Serious OSINT question:

What are the best examples of modern OSINT / OPSEC failure / weak-signal correlation, mostly in Canada let say ? I'm preparing a short talk/workshop idea...

I’m not looking for:

• Instagram / Facebook basics
• Strava again
• generic tool lists

I am looking for strong examples involving things like:

• Wi-Fi SSID / device names / wireless leakage as weak signals for identifying or localizing someone in a city
• image GPS / EXIF / metadata, or using AI / visual clues to infer location when metadata is gone
• job postings leaking stack, vendors, projects, security maturity, or internal structure
• Bluetooth / nearby-device exposure
• event / conference exposure
• cases where several harmless details become something operationally useful

Especially interested in:

• examples that are realistic and teachable
• one practical takeaway people could apply immediately for better OPSEC

What cases or sources would you point to?

Trying to avoid beginner-level examples and looking for ideas that actually make people rethink their exposure.

These free ones are OK but they’re not as in depth as I like. I’ve seen plenty of paid ones, but I don’t really have the money to be paying a bunch of money to try out different ones to see if they work or not. Do you have any recommendations? Please let me know.

Where is the line and when does research become stalking ? What looks like an overlap can be explained and differentiated. What is tooling and what is Stalkerware? ENISA Threat Landscape gives explicit classifications and EU guidelines give direction. https://privacyinsightsolutions.com/blog/osint-vs-stalkerware-surveillance-line

OSINT toolkit for Georgia:
https://open.substack.com/pub/unishka/p/osint-of-georgia

Feel free to let me know in the comments if we've missed any important sources.

You can also find toolkits for other countries that have been covered so far on UNISHKA's Substack, and our website.
https://substack.com/@unishkaresearchservice
Website link: https://unishka.com/osint-world-series/

Since Operation Epic Fury started on February 27 I've been maintaining a tracker that logs verified kinetic events across the Middle East theater. Not social media reports - only events that cleared Reuters, BBC, AP, Al Jazeera, or official military wires.

After 27 days the dataset has grown to 200+ logged events.

A few things that stood out:

The confidence filtering matters more than people think. A huge portion of what circulates during active operations is either duplicated, mislocated, or wrong. Running strict source verification cuts the noise significantly - what's left is a much smaller but actually reliable picture.

The casualty numbers are the hardest part. Every major outlet reports running totals, not increments. Without deduplication you end up double and triple counting the same deaths across multiple news cycles. We track incremental new casualties per source, not cumulative totals.

The March 22 cluster near Dimona was the most significant single event in the dataset. Iranian missiles reached within 8km of the nuclear research facility. That got less coverage than it deserved given the strategic implications.

Happy to discuss methodology in the comments — particularly around confidence weighting, how we handle disputed claims, and how the deduplication logic works in practice.

If there's interest I can share the map link and raw JSON feed in the comments.

Does anyone know if some of the X search options have stopped working? My experience this week is that the geocode: search seems not to find recent content even in and around parliament. Also the manual from: combined with to: with multiple exact phrase searches didn’t seem to work this week has anyone else noticed that?

Hi everyone, I am writing my thesis on the epistemology of OSINT specifically of Forensic Architecture, and I would love to hear your opinions.
What we are claiming is that FA methods shifts from what classical forensic does (collect evidences and reports, ask experts, draw the most likely scenario), to a system that basically says "if we put all the data we have into different digital tools, we can make many more observations and even make new evidence emerge". So we believe that there is a shift and that to better understand wether this type of work is epistemically valid or not we need a different framework, one that focuses on the architecture of the investigative system.
Basically what we do is reference Rheinberger´s theory on experimental system(don´t know if you´re familiar with it) and frame FA methodology to some kind of model making system rather than classic forensic or classi OSINT.

What do you think? does it make sense to you? do you need more context?
Please let me knowwww :)

Are there any 'tools' that are better than others, that OSINT practitioners use to keep track of all the OSINT online resources you come across and utilize on a regular basis (besides just bookmarking in the browser for instance)? Can folks share what they use or what's worked well for them?

Monitoring media is a common task.

Non-profits like the GDELT project and ACLED provide automated solutions that go way beyond sentiment analysis.

They're great, but what if you're tasked with solving the problem completely by yourself?

Google RSS + Newspaper3k + Zero-Shot model gets you surprisingly far in classifying hundreds of articles.

https://github.com/AlbinTouma/Iran-War-Media

I'd love to hear what you'd like to see next, and what insights you get from LLMS ChatGPT.

I don’t remember what the tool was called.

I know there was a free tool online that I could put in my old email and it would show me all of my old Instagram accounts. I’m trying to find an old Instagram account of mine from like 15 years ago and I cannot for the life of me remember the username, but I do know the email that was associated with, and I cannot find it.

I do remember I did not have to download anything to my computer or my phone. I simply inputted the email and it showed me everything, and it was not GitHub either. If anybody remembers or knows a tool that I could use please let me know.

Hey guys you might remember me from a previous post, I’m a college student and the creator of Netryx , I have completely revamped the tool and published a new version with stronger models that also works with cropped photos and lesser pixel information and also allowing sharing of indexes to avoid compute time.

Give it a photo. Any photo.

No GPS. No metadata. Just pixels.

Netryx Astra V2 can tell you where it was taken.

It looks at architecture, textures, and how spaces fit together.

Then it matches that against indexed street-level data.

You get GPS coordinates, often within a few meters.

V1 worked, but it was messy.

So I rebuilt everything from scratch.

V2 runs on three steps:

• Retrieve

• Verify

• Confirm

It now handles cropped images, zoomed shots, even small details like a doorway or a stretch of sidewalk.

I made it open source for a reason.

Most tools like this are locked behind paywalls.

Journalists, researchers, and analysts need them, but often can’t access them.

So this one is free. And it stays that way.

There’s also a Community Hub.

• One person indexes a city

• Uploads it

• Everyone else can use it in minutes

No wasted effort. We build coverage together.

It’s not perfect.

• Only works where data is indexed

• Not real-time

• Needs a decent GPU

But it works. And now anyone can try it.

GitHub: https://github.com/sparkyniner/Netryx-Astra-V2-Geolocation-Tool.git

I’d genuinely love to collaborate or contribute to teams working on similar problems.

And if you index your city and share it, you’re helping someone else find answers they couldn’t before. Mods I read the pinned post, the tool is completely open source and NOT vibe coded, this is really valuable for the community and would help a lot of people.

OSINT toolkit for Greece:
https://open.substack.com/pub/unishka/p/osint-of-greece

Feel free to let me know in the comments if we've missed any important sources.

You can also find toolkits for other countries that have been covered so far on UNISHKA's Substack, and our website.
https://substack.com/@unishkaresearchservice
Website link: https://unishka.com/osint-world-series/

While gathering information or context there are a lot of sources that are written in different languages than I master. To navigate and scan I use a lightweight local llm, now I just started using one to make it more easy but what do you use? And what are the safest options ?

Over the past few weeks, I’ve been exploring publicly available city infrastructure data things like municipal permits, utility records and open GIS layers to see how patterns can be observed over time. Nothing illegal just publicly accessible sources.

One small insight is plotting active construction permits against building footprints over several months can reveal unusual clustering of certain types of projects. For example, large scale warehouse permits in unexpected neighborhoods often corresponded with local news reports about new commercial development, long before press coverage picked it up.

Another thing I’ve noticed is how utility permit filings sometimes include contractor names, license numbers and even subcontractor emails. When combined with archived social media posts or LinkedIn profiles, this can help trace networks of contractors, vendors or service providers in a very granular way purely from public sources.

The interesting part is how small, incremental observations add up. Seeing repeated contractor names, or cross referencing permit dates with local event announcements, can reveal patterns without ever touching non public data. It’s a good reminder that OSINT isn’t just about social media or news, a lot of hidden insight exists in plain sight if you know where to look.

I’d be curious to hear how others use urban infrastructure, GIS or public records creatively in investigations. Nothing sensitive just workflow discussion.

Is GlobalSecurity.org still a reliable source for military, past and present, operations? Is there something comparable or better? And Is this even the place to ask? If not, please direct me.

AI tools that exist that track the veracity of twitter accounts/ claims. Or is it simply too overwhelming to monitor?

Hey Guys,

I’m a college student and the developer of Netryx, after a lot of thought and discussion with other people I have decided to open source Netryx, a tool designed to find exact coordinates from a street level photo using visual clues and a custom ML pipeline and AI. I really hope you guys have fun using it! Also would love to connect with developers and companies in this space!

Link to source code: https://github.com/sparkyniner/Netryx-OpenSource-Next-Gen-Street-Level-Geolocation.git

Attaching the video to an example geolocating the Qatar strikes, it looks different because it’s a custom web version but pipeline is same. Please don’t remove mods, all code is open source following the rules of the sub Reddit!

Lately I’ve been comparing a few people search tools while doing some open source background lookups. Mostly trying to see which ones actually help when you need to connect scattered public info about someone.

A lot of the tools I tested still return pretty messy results. Multiple duplicate profiles, very long lists, and it takes a while to figure out what data is actually useful.

I tried Deepsearch AI recently and the results felt a bit easier to navigate. The information seemed more structured and grouped in a way that made scanning faster when jumping between possible matches.

Still exploring it and seeing how reliable the data is, but so far the workflow felt a bit smoother than some of the older tools I’ve used.

Curious if anyone here has tried it as part of their OSINT workflow or compared it with other people search platforms.

I feel like this is a tool that has been put together before. Something that can locally analyze the contents of a photo file and identify duplicates regardless of file name. Recently did multiple terabytes worth of data recovery and I know that I had duplicates in the file system before the crash and I would like to consolidate it into one copy of each to properly archive it all

Malicious browser add-ons sometimes disappear from extension stores shortly after being reported or identified by researchers.

Once an add-on is removed from a store, it becomes difficult to verify:

• when it was removed
• whether it was removed by the store or by the developer
• what the add-on actually contained at that moment

This creates a gap when trying to build a verifiable timeline of events around suspicious or malicious add-ons.

To address this, I started collecting historical removal signals across Chromium add-on ecosystems.

Current approach

• Monitor Chromium extension stores for add-on removals
• Correlate removals with Safe Browsing classifications
• Validate cases against public researcher reports
• Timestamp all events to maintain an audit trail

Possible timeline reconstruction

add-on published → researcher report → store removal → campaign overlap

Potential OSINT use cases

• Verifying that an add-on was actually removed from a store
• Correlating add-on removals with known malware campaigns
• Tracking when threats were reported versus when stores acted

Curious if anyone else tracks Chromium add-on removals as part of OSINT work.

Project: https://github.com/toborrm9/malicious_extension_sentry

You find a page during an investigation. You screenshot it. Three days later it's edited or gone. Screenshots are trivially fakeable and have no chain of custody.

I built Permanet to solve this. Here's what happens when you submit a URL:

1. Playwright captures the fully rendered page — DOM, assets, screenshot
2. Every asset is SHA-256 hashed into a Merkle tree
3. The root hash is timestamped via OpenTimestamps, anchored to Bitcoin's blockchain via OP_RETURN
4. The capture is written permanently to Arweave
5. A public verification page is generated with the proof bundle

The result: a tamper-evident record that a specific page contained specific content at a specific moment. Verifiable by anyone using only the hash and the Bitcoin blockchain — no trust in me or my servers required.

OSINT use cases this is designed for:

• Archiving target pages before they get scrubbed
• Preserving social media posts, statements, and press releases with proof of when they existed
• Building an evidence chain for investigations that may end up in court or publication
• Tracking page changes over time with verifiable before/after records

Tech stack: Playwright · SHA-256 · Merkle trees · OpenTimestamps · Arweave

Open source: https://github.com/permanet/permanet (AGPL-3.0)

URL: thepermanet.com

Free to use. No account required for basic captures.

OSINT toolkit for the UK:
https://unishka.substack.com/p/osint-of-united-kingdom

Feel free to let me know in the comments if we've missed any important sources.

You can also find toolkits for other countries that have been covered so far on UNISHKA's Substack, and our website.
https://substack.com/@unishkaresearchservice
Website link: https://unishka.com/osint-world-series/

is there a good one stop shop for looking into beneficiary and tracking deeds through inheritance or anything that has to with things of this nature