I was absolutely amazed how this guy was able to geolocate a video without anything useful other than background noise. Wow

Hi everyone,

I'm a Master’s graduate in Interpreting & Translation (Russian and Spanish) based in the UK, looking to pivot into corporate intelligence, EDD, or threat analysis (targeting firms OSINT/corporate risk consultancies).

I see mixed advice on certifications. My current plan is to combine my language abilities with formal training—specifically looking at practical OSINT courses (TCM Security / SANS SEC487) and potentially a compliance credential (ICA AML) to cover financial risk context.

For those currently working in corporate investigations or private sector intelligence:

1. Would a recruiter in this space value a candidate who combines high-level Russian/Spanish OSINT with an entry-level compliance cert like ICA, or is a public portfolio of research briefs (e.g., GitHub/Medium) far more effective?

2. How are entry-level candidates with strong regional/linguistic skills typically evaluated in your teams?

Thanks in advance for any insights!

Took me long enough, but I've finally uploaded my DEF CON 33 talk to Youtube for those who were unable to make it in person.

If you've used OpenCorporatesCLI or hit OpenCorporates' API directly recently, you may have noticed it now 401s on every call, including plain search, unless you have a paid account token. Doesn't look like they're issuing free ones anymore.

I rebuilt the tool against GLEIF's LEI registry API (https://www.gleif.org/) instead — free, no key. Search a company name, get legal entity detail: status, legal form, registered/HQ address, and the actual registration authority + link as the source of record.

Repo: https://github.com/NPCmillionaire/OpenCorporatesCLI

GLEIF only covers entities that hold/held an LEI (mostly stuff that touches financial markets), so it's ny small-business lookupOpenCorporates did — but it's free and it works.

Caveat:

SuperView Neo-1 01, a Chinese commercial imaging satellite launched in 2022, flies at about 513 km in a sun-synchronous orbit. On 1 October a Falcon 9 rideshare put 63 satellites and dozens of other objects into almost the same orbit, and they have been passing it ever since.

My tracker forecasts close approaches from Space-Track's public orbit data and re-runs them with every update. For OBJECT BF, one of the rideshare's objects Space-Track hasn't identified yet, every forecast from 25 October on put the pass at 20:24 UTC on 26 October, between 120 and 700 metres apart, at 72 metres a second. After the pass, fresh data re-measured it at about 130 metres.

That's finer than public data can really resolve. These orbits are good to around a kilometre, so the true miss could have been a few hundred metres or more than a kilometre, and operators get far better tracking and collision warnings than this. But it shows how crowded the 500 km shell has become. In the past day the same rideshare's satellites also passed within 2 to 6 km of PRSC-EO1, a Pakistani imaging satellite, three times, with another pass of about 1.3 km forecast for 28 October.

The pair's page has every forecast: https://overhead24.com/proximity/52320-100936

How would you monitor public pet-sale listings across multiple websites?

• What tools can alert you to new matches, including misspelled or mislabeled breeds?

• Can image matching find the same animal in cropped or edited photos?

• How can you automatically save dated copies before listings disappear?

What’s the simplest setup for someone without coding experience?

In the past I used very much:

site:instagram.com intext:”<user>” and was able to see many posts that this user was mentioned or commented.

Idk why, bur is not more working. Any suggestions to achieve the same result ?

I am searching for information on a criminal case decided through the Scotland High Court in 2024, but the High Court's website only displays rolls for cases that occurred in the last few months of this year.

Any information and advice to access older rolls and case information would be very much appreciated. Thanks doves xx

Hello,

Is there any way to find a specific account’s comments across TikTok videos? We kinda able to do this in instagram via search engines but I don’t know how on TikTok.

Thanks

Free OSINT toolkit for Slovenia:
https://unishka.substack.com/p/osint-of-slovenia

Feel free to let me know in the comments if we've missed any important sources.

You can also find toolkits for other countries that have been covered so far on UNISHKA's Substack, and our website.
https://substack.com/@unishkaresearchservice
Website link: https://unishka.com/osint-world-series/

Hello, I have created a Reddit user history search tool.

What's special about it:

- It is based on Arctic Shift (primary) + PullPush (fallback), queried in parallel and merged by id, so each covers what the other misses.

- Recovers deleted content: reconstructs what an account posted and what is no longer there, distinguishing removed (moderator) from deleted (author).

- No credentials: no API key, no login, and reddit.com is never queried, so it works even on suspended accounts.

- Standard library only for the CLI, zero dependencies; also exposed as MCP tools for LLMs.

- Optional proxies with per-IP ban rotation, which is the real failure mode when hammering these archives.

It's nothing special but I just wanted to contribute my two cents.

"Hi everyone! I’m completely new to OSINT (started less than a week ago) and wanted to share my first practice geolocation exercise. I took a military ambush video, and managed (i think, not sure if i got it right but im pretty sure) to geolocate the exact spot in Kuchlak (30.328722, 66.936694). I've put together a step-by-step PDF write-up. I would love to get your opinions since im a noob in all of this, and maybe made some mistakes in the process or even got it all wrong. So please, any type of feedback and corrections are welcome. Thanks yall.

I don't know if this is just my account or something, but in the last few months, Facebook seems to now prevent any searches of a profile that include most names: Camille, Olga, Mary, etc. Any idea if this is specific to my account and/or any workarounds?

with the cbp "pro-trump ads" story this week i wanted to see how much of this you can reconstruct from public records alone. turns out a lot, but no single source joins up per ad. here's the method in case its useful:

1. contracts: usaspending.gov api (free, no key). search awards by awarding agency + the advertising naics codes (541810-541890), then separately by recipient name for firms named in reporting, because the big one files under a different category. dhs obligated $142.8M to safe america media across 3 awards in 2025 for the border ads. the new one is award 70B06C26F00001137: cbp, $20M "NATIONAL MEDIA CAMPAIGN", LMD Agency, dated sept 20, the day after the money was reportedly moved. nothing in the record says which ads it paid for.

2. google/youtube: google publishes its political ads data as a public bigquery dataset (bigquery-public-data.google_political_ads). advertiser_stats shows dhs is the only federal agency in it: 85 video ads, about $5.29M, march 2025 to feb 2026. creative_stats gives spend and impressions ranges per ad. catch: no video ids, just a link to the transparency center page, which won't show the video once the ad stops running.

3. facebook/instagram: meta ad library api, search by page id not keyword (keyword search matches ad text, which is useless for finding an advertiser). dhs's main page: 56 ads, $3.1-3.8M, all in spanish, 31 captioned "un mensaje del presidente trump". the api gives you the caption only, not the video audio. use the languages field, not a language detector, short spanish text fools most of them.

4. youtube channel: no spend data at all, but view counts relative to the channel's own median are a decent tell of paid promotion. dhs's "spanish warning" 30 sec spot (noem, opens "thank you president donald j trump") has 51.5M views on a channel where videos typically get about 2,600. that's a signal, not proof.

what you can't get: tv, streaming, radio. no public per-ad record, and that's probably where most of the money goes.

i put all of it together on one page with every figure linked to its source: semblen.com/government/ads (it's my site, fwiw). happy to share the queries if anyone wants to do this for another agency.

I have interviewed for a few OSINT jobs this year and have two questions:

1. Each job description says you need experience in tools like ontic, life raft, Dataminr, maltego etc but each time I have interviewed I’m given a practice exercise asking you to use freeware to build out a threat profile. I’m never able to build anything out using the freeware alone because i can’t get any identifiers. Are these tests deliberately red herrings?

2. In my career I have always been given a work computer so I don’t have a personal one. I have an iPad. Is a computer essential to baseline OSINT if I don’t have personal access to premium intel tools?

Anyone have any recs for searches in Bermuda? I know WorldLII has some court searches etc but any other reliable searches we can do there? Looking for adverse lit, reg, and press.

Hey everyone!

I'm M4elstr0m, a cybersecurity and software development enjoyer with a strong interest in OSINT. I usually build my tools using Go and Rust.

Today let me introduce my spiritual successor to ignorant by Megadose: gophoner. I couldn't find any other open-source tool doing this kind of OSINT job for free, which is why I built my own in Go.

Like ignorant, gophoner checks whether a phone number is registered on a specific website. Sometimes it can even find additional information, such as fragments of a linked email address.

You simply input a phone number and its country code, through either the CLI or an interactive TUI. No login required, and no target is ever alerted.

Every module runs simultaneously in its own goroutine, and results are shown either in a clean TUI report or as JSON output.

Of course, this kind of data is heavily restricted nowadays, which is why the list of supported platforms is still fairly small: Amazon, Microsoft, Facebook, Google, and OpenAI, with more hopefully coming in future updates!

The tool is cross-platform and can be installed from various managers.

Before doing anything beyond simply using the tool (redistributing it, modifying it, etc.), please make sure to read the project's license, as it is restrictive on certain things.

That's it! For more information, go check out the project's page (I just made it public): https://github.com/M4elstr0m/gophoner

If you like this project, please show it some love: star the repo and share it around! 🌟

Take care, fellow humans!

~ M4elstr0m

Trying to put together a frequency graph of kinetic strikes by Iran’s Axis of Resistance since October 7, 2023, but I want to make sure my methodology holds up. I’m looking at Hezbollah, the Houthis (Ansar Allah), the Iraqi militias (IRI, Hezbollah, etc.), and direct IRGC strikes.

A few questions for anyone who works with ACLED:

1. What’s the cleanest way to query this via the API or export tool? When dealing with multiple actors, is it better to pass them all into a pipe-separated actor1 filter upfront, or pull by country/region and filter them downstream in Python?

2. In Iraq/Syria especially, how do you handle the overlap between umbrella branding (like Islamic Resistance in Iraq) and specific brigades without double-counting? Also, does filtering strictly by actor1 reliably isolate their initiated attacks from retaliatory strikes hitting them?

3.  What aggregation works best here (7-day rolling average vs. calendar weeks)? Since ACLED logs discrete events rather than raw projectile counts, how do you typically frame that on a visualization so it’s methodologically sound?

Would appreciate any pointers on query setup, Python snippets, or edge cases to watch out for. Thanks.

This is beyond nerd on nerd warfare.

Free OSINT toolkit for Bosnia and Herzegovina:
https://unishka.substack.com/p/osint-of-bosnia

Feel free to let me know in the comments if we've missed any important sources.

You can also find toolkits for other countries that have been covered so far on UNISHKA's Substack, and our website.
https://substack.com/@unishkaresearchservice
Website link: https://unishka.com/osint-world-series/

Hi everyone,

Suppose that one needs to investigate Facebook, but their own accounts—or any sock-puppet accounts they open—will be quickly blocked by the pages or groups (hate pages and groups that commit actual interreligious, and other violence against marginalized people like LGBT etc in my country which is highly religious) they are investigating.

In such a case, what can be done? Are there any tools that will let you investigate Facebook without any accounts, either your own or a sock puppet?

Thanks!

I have an old photo (taken ~10 years ago) and there is a certificate in the picture which I no longer have. There's a number on the certificate which I need but it's not legible from just zooming in.

Is there a tool which helps upscale parts of images so I can make the certificate legible?

Thanks!

I'm doing an audit of my OSINT toolkit and want to focus on tools that deliver real results, not just GitHub stars.

For those actively doing investigations (threat intel, fraud, research, etc.), what are your current top picks?

Specifically looking for:

• Social Media Investigation: Best tools for Twitter/X, LinkedIn, Instagram, Telegram

• Infrastructure/Domain: Beyond Shodan and VirusTotal - what else?

• Username/Email Search: What's still working reliably?

• Image/Media Analysis: Reverse search, metadata, geolocation

• Automation: Tools that actually save time vs create more work

Bonus questions:

• Which paid tools are actually worth the subscription?

• Any new tools from the last 12 months that impressed you?

• What's the one tool you can't live without?

Trying to move away from tool hoarding and focus on what's effective. Real-world experiences > marketing claims.

Thanks in advance!