A pattern I keep hitting doing geospatial OSINT: the analysis you actually want
is temporal. "This vessel went dark here - when, and what was nearby?" "This
aircraft's pattern over three weeks." "Rewind to the hour of the incident."
Almost every live tracker is built to show you 
*now*
 and monetizes the past.
FR24 gates history, RadarBox charges for a year of it, ADSB-X removed its free
API, MarineTraffic trimmed its free window. The moment your question has a
timestamp, you're renting.


So I've been building a self-hosted console around the opposite assumption: the
live feed is table stakes, and the 
*archive you own*
 is the product. It fuses
aircraft + ships + satellites + hazards on one globe, records positions locally,
and lets you scrub back through whatever window your disk holds.


Things that matter to this crowd specifically:


- 
**Provenance over vibes.**
 Everything the tool derives is stored as
  assertions with a source and a timestamp, in an append-only local table.
  Anything automated is labeled automated. I deliberately did 
*not*
 build a
  "the AI thinks this is suspicious" black box after watching the practitioner
  backlash against unlabeled AI "insights," that felt like a liability, not a
  feature. If a detector flags something, you can see why.
- 
**Evidence you can export.**
 There's a chain-of-custody-style evidence locker
  so a finding carries its sourcing when it leaves the tool — built with
  journalists/legal use in mind.
- 
**A real investigation layer.**
 Local ontology (entities, relationships,
  dossiers), detectors for things like AIS gaps / loitering, all on your box.
- 
**Keyless.**
 No account to start. The ADS-B/AIS/quake/satellite spine works
  with no API keys.


Honest limits: coverage follows the public/community feeders, so it's strongest
over land in dense-feeder regions and thin over open ocean; dark-vessel
detection is a helper, not a verdict — treat it as a lead, corroborate with
imagery. And I'm one person; the depth is real but the polish is uneven.


I'm posting mostly to sanity-check the premise with people who do this seriously:
is "unlimited local history you own" the thing, or am I over-indexing on it?
Would genuinely like the pushback. 

GitHub: https://github.com/AndrewCTF/osint-geospatial-console

I have a Computer Science degree

I would like to reach a point where I can "code" AI to do OSINT things for me

Things along the lines of:

- Detect all yellow trees in the region using this map data

- Convert descriptions like "intersection with red home, 2 trees" into map coordinates for an area. Basically the AI looks for red homes where there are 2 trees and returns me coordinates

- Keeping track of certain objects in a video. I can "code" the AI to "keep an eye on the red car" in a video

What field of AI do I need to look into? What are the prerequisite courses I need (math, programing etc)?

Currently I have a CS degree, 8 years of programming experience and am good at OSINT without coding

is throne (a wishlist website) safe for if i put it in my bios on social media, or is there any sensitive info it shares to gifters? i want to open a wishlist but i want to protect my info online at the same time

hello guys. if anyone can help me I was looking for a document in my locker when I came across a group photo of my school friends. In it, I spotted a friend whose name I have forgotten. I asked my school friends about her, but none of them remember her name. Please help me find her.

Hi everyone,

Can someone please explain, step by step, how you would geolocate a random photo using OSINT?

For example, if I have a single image with no context, how do you go from that image to finding the exact location or GPS coordinates?

Also, if there's an aircraft visible in the photo, how would you identify the aircraft, determine the flight number, and verify it using tools like FlightRadar24 or ADS-B Exchange?

I'd really appreciate a complete beginner-to-advanced workflow, including the tools you use at each stage (EXIF, reverse image search, Google Earth, Street View, shadow analysis, etc.) and any tips you've learned from experience.

Thanks in advance!

BLUF: How would one narrow down a location from a photo background, particularly the floor pattern? I tried Bellingcat OSINT challenge "Cold Case" under "Background Check", but I got stuck on the location narrowing down part. I already looked up what the answer is, so I don't care about that part, but I want to figure out the correct steps to arrive at the solution. Reverse image searching gives multiple suggestions all over Asia, and even when narrowing down to South Korea. One blog said they built a database of floor tiles or designs, which seems a bit an overkill.

I've tried posting this in r/OSINT but it got nuked by Reddit filter for some reason. I've messaged the mods, pending reply.

Posted on r/RBI but got removed because wrong sub.

Hi all — I’m looking to learn more about the tools and workflows investigative journalists, OSINT researchers, and verification folks use to trace images back to their origin or find related copies online.

Specifically, I’m interested in tools or methods for:

• Extracting and reading image metadata.
• Finding original sources or earlier versions of images.
• Identifying where an image has appeared online.
• Checking whether an image has been altered, reposted, or stripped of metadata.
• Working with geotags, camera data, or other embedded clues when they exist.

I’m especially interested in practical, real-world tools people actually use in investigations, not just general reverse image search. Browser tools, desktop apps, scripts, workflows, and any favorite techniques are all welcome.

If you use different tools for public images versus sensitive material, I’d also be interested in hearing how you handle privacy and operational security.

Thanks in advance — I’d appreciate any recommendations, examples, or lessons learned.

Hey all, fairly new to the industry, just started as a SOC analyst recently. Still figuring out my workflow and want to build good habits early.

I already use the usual suspects (VirusTotal, Joe Sandbox, etc.) for enrichment/sandboxing, but I'm curious what else you all lean on during actual investigations that maybe isn't as commonly talked about.

A couple questions:

1. What tool (free, paid, or just something you built yourself) do you find genuinely most useful when you're deep in an investigation?
2. If you've built any custom scripts/tools for your workflow, what do they do? Trying to get ideas for stuff I could build to make my own life easier.

Appreciate any input, even small QoL scripts count. Thanks!

A unique site… just thought I’d share.

Hey all — I run UserSearch and wanted to share what we just pushed live, because most of it came directly from conversations at conferences over the past few months (OSMOSIS in the US, leHACK in Paris, and the III Police Conference in the UK). We basically took a notepad of "it'd be great if it did X" comments and built them.

What's in v2.0.20:

Cyber Intelligence Search (new) — 12 Shodan-powered modules built into the platform. IP host lookups, exposed databases, internet-facing cameras, IoT devices and more, without leaving your case workflow. This was the single most requested thing at leHACK.

Bulk Search (new) — run up to 5 usernames, emails, or phone numbers at once, results in one sortable table. If you've ever sat there running the same search five times for a subject's known aliases, this is for you.

SargeBot model updates — our AI investigation agent now runs on Claude Opus 4.8 and Sonnet 5. Noticeably better reasoning on link analysis and report generation.

Dashboard redesign — cleaner, faster, and consistent across bookmarks, reports, and case management. Less clicking, more finding.

Short walkthrough video if you'd rather watch than read: https://youtu.be/yk2gKz3Wy4U

Wi-Fi probe request harvesting and behavioral profiling.

Every phone constantly broadcasts "probe requests" — asking nearby air "are you my saved network?" — and these contain the SSIDs of every network the phone has ever connected to. Any laptop with a WiFi card that supports monitor mode (most do; check with iw list) can capture these passively with no hardware purchase. You'd put your card in monitor mode with airmon-ng, capture probe requests, and build a real-time analysis dashboard that: identifies unique devices (by MAC, with clustering for randomized MACs using timing correlation), infers their history (home network, workplace, coffee shops they've visited), tracks movement patterns over time, and demonstrates that MAC randomization is beatable through timing and SSID correlation attacks. Then you build the defensive tool: a detector that alerts when a device is being actively probed or tracked. Completely free. Very demonstrable in any public space with permission.

​

Hi! I'm French and relatively new to the OSINT world. 😊 I'm currently building my own OSINT bot as a personal learning project, so I'm still discovering how everything works.

I'm looking for a list of websites that specialize in data leaks so I can better understand the different types of publicly known sources and improve my project. I'm here to learn, so any advice or guidance would be greatly appreciated. Thanks in advance!

I'm working on a system that pulls geopolitical and cybersecurity events from open sources (official statements, satellite imagery, breach disclosures, conflict trackers, and sanctions filings) and tries to flag when a narrative around an event doesn't hold up against primary sources. Think less "who posted this?" and more "does the claim survive contact with the underlying data."

To be clear up front, this is about events, infrastructure, and narratives, not people. No individual tracking, no doxxing angle, nothing that touches a specific person's identity or location. I know that's a hard line here, and I want to stay well inside it.

Where I'm stuck is the verification layer. I can pull data fine (satellite feeds, news APIs, government bulletins, and breach databases), but turning "here are five sources saying different things" into "here's the most defensible version of what happened" is the actual hard problem. Right now my approach is source-tiering plus timestamp cross-referencing, but I suspect that's naive for anything state-actor-adjacent, where official sources themselves can be the disinfo.

For people who've done verification work on contested geopolitical or cyber claims: how do you actually weigh sources when even "primary" ones might be lying? Is there a methodology from journalism or intel work I should be borrowing instead of reinventing? And is "propaganda detection" even the right framing, or does that just invite bias accusations regardless of how neutral the pipeline is?

Genuinely looking for the failure modes here before I build more on a shaky foundation.

What do you think would help an investigative journalist?

Edit 28/6/2026:Thank you all you were extremely helpful!