responsibility areas
Merge patterns and review processes

Branch & Fork Analysis

Fork Network Mapping:

Identify internal copies of external projects
Track code reuse across organizations
Discover unofficial mirrors and backups

Branch Strategy Insights:

Development workflow understanding
Feature development timelines
Release preparation patterns

7. Automated Reconnaissance Tools ”automated-tools”

Specialized GitHub OSINT Tools

Credential Scanning:

TruffleHog -h

Gitleaks - Pattern-based detection:

gitleaks detect --source=/path/to/repo -v

GitRob - Comprehensive repository analysis:

gitrob target-organization

GitRecon -h

8. Quick Investigation Commands

1. Profile Recon:

curl -s "https://api.github.com/users/Techenthusiast167" | jq '. | {name, company, location, public_repos}'

2. Repository Scan:

trufflehog git https://github.com/Techenthusiast167 --json --verify > techenthusiast_scan.json

3. Code Search:

gh search code “filename:.env password” --owner=Techenthusiast1674. Network Analysisgh api users/Techenthusiast167/following | jq ‘.[].login’

Profile Recon

9. GitHub Account Creation Date Detection Methods

Method 1: Direct API Call (Primary Method)

API Endpoint

https://api.github.com/users/[username]

Example for our target:

https://api.github.com/users/Techenthusiast167

Response includes > JSON:


  “login”: “Techenthusiast167”,
  “id”: 123456789,
  “node_id”: “...”,
  “avatar_url”: “...”,
  “gravatar_id”: “”,
  “url”: “https://api.github.com/users/Techenthusiast167”,
  “html_url”: “https://github.com/Techenthusiast167”,
  “created_at”: “2020-05-15T10:30:00Z”,
  “updated_at”: “2024-01-20T08:45:00Z”

Method 2: Using GitHub CLI

Install GitHub CLI first

gh auth login

Get user info with creation date:gh api users/Techenthusiast167 | jq ‘.created_at’# Full user details

gh api users/Techenthusiast167 --jq ‘. | {username: .login, created_at: .created_at, public_repos: .public_repos}’

Direct curl Equivalent

Basic User Info with Creation Date

Simple curl request

curl -s “https://api.github.com/users/Techenthusiast167”

Filter specific fields using jq

curl -s "https://api.github.com/users/Techenthusiast167" | jq '{username: .login, created_at: .created_at, public_repos: .public_repos}'

Or extract individual fields

curl -s "https://api.github.com/users/Techenthusiast167" | jq '.created_at'

curl -s "https://api.github.com/users/Techenthusiast167" | jq '.login'

curl -s "https://api.github.com/users/Techenthusiast167" | jq '.public_repos'

With Authentication (Higher Rate Limits)

Using personal access token

curl -H “Authorization: token ghp_your_token_here” \
  -s “https://api.github.com/users/Techenthusiast167” | jq ‘.created_at’

Or using GitHub CLI token (if installed)

curl -H “Authorization: token $(gh auth token)” \
  -s “https://api.github.com/users/Techenthusiast167” | jq ‘.created_at’

Complete curl Examples

Example 1: Get Account Creation Date Only

curl -s “https://api.github.com/users/Techenthusiast167” | jq -r ‘.created_at’

Example 2: Formatted Account Information

curl -s "https://api.github.com/users/Techenthusiast167" | \
jq -r '"Username: \(.login)\nCreated: \(.created_at)\nRepositories: \(.public_repos)\nFollowers: \(.followers)"'

Example 3: Calculate Account Age

Get creation date and calculate age in days

creation_date=$(curl -s "https://api.github.com/users/Techenthusiast167" | jq -r '.created_at')
account_age=$(( ($(date +%s) - $(date -d "$creation_date" +%s)) / 86400 ))
echo "Account age: $account_age days"

Example 4: Complete Profile Snapshot

curl -s “https://api.github.com/users/Techenthusiast167” | \
jq 

  username: .login,
  name: .name,
  company: .company,
  location: .location,
  email: .email,
  blog: .blog,
  bio: .bio,
  account_created: .created_at,
  account_updated: .updated_at,
  public_repos: .public_repos,
  public_gists: .public_gists,
  followers: .followers,
  following: .following,
  hireable: .hireable

Batch Check Multiple Users

Check multiple accounts

usernames=(”Techenthusiast167” “octocat” “torvalds”)

for user in “${usernames[@]}”; do
    echo -n “$user: “
    curl -s “https://api.github.com/users/$user” | jq -r ‘.created_at’
    sleep 1  # Rate limit respect
done

Save to File with Timestamp

Save complete profile with timestamp:

curl -s "https://api.github.com/users/Techenthusiast167" | \
jq --arg date "$(date -Iseconds)" '. + {investigation_date: $date}' > techenthusiast167_profile_$(date +%Y%m%d_%H%M%S).json

Quick One-Liners

Get just the creation date:

curl -s “https://api.github.com/users/Techenthusiast167” | jq -r ‘.created_at’

Check if user exists and get creation date:

curl -s -o -w "%{http_code}" "https://api.github.com/users/Techenthusiast167" && curl -s "https://api.github.com/users/Techenthusiast167" | jq '.created_at'

The curl + jq combination is actually more universal than GitHub CLI since it works on any system with these basic tools installed, and doesn't require additional authentication for basic public profile lookups.

10. Legal & Ethical Consideration “Legal-ethical”

Compliance Framework

Authorization Requirements: Always ensure proper legal authority
Rate Limit Respect: Adhere to GitHub’s API usage policies
Data Handling: Secure storage and processing of collected information
Disclosure Protocols: Follow responsible disclosure for found vulnerabilities

Ethical Boundaries

Only access publicly available information
Respect organization privacy settings
Avoid disruptive scanning techniques
Maintain professional confidentiality

11. Case Studies & Real-World Examples ”case-studies”

Incident Response Scenarios

Case Study 1: Accidental Credential Exposure

Developer commits AWS keys to public repository
OSINT investigation identifies exposure within 2 hours
Rapid response prevents cloud infrastructure compromise

Case Study 2: Insider Threat Identification

Unauthorized code copying detected through fork analysis
Employee departure risk assessment via commit pattern changes
Proactive measures implemented based on intelligence

12. Best Practices & Reporting “practices”

Investigation Documentation

Standardized Reporting Format:

Executive summary of findings
Detailed technical evidence
Risk assessment and impact analysis
Recommended mitigation strategies
Supporting artifacts and references

Professional Standards

Maintain thorough investigation notes
Validate findings through multiple sources
Correlate GitHub intelligence with other OSINT data
Present findings in clear, actionable formats

This guide represents professional standards for GitHub OSINT investigations. Always operate within legal boundaries and respect platform terms of service while conducting reconnaissance activities.

FROM DIGITAL FOOTPRINT TO PERSONA

D4RK_INTEL — Fri, 30 Jan 2026 23:43:28 GMT

Subscribe now

Several months ago, I was engaged by a client to investigate an individual suspected of fraudulent activity, with the primary identifier being a phone number.

As a professional OSINT analyst, accepting such a task requires an immediate ethical and legal checkpoint. Before initiating any technical search, I conduct a client interview to establish a legitimate basis for the investigation.

Key questions include:

What is the specific aim and desired outcome? (e.g., evidence collection for legal action, asset tracing, confirming identity for a civil matter).
What is the known background of the POI? (e.g., alleged profession, last known location, areas of interest).

This preliminary phase is not just administrative - it defines the investigative scope, sets realistic expectations, and provides crucial contextual data (like location or profession) that will later serve as validation points, preventing the analyst from pursuing false leads.

The Investigative Challenge

While email addresses can often be queried directly via search engines and specialized tools, investigating a Person of Interest (POI) primarily through a phone number requires a more nuanced, layered approach. This case highlights the process of transforming a single data point into a comprehensive digital identity profile.

Methodology: A Tiered Approach to Digital Discovery

Phase 1: Initial Triangulation via Reverse Lookup
The investigation began with standard reverse phone number lookup services. This provided a preliminary data set: a potential name, profile picture, geographic region, and an associated email address.

Analyst Note: Data from these sources must be treated as leads, not facts. Corroboration through multiple independent sources is essential to avoid false positives.

Phase 2: Validation and Expansion with Advanced Search Operators
To test and expand the initial leads, I employed advanced search operators, targeting the phone number directly across major platforms.

"Target-Phone-Number" site:facebook.com OR site:linkedin.com OR site:instagram.com
"TargetPhoneNumber" filetype:pdf
"Target-Phone-Number" site:.edu

This phase yielded minimal results, a common occurrence with phone numbers that are not publicly posted. This signaled a need to pivot to the email address lead.

Phase 3: Correlation and Identity Verification

When direct phone number queries using site-specific operators returned limited results, I pivoted to exploit the email address obtained during initial reconnaissance. This required a more refined approach than a simple email search.

I deconstructed the email address (e.g., john.doe@domain.com) into its core components: the local-part (john.doe). Recognizing that individuals often reuse usernames across platforms, I hypothesized that this local-part-or variations of it-might serve as a username on social networks.

A targeted search using the format "john doe" site:instagram.com proved immediately fruitful, revealing an Instagram profile belonging to the Person of Interest.

Phase 4: Account Enumeration via Authentication Pathway Testing

With the target’s Instagram account confirmed, I employed a controlled account enumeration technique to identify additional digital footprints. This involved using the “Forgot Password” function on various high-value platforms-including Facebook, Snapchat, and region-specific services like BetNaija-while inputting the target’s known email address and username.

Note: This technique capitalizes on the standard behavior of authentication systems. When a submitted identifier (email or username) is associated with an existing account, the platform will typically respond with a partial, non-intrusive confirmation (e.g., displaying a masked version of the associated email or a prompt to send a reset link). A response indicating the identifier is “not found” suggests the absence of an account.

Example:

Instagram:

SnapChat:

BetNaija:

This method served as an efficient reconnaissance tool, confirming the target's active registrations across multiple digital platforms. Each positive indicator-where the system acknowledged the existence of an account-provided a validated starting point for further open-source inquiry.

Phase 5: Leveraging Pattern Recognition for Email Discovery

With the target’s core Instagram username identified, I hypothesized that this identifier might follow common syntactic patterns across other email addresses. Using the specialized email intelligence platform Epieos, I systematically tested predictable email permutations derived from the known username.

The initial email address associated with the phone number returned no actionable intelligence in Epieos. I therefore pivoted to a pattern-based approach. For a username like johndoe, I generated and queried logical variants such as doejohn@[domain]. This technique is grounded in the common user behavior of maintaining consistent naming conventions across digital services.

One permutation, doejohn@gmail.com, returned a high-confidence match in Epieos. Reverse-searching this newly discovered email address via standard search engines successfully uncovered a previously unknown Facebook profile.

The most compelling validation came from cross-platform visual and biographical analysis. The individual depicted in the Facebook profile photos displayed distinctive, matching physical markers (noted as tribal marks) consistent with the Instagram imagery. Furthermore, the professed occupation listed on both profiles was identical. This multi-faceted correlation-combining unique visual identifiers with consistent biographical data-provided robust, high-confidence confirmation that both accounts belonged to the same individual.

Phase 6: Supplementary Platform Verification and Visual Intelligence

A comprehensive digital profile investigation extends beyond traditional social media. To ensure no significant footprint was overlooked, I performed supplementary checks by verifying the phone number’s presence on key communication and service platforms.

Platform-Specific Checks:

Messaging Services: The number was saved as a contact to check for a corresponding profile on WhatsApp and Telegram. These platforms often reveal a profile picture, status, and “last seen” information, all of which are valuable pieces of passive intelligence.
Financial Technology (Fintech) Apps: A search within popular regional fintech applications can indicate whether the number is linked to an active payment or wallet account, potentially revealing a verified name or transaction alias.

Exploiting Visual Assets:

Any profile picture discovered during these checks or from previously identified social media accounts was subjected to automated reverse image search using tools like Yandex Images, Google Lens, and PimEyes. This process can uncover additional, often overlooked, instances of the image across forums, websites, or other social profiles, further expanding the digital footprint map.

Analyst Note: These steps are part of a thorough collection phase, designed to aggregate all publicly accessible artifacts linked to the identifier. Each new data point, whether a fintech alias or a reused avatar, serves to enrich the overall understanding of the POI’s digital behavior and presence.

Minimal → Entity Relationship Graph Visualization on Target

Client Satisfaction:

Final Analyst Reflection

OSINT is a powerful discipline that democratizes access to information. With this power comes an obligation to wield it with integrity, precision, and respect for ethical boundaries. The most skilled analyst is not the one with the most clandestine tools, but the one who can architect a rigorous, repeatable, and responsible process to transform scattered public data into actionable, verified intelligence.

This case study serves as a template for such a process—a reminder that in the digital age, truth is often assembled, piece by corroborated piece, from the vast mosaic of the open web.

Ethical Disclaimer: The methodologies described herein are intended for educational purposes and legitimate investigative work conducted within strict legal and ethical frameworks, such as due diligence, fraud prevention, and security research with appropriate authorization. Unauthorized use of these techniques to harass, stalk, or invade the privacy of individuals is strictly prohibited and may violate laws and platform terms of service.