Hey Everyone,
Here are some stories from the past week showing how OSINT was used in real world cases.
Criminal Cases and Law Enforcement
A TikTok comment and a matching hoodie: social graph pivoting in a Connecticut motel robbery
Overview: Police allege Francisco Perez, 45, of Enfield, was one of two masked men who robbed a Wethersfield Motel 6. Reports put the take at about $9,701 in cash plus a phone and watch. An arrest warrant says open-source research on TikTok produced his name. He is charged, not convicted.
What needed investigating: Two armed, masked suspects escaped. Surveillance footage showed clothing but not faces.
How OSINT was used (per the warrant, as reported):
A Wethersfield detective found a woman's TikTok profile through open-source research.
A user left a Spanish comment on her post: "Love you always, beautiful, my love. One hundred percent Puerto Rico." That suggested a close relationship.
The detective reviewed the commenter's photos. One showed a man with groomed eyebrows in a dark Nike hooded sweatshirt that "closely resembles" a robber's.
Police sent identification requests to other departments. Danbury police said the man appeared to be Perez.
Non-OSINT follow-up: license and phone records, phone activity near Hartford, a license plate camera hit on the stolen car, and DNA from its steering wheel.
What it led to: Arrest on Sept 22. Charges include first-degree robbery and first-degree kidnapping with a firearm. Bond was $500,000. The second suspect is not identified.
Learning Note: It is a clean example of pivoting from one account to its commenters, then comparing clothing to CCTV. OSINT produced the lead; records and DNA did the proving.
Techniques: SOCMINT, social graph pivoting (comments), clothing comparison, translation
Sources: The Mary Sue · Attack of the Fanboy.
An AI-generated decoy, then a phone number, face match and plate reader: inside a Michigan sting
Overview: Livonia's LURE unit, which targets child sex offenders, used an AI-generated image of a teen to pose on a dating app. An FBI task force officer's affidavit describes how a suspect was identified and arrested. 404 Media found the affidavit through Court Watch.
What needed investigating: A man allegedly pursued a decoy he was told was 15. Investigators had a phone number and messages but no confirmed identity.
How OSINT was used:
Decoy profile. In September, the officer created a Taimi profile with an AI-generated image of a teenage-looking male and no listed age.
Platform hop. The chat moved to WhatsApp, which exposed a phone number.
Identification. Investigators identified Christopher Thomas Mertens using that phone number and facial recognition.
Tracking. They then tracked his car with Flock license plate readers.
Arrest at the planned meetup point.
What it led to: Arrest, and the affidavit says he later admitted the conduct. He is charged, not convicted.
Ethics angle: 404 Media places the case in a wider trend of AI-generated child images in stings. It also notes police use of AI personas to monitor protesters. Phone-number lookup is open-source practice; facial recognition and Flock are law enforcement data, not OSINT.
Techniques: sock puppet (AI-generated persona), phone number pivoting, facial recognition, ALPR tracking (law enforcement data), court records (Court Watch)
Sources: 404 Media (links the affidavit via DocumentCloud)
Missing Persons and Cold Cases
Genome sequencing and a state genealogy team name Sanford's 1997 John Doe as John Richard Moulis
Overview: Skeletal remains found in Sanford woods in March 1997 were identified as John Richard Moulis, 37. He was reported missing from Orlando in January 1997. The death was ruled a homicide, and the case remains open.
What needed investigating: The remains sat in NamUs as UP16164 for decades. A 2023 STR profile entered into CODIS produced no match.
How OSINT was used:
Funding. Florida Senate Bill 678 grant money paid for advanced testing in 2025.
Lab work. The Volusia County Medical Examiner's Office submitted bone samples to Othram. Othram built a profile with its Forensic-Grade Genome Sequencing.
Genealogy. The Florida Department of Law Enforcement's forensic genetic genealogy team searched for relatives. In July 2026 it reported a possible close relative to Sanford police.
Confirmation. Investigators collected a reference sample from that relative. A direct comparison confirmed the identity.
What it led to: A name, a missing-person link and a fresh homicide lead. Police now want tips on his final days. His 1986 Dodge Aries was found abandoned at an Orlando Greyhound station. Likely next: the records phase of the case, rebuilding his last movements.
Learning Note: It shows the hand-off between lab, genealogists and detectives. Note that CODIS failed because it only finds people already on file.
Techniques: investigative genetic genealogy, forensic genome sequencing, NamUs records, familial reference comparison
Sources: Othram / DNASolves case page · FOX 35 Orlando
Financial Investigations
Overview: On Oct 8 the UK designated Xeltox Enterprises Ltd, listing Cryptomus, Heleket and Certa Payments as name variations. It also designated Kyrgyz exchange TokenSpot. Chainalysis and KrebsOnSecurity laid out the open-source and on-chain trail behind the payment processor.
What needed investigating: Cryptomus presented as a Canadian company. Researchers wanted to know who ran it and how much illicit money it handled.
How OSINT was used:
Sanctions notice as a pivot sheet. The UK entry lists a Vancouver street address, two websites, a support email and Canadian and BC registration numbers. Each is a searchable selector.
Address clustering. Cryptomus shared a Vancouver address with dozens of currency dealers and money transfer firms. None appeared to be physically there.
Shared hosting. Certa Payments' former site shared a server with 12 other domains, including rasd-state[.]ws, which belongs to the Central Reserve Authority of the Western Sahara.
Corporate records. Krebs reports the sole shareholder of Certa Payments was a 25-year-old Ukrainian woman.
Blockchain analysis (Chainalysis). Cryptomus and Heleket received funds from more than 15,000 illicit actors. Illicit counterparties topped 900 in one month in late 2025.
Deposit address convergence (Chainalysis). TokenSpot, Grinex and Meer sent funds to the same HTX deposit address, which received more than $308 million.
Direct engagement. Krebs asked both services' Telegram support bots about each other. Heleket's agent denied any link.
What it led to: An asset freeze plus internet services and payment processing prohibitions. It follows Canada's CAD 176 to 177 million FINTRAC fine in 2025. Likely next: exchanges blocking flows to listed wallets, and pressure on the Heleket successor brand.
Learning Note: Pair the sanctions notice with reverse address search and reverse IP lookups. Beginners can replicate the address and shared-hosting steps for free.
Techniques: sanctions list analysis, corporate registries, address clustering, domain/infrastructure pivoting (shared hosting), blockchain analysis, deposit address clustering
Sources: Chainalysis · KrebsOnSecurity
Procurement, tax and company records show a Kazakh president's relative owns two state-backed universities
Overview: Radio Azattyq, published with OCCRP, found that 23-year-old Medeu, grandnephew of President Tokayev, owned two new universities receiving state money. One received over $4.2 million in procurement contracts. Procurement data shows over $250 million in state funds for its sports campus.
What needed investigating: New "national" universities appeared with state partners. Reporters asked who owned them and how public money flowed in.
How OSINT was used:
LinkedIn. His profile gave his age and Boston University attendance when he founded the sports academy in 2021.
Web archives. An archived academy website showed its stated mission.
Company records. He was sole owner for several years. A state body, KazSportInvest, took a 5% stake in August 2025.
Government procurement portal. Over $4.2 million in contracts, the largest over $2.5 million in March 2026.
Tax registry. Nearly $800,000 in taxes paid since 2022.
Filing timeline. For the AI university, filings show a state-linked co-owner joined 11 days after its April 2026 founding.
What it led to: Public disclosure of family ownership of state-funded institutions. Medeu addressed the questions in interviews with other outlets.
Techniques: corporate registries, procurement databases, tax registries, SOCMINT (LinkedIn), web archives, filing date analysis
Sources: Radio Azattyq / OCCRP
Cybersecurity and Threat Intel
Teardowns, eSIM data and on-chain tracing expose implanted Ledger wallets
Overview: Independent researchers found cellular spy implants inside Ledger hardware wallets bought from resellers. Ledger confirmed an implant on Oct 10 and tied all drain reports to devices sold by Malaysia-based reseller CryptoBilis. Bitquery traced $102.0M taken from 335 wallets on six chains.
What needed investigating: Users reported wallets emptied on Oct 9. Two questions followed: how were seed phrases stolen, and where did the money go?
How OSINT was used:
Hardware teardowns. Joe Grand bought eight wallets from Lazada sellers in Thailand and found implants in four. Mark Karpelès and Tibane Labs documented implant variants from devices bought on Amazon and Yahoo! Auctions Japan.
Physical indicators. Tibane Labs said the antenna wire was the telltale sign. Markings on the microcontroller and eSIM had been scraped off.
Cell network data. An anonymous Japanese researcher used eSIM cell-tower data to find likely manufacturing hubs. He traced seed transmissions to servers in a Hong Kong data center managed by Alibaba.
Seed list from public posts. Bitquery started from ten addresses posted publicly by researchers tanuki42 and Specter.
Following the money. Bitquery read every payment in and out on TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. It used public order records from Chainflip, Relay.link and NEAR Intents.
Clustering. Wallets were tied to one actor by simultaneous approvals, key additions, shared funding and matching test loops. About 8 minutes before the drain, 30 TRON wallets had a new signing key added.
What it led to: Ledger told CryptoBilis to halt sales. Tether froze $10.0M across 20 wallets. About $81M was still visible on-chain as of Oct 16. The thief is not identified. Bitquery says its Tornado Cash and Zcash links are strong inferences, not proof. Likely next: exchange freezes and law enforcement requests built on these traces.
Note: Bitquery states that an exchange payment shows where funds came from, not who owns the receiving wallet. That is a good attribution caution.
Techniques: blockchain analysis, wallet clustering, cross-chain bridge tracing, hardware teardown, cell network analysis, marketplace purchasing (test buys)
Sources: Bitquery investigation · Zero Day, Kim Zetter · BleepingComputer
GitHub commit times point to Kazakhstan in a regional espionage campaign
Overview: Cisco Talos (UAT-6275) and Recorded Future's Insikt Group (TAG-193) published coordinated reports on a spear-phishing group. Victims and lures span nine countries. Both assess, with medium confidence, that the group likely operates from Kazakhstan.
What needed investigating: Government ministries across the former Soviet space received official-looking lures. Researchers needed to cluster the activity and judge who was behind it.
How OSINT was used:
Exposed infrastructure. Insikt found open staging directories holding more malware and a previously undocumented GitHub staging account.
Commit history. Talos used the repository's commit history to track infrastructure and malware changes over time.
Pattern-of-life timing. Talos plotted 77 GitHub commits against UTC+3 and UTC+5. Activity fit a 09:00 to 18:00 workday in UTC+5 (Astana, Almaty).
Supporting artifacts. Russian-language strings and apparent malware test submissions from Kazakhstan shortly after compilation.
Event timing. Insikt saw intrusions that coincided with diplomatic events involving Kazakhstan. It notes timing alone does not prove a link.
What it led to: A named cluster with detection signatures and IOCs. Talos links it, as likely the same broader cluster, to YoroTrooper. Neither team claims state sponsorship.
Learning Note: The working-hours method is easy to practice. Pull public commit timestamps, convert to candidate time zones, and look for a workday shape.
Techniques: pattern-of-life timing analysis, GitHub/code repository analysis, exposed directory discovery, infrastructure clustering, victimology, lure analysis
Sources: Cisco Talos · Recorded Future Insikt Group · The Record
Brooklyn prosecutors stop chasing scam domains and take down the servers behind them
Social Engineering and Scams | Oct 14, 2026 | Brooklyn, New York; Ukraine and Eastern Europe
Overview: The Kings County DA's Virtual Currency Unit and the FBI disrupted a crypto investment scam aimed at Russian speakers. They seized or disrupted 241 domains and 112 servers. About $300,000 has been recovered so far.
What needed investigating: Over three years, a cluster of Brooklyn victims described the same pattern. The office had already taken down about 400 scam domains, but new sites kept appearing.
How OSINT was used:
Victim pattern mapping. Victims saw Russian-language Facebook ads, got a call from a Russian-speaking "investment advisor," and were coached into opening crypto accounts.
Site analysis. Seized sites imitated real investment platforms and cited U.S. agencies or figures such as Elon Musk.
Infrastructure tracing. Investigators traced IP addresses and infrastructure to Ukraine and other Eastern European countries. Servers sat with Eastern European and American hosts.
Strategy shift. Instead of domains, the unit identified "the servers supporting the scam, worldwide." Warrants were executed across three time zones in several hours.
Partners named: Shadowserver, Coeus, UltaHost and the DA's Digital Evidence Lab.
What it led to: Seized servers held victim data, site content and operating software. The data revealed a follow-on recovery scam that contacted victims weeks later. No arrests are announced.
Learning Note: It is a clear lesson in moving from indicators to infrastructure. Domains are cheap to replace; the servers that populate them are not.
Techniques: domain/infrastructure pivoting, IP and hosting analysis, victim pattern analysis, scam site analysis
Sources: Brooklyn DA press release · The Record
Research and Methods
Henk van Ess: country domains, local-language operators and the Wayback Machine to find hidden documents
Research and Methods | Oct 14, 2026 | Global (worked example: Ghana and China)
Overview: GIJN republished a step-by-step research guide by Henk van Ess. It walks one worked example: Chinese involvement in Ghana. Each step is a free search technique beginners can copy today.
What needed investigating: How to find experts and official documents on a topic in a country whose language you may not speak.
How OSINT was used (the guide's steps):
Find experts sideways. Search Substack for the topic, then add /recommendations to a strong writer's address to find related newsletters.
Find the country domain. Ghana is .gh, and government is .gov.gh.
Test the volume. Run
filetype:pdf site:ghto see whether the domain holds many PDFs.Search in the local language. The query
"中国人" filetype:pdf site:ghsurfaced a 2020 university paper on Chinese small-scale gold mining.Loosen, then narrow. Drop the quotes, then restrict to
site:gov.gh. This led to Energy Commission project files.Revive dead links. Search the Wayback Machine for
domain/*and filter archived URLs by keyword. This recovered six PDFs captured on Oct 29, 2020.Search outside the domain. Search a distinctive URL string without
site:. Van Ess foundinurl:no longer worked reliably and switched to a phrase search.Flip the perspective. Translate Ghana into Chinese (加纳) and search
site:gov.cn. This found a 2025 Chinese Ministry of Commerce investment guide for Ghana.Analyze with AI, then verify. NotebookLM summarized documents, and a second model checked claims. He caught a debt figure on the wrong date.
Monitor. Turn the best query into a Google Alert.
What it led to: A repeatable workflow, not a single finding. The verification step is the lesson: the AI attached a real number to the wrong date.
Learning Note: Step 7 matters. Search operators change without notice, so test each one before relying on it.
Techniques: advanced search operators, country-domain search, foreign-language search, web archives (Wayback Machine URL listing), expert discovery, AI-assisted document review with verification, alerts
Sources: GIJN, International Research Guide
World Affairs and Political
AdSense IDs, Yandex counters and same-second posts map inauthentic networks around Armenia's election
Overview: DFRLab mapped four coordinated networks of Facebook pages and websites, plus Telegram channel pairs, that amplified fears of war before Armenia's June 7 vote. Many pages stopped posting on June 9, two days after the election. DFRLab does not name a state sponsor.
What needed investigating: Narratives such as "300,000 Azerbaijanis" spiked during the campaign. DFRLab asked whether the spread was organic or coordinated, and who sat behind the sites.
How OSINT was used:
Two scores. Analysts rated coordination (behavior) and inauthenticity (presentation) separately.
Facebook timing. Identical posts across many pages within seconds or minutes, plus shared naming patterns and contact emails.
A seller found by email. One shared email led to a man who said he sold about 100 pages with 3 to 4 million followers in mid-2025, to buyers he said were in Russia.
Analytics IDs. Four news sites carried Yandex Metrica counter IDs within a range of only 326. That suggests batch creation. Three sites shared one Google AdSense publisher ID.
File hashes. One photo appeared on seven sites within 2 minutes 46 seconds. The SHA-256 hash matched on all seven.
Hosting and admin clues. Four sites shared one Beget-hosted IP. Admin logins used "Adminka" variants, and Russian interface text appeared on Armenian-language sites.
AI artifact timing. Three sites had AI-generated logos made in one ChatGPT session, seven minutes apart, on May 12, 2026.
Telegram pairs. Analysts counted how often two channels posted the same item within one minute, against a shuffled baseline. One pair matched 572 times, 374 in the same second.
Tools named: Junkipedia, LetsData, Osavul, Meta Content Library, DNSLytics, Wayback Machine, BuiltWith and TGStat.
What it led to: A documented map of four networks and two Telegram clusters. DFRLab hedges each link. Shared developers or AdSense IDs "do not by itself" prove common control. Likely next: platform takedowns and comparison with earlier DFRLab work on Russian interference in Armenia.
Learning Note: Analytics and ad IDs are a classic pivot. BuiltWith and DNSLytics let beginners look up which sites share an ID.
Techniques: SOCMINT, coordinated inauthentic behavior analysis, analytics/AdSense ID pivoting, domain/infrastructure pivoting, file hashing, web archives, Telegram co-posting analysis
Sources: DFRLab
Tool Watch
Three tools to check out. One is a police-facing AI geolocator, one maps surveillance cameras, and one links pseudonyms across forums.
Tool | What it does | What's new / interesting | Cost |
|---|---|---|---|
AI geolocation of photos. Sold to police, including LAPD and Miami-Dade Sheriff's Office per 404 Media. | New interior feature matches tiles, appliances and toiletries to rental and sale listings such as Airbnb and Zillow (Cybernews, Oct 13). Manual technique underneath: reverse image search plus scanning listing photos by area. Privacy risk: one posted photo can reveal a home. | Sold to law enforcement | |
Shows the location and direction of known license plate readers and other outdoor cameras in the MapQuest mobile app. | Launched Oct 16. Covers vendors including Flock, Motorola (Vigilant), Genetec and Axon. Community maps such as DeFlock do similar work. | ||
Crawls Tor and clearnet forums, builds writing-style profiles and scores similarity between pseudonyms. | Public beta, AGPLv3. Featured in OSINTech's Oct 15 timeline; Manual technique underneath: stylometry, comparing phrasing, grammar and posting times by hand. Similarity scores are leads, not proof of identity. | Free, open source (needs an LLM API key) |
That’s all for now, talk to you soon!
David
Social Engineering and Scams