Verify or Burn a Claim: Chaining Photo, Map, and Public Records
a claim is a hypothesis. chain exif, the map, the sun, and the public record until the story holds or falls apart. most fake claims fall apart on the date.
OSINT
Read Full News
Social Media OSINT: Timezones From Timestamps, Networks From Replies
when someone posts tells you where they wake up, who they reply to tells you who they are. public data, read patiently, no fake friend requests.
Domain and Infra OSINT: WHOIS, Passive DNS, crt.sh, Shodan, Censys
certificate transparency leaks the subdomains dns hides, passive dns reverses an ip into everything it ever hosted, and shodan tells you which port someone forgot to close.
Username and Email OSINT: Sherlock, Holehe, and Breach Pivots
handle reuse is the gift that keeps giving. enumerate accounts with sherlock, check email existence with holehe without alerting anyone, and correlate breaches to connect the dots.
Geolocate a Photo Like Bellingcat: EXIF, Reverse Image, Sun and Shadows
exif if you are lucky, reverse image search to catch recycled photos, and sun plus shadow plus landmark when the metadata is gone. verification, not stalking.
Trace the Scam Back to Its Cheap VPS: Infrastructure OSINT for Fraud Fighters
One baby domain points at one cheap vps that hosts five other scam fronts. pivot the IP, cluster the wallet, find the abuse inbox, write it up. no hacking required.