Social Media OSINT: Timezones From Timestamps, Networks From Replies
when someone posts tells you where they wake up, who they reply to tells you who they are. public data, read patiently, no fake friend requests.
Read Full News
Domain and Infra OSINT: WHOIS, Passive DNS, crt.sh, Shodan, Censys
certificate transparency leaks the subdomains dns hides, passive dns reverses an ip into everything it ever hosted, and shodan tells you which port someone forgot to close.
Username and Email OSINT: Sherlock, Holehe, and Breach Pivots
handle reuse is the gift that keeps giving. enumerate accounts with sherlock, check email existence with holehe without alerting anyone, and correlate breaches to connect the dots.
Geolocate a Photo Like Bellingcat: EXIF, Reverse Image, Sun and Shadows
exif if you are lucky, reverse image search to catch recycled photos, and sun plus shadow plus landmark when the metadata is gone. verification, not stalking.
Scam-Baiting Without a Felony: Waste Their Time, Keep Your Freedom
let them connect to a burner vm, keep them talking, record everything, collect iocs. do not touch their machine. that line is the whole article.
Reporting Pipelines That Actually Do Something (IC3, FTC, abuse.ch)
reporting to the right inbox with a clean evidence pack is the difference between a takedown and a form that goes nowhere. here is the map.
The Refund Scam, Unmasked: The Script, the Money, and the Tells
they do not steal your money. they convince you to send it, using a remote session, a fake overpayment, and a bank balance that is literally an edited div.
Trace the Scam Back to Its Cheap VPS: Infrastructure OSINT for Fraud Fighters
One baby domain points at one cheap vps that hosts five other scam fronts. pivot the IP, cluster the wallet, find the abuse inbox, write it up. no hacking required.
Detonate the ‘Refund’ RAT in a Sandbox, Not on Grandma’s Laptop
Clean snapshot, host-only net, fake internet, capture everything, then double-click the thing your aunt almost ran. The tray icon is their shell.
Your C2 Resolver Is a Public GitHub Gist (and Sometimes a Twitter Bio)
the implant only knows a gist id. githubusercontent hands it the real next hop. your proxy called it developer browsing.