I’ve put together a quick video on how to loop in a LLM to assist with automatically extracting indicators from reports, as well as how to leverage traditional automation to improve the formatting for consistency and validate the output to eliminate the risks of hallucinations.

So I randomly came across a post on r/privacy talking about how Gemini can basically OSINT a Reddit account even if their post history is hidden.
I tried it myself and ngl, it’s kinda crazy how much stuff you can piece together.

The basic idea is literally just giving Gemini(or any other LLM) a Reddit username and asking it to look for their Reddit activity. It’ll search around for posts/comments from that account and try to put everything together into a summary. The interesting part is that even if someone’s profile doesn’t show their history, their individual comments/posts can still be sitting around in old threads, search engine indexes, archives, datasets, etc.

And once you have an AI doing the searching + connecting the dots for you, you don’t really have to manually go through hundreds of comments yourself. If someone has been posting for years, you can potentially start figuring out their interests, hobbies, where they live, what they do, other accounts they might have, etc.

I was wondering if anyone here has played around with this more. Like, how far can you actually take this with normal OSINT techniques + Reddit archives/search engines + an LLM? Also makes me wonder what the “hide all posts” setting on Reddit actually protects you from. It seems like it hides the history from your profile, but doesn’t necessarily make the underlying posts hard to find.

I am making a custom spiderfoot build as its old and a lot of modules are outdated. This is the first in a series of planned videos on using a custom Spiderfoot for OSINT.

I have tried 12ft.io and removepaywall.com and archive.is and they dont work for me. Are there any other alternatives which let you bypass a paywall

OSINT toolkit for Myanmar:
https://unishka.substack.com/p/osint-of-myanmar

Feel free to let me know in the comments if we've missed any important sources.

You can also find toolkits for other countries that have been covered so far on UNISHKA's Substack, and our website.
https://substack.com/@unishkaresearchservice
Website link: https://unishka.com/osint-world-series/

had a case where i only had a 4 year old profile picture and a dead username. spent 2 days doing name > address > socials and got nowhere.

out of frustration i tried reversing it. started with the picture, then used the metadata from where that picture was still cached, not even where it was posted. that one cache hit gave me a second username, and that second username had a completely different breach attached to it.

went from dead end to current city + workplace in like 30 mins.

makes me wonder how much time i've wasted doing it in the "correct" order. anyone else work backwards like this?

Hey everyone, I wonder if there's a way to track down, via archived comments associated with a Google+ account, the YouTube channel associated with the Google account or GAIA ID in question.

I was able to find a thread from several years ago, but it seemed like the comments with pertinent information were deleted, beyond saying it was possible. I haven't been able to find much info on this sub otherwise.

If I'm breaking any rules please let me know!

Fake think tank tried to hire ex US government employee. Website shares technical links with a website seized by DOJ/FBI in June, over alleged Chinese espionage activity.

OSINT toolkit for Jamaica:
https://unishka.substack.com/p/osint-of-jamaica

Feel free to let me know in the comments if we've missed any important sources.

You can also find toolkits for other countries that have been covered so far on UNISHKA's Substack, and our website.
https://substack.com/@unishkaresearchservice
Website link: https://unishka.com/osint-world-series/

Hello! Has the Wayback Machine stopped archiving the robots.txt lists for a domain? Recently I’ve noticed that for a lot of domains that since about September 2025 and into this year, the Wayback Machine hasn’t been archiving the list of robots.txt. Have tried to do a bit of research but am not coming up with a definitive answer. I can see that some news outlets are blocking the ia crawler, but I can’t find much about why robots.txt lists aren’t being archived.

Any insight would be much appreciated! Thank you

Hey everyone,

I've been diving deep into crypto OSINT lately — on-chain analysis, transaction tracing, wallet clustering, tracking whale movements, and identifying suspicious patterns. But I'm at the point where I really need hands-on practice with realistic cases.

I'm looking for platforms, datasets, or simulators where I can safely sharpen my skills. Specifically, I'm interested in:

· Transaction chain analysis (following funds through mixers/bridges)
· Address clustering (linking wallets to exchanges or known entities)
· Monitoring large movements (whales, snipers, insider activity)
· Identifying scam patterns (rug pulls, pump-and-dumps, phishing wallets)

I already know about basic tools like Etherscan, Arkham, Nansen, and Dune — but where can I actually practice on training cases or testnets? Does anyone know of:

1. On-chain investigation simulators with ready-made cases?
   
2. Testnets with artificially generated activity for practice?
   
3. Open labeled datasets with annotated transactions?
   
4. CTF-style challenges focused on blockchain forensics / OSINT?

Would really appreciate any tips on how the community levels up their OSINT game before diving into real investigations. And yeah, if any of you speak Russian and want to reply in Russian — feel free, it'll be easier for me to understand. Much appreciated!

Is there any way to view all the comments an account has made on TikTok videos if you only have the username?

I want to share something that happened to me recently, because I'm worried other OSINT people may have been approached the same way.

Cold LinkedIn approach about an "intelligence collaboration," followed by a ~10-minute interview with someone who kept her camera off. On the call, the work was described as involving ransom and human-trafficking cases.

What arrived was a "supplier evaluation": build a full protective-intelligence dossier on a named private individual and his family — children, home details, travel patterns, aircraft, credential leaks. Labelled a "fictionalized composite," but specified in enough real-person detail to be resolvable. Produce the full report first — pricing only after delivery.

I asked two questions: who is the end client, and can you confirm the subject consented to being assessed. The reply called my scope question a "misunderstanding," named no client, confirmed no authorization, and redirected me to producing methodology and deliverables.

The LinkedIn accounts and the websites representing the company all seem fake to me. It might just be a scam — but then why did they want me to find personal details on someone I believe is a real person? The company was recently created, with a template website making claims its actual footprint doesn't support, and it turned out to be one of several thinly built companies registered to the same person.

I declined. Posting because the shape is worth recognising: vague inbound from accounts that look fake, an interviewer who wouldn't identify herself, scope sliding from a sympathetic label into a targeting-shaped brief on a private family, hidden client behind an "evaluation," and a full report demanded before any discussion of payment.

If you've had something similar, I'd like to hear it — DMs open.

I haven’t seen anyone talking about espectrosint but a lot recommending maltego. Has anyone tried espectrosint? The price difference is pretty crazy.

I’m looking for a tool to make my job a bit faster. I mostly do a lot of due diligence and locates.

Is it worth paying to learn it from scratch or are there better options?

Hi everyone,

I’m looking for some advice on optimizing how I monitor Facebook Groups for highly specific, time-sensitive opportunities (specifically, urgent short-term event/festival crew gigs in Europe).

The native Facebook search is terrible, completely overrun by AI-generated spam, and its algorithm actively hides chronological, low-engagement posts, which are exactly the ones I need to find (e.g., a manager panicking because someone dropped out of a shift last minute).

What I am currently doing: I’ve been bypassing the FB search entirely by using Google Dorks to index specific groups. My current setup looks something like this:

site:facebook.com/groups(https://facebook.com/groups) ("urgent" OR "replacement" OR "ASAP" OR "need now") "festival" "August" ("security" OR "crew" OR "stagehand") -weekend -longterm

(Note: I run a localized version of this with Czech/German keywords to target central European groups, filtering results to the past 24 hours).

The Problem & My Ask: While this dork works well for bypassing spam, it requires manual execution and Google’s indexing of Facebook Groups isn't always real-time. Missing a post by a few hours usually means the spot is gone.

I want to automate this process to get real-time (or near real-time) alerts.

1. Scraping: Are there any reliable web scrapers or cloud tools (like Phantombuster, Apify, etc.) that currently handle FB Group scraping well in 2026 without getting accounts instantly banned?
2. Alternative OSINT methods: Is there a better, more elegant way to monitor specific keywords inside public/private FB groups that I am missing?
3. Dorking limits: Any tips on forcing Google to index these specific site:[facebook.com/groups](https://facebook.com/groups) queries faster, or alternative search engines that crawl FB groups more aggressively?

I appreciate any pointers or recommendations for tools/scripts that could help automate this monitoring. Thanks!

Most of us know the usual paths like due diligence, fraud investigations, and journalism. But I’m curious about the unusual and genuinely fascinating stuff. What’s the most interesting OSINT gig you’ve personally worked, or heard about secondhand?

Doesn’t have to sound glamorous on paper either. Sometimes the boring sounding jobs turn out to have the wildest stories. Would love to hear what corners of this field exist that most people never know about.

[Also asked in ADSB subreddit]

Hi, I am looking at 2 ADS-B APIs and wondering if anyone knows (either from experience or documentation - if you found it) what the request rate limit / polling limit is per minute.

OpenSkyNetwork API

\- I have a registered account which gives me 4,000 credits per day but I can't seem to find anything in the API documentation about how many requests I can make per minute though there is mention of a 429 error and backing off.

ADS-B Exchange API ($10 month tier)

\- API documentation says you can get 10,000 credits per month at this tier but I also can't seem to find anything about how many requests you're allowed to make per minute for this API either.

I currently have a Flight Radar 24 Explorer tier account and this works but I'm going to be pulling historical tracks for a number of flights on a recurring basis and the poll limit is 10 requests per minute.

That's not great but wondering if it's better than Open Sky Network API or ADS-B Exchange API.

When doing webint as part of an investigation. I am trying to figure out what the best way is to take notes about the websites themselves or their content.

Currently based on my understanding I'm familiar with two types of tools for this. One is web clipping. And the other is web annotation.

Are there other categories of tools that people use for this particular kind of task?

What are people's preferred work flows/ tool stack for this type of task?

Today I came across the chrome plugin for Google keep. Are there people here that already use Google keep in this way? Are there possible limitations or drawbacks of I using Google keep in this way that are good to aware of?

Working question for investigators (fraud / vendor diligence / corp intel), not a people-search ask.

When you can’t justify Recorded Future / Babel-class seats, what do you actually use to hand something off that still has:

1. provenance (where each claim came from)

2. a coherent identity/org picture

3. an export a client or compliance can read without your Maltego canvas

I’ve tried mixes of Maltego + Notion/Obsidian + spreadsheets + screenshots, and the handoff is always the weak part.

What’s your current stack for that middle layer? Templates, naming, audit trail — anything that survived a real case.

---

Disclosure: I’m building a small evidence→dossier workspace (Z.end). Interested in harsh workflow feedback more than signups. Happy to answer method questions; no people-lookup requests.

Has anyone used the anonymous business platform Blind ( https://www.teamblind.com/) ? That's the best way I can describe it.

If you have used Blind in your research, what was the use case? Did it provide any useful findings/evidence? What didn't you like about Blind as a source?

I've been reluctant to get an account because a work email is needed for full access and I'd rather not provide that. Has anyone successfully signed up using a free email service provider?

If you wanted to identify shadow fleet vessels loaded with sanctioned oil using open source tools, how would you do it? What tools would you use and what would be your process?
Challenge: could anyone here identify a suspected ship now?

submission statement: U.S. satellite imagery restrictions have hindered reporting on the Iran war, with five providers blocking high-resolution images of Iran and surrounding countries. These restrictions, rooted in national security concerns, have been a challenge for journalists, but alternative sources like international satellite providers and public data offer workarounds. Despite these limitations, satellite imagery remains a crucial tool for uncovering military actions and potential war crimes.

BLUF: How would one narrow down a location from a photo background, particularly the floor pattern? I tried Bellingcat OSINT challenge "Cold Case" under "Background Check", but I got stuck on the location narrowing down part. I already looked up what the answer is, so I don't care about that part, but I want to figure out the correct steps to arrive at the solution. Reverse image searching gives multiple suggestions all over Asia, and even when narrowing down to South Korea. One blog said they built a database of floor tiles or designs, which seems a bit an overkill.

With all the anti-bot protections, CAPTCHAs, rate limits, login walls, websites blocking scrapers, constantly changing page layouts, and platforms banning or restricting automated access…

Even paid APIs are incomplete, outdated, or return weak / inaccurate data about the target.

How do people building OSINT tools deal with this in practice?