Hey Everyone,
Here are some stories from the past week showing how OSINT was used in real world cases.
Criminal Cases and Law Enforcement
Genealogy Narrowed It to Three Brothers; a Stolen-Car Record Supplied the DNA: Spokane's 1986 Mary Ann Turner Killing
The Case: Early on Nov 4, 1986, Mary Ann Turner, 32, was found dead near South Ivory Street and East Pacific Avenue in Spokane. She had recently moved from Sacramento. A scarf and sweater were wrapped around her neck. A "secret witness" tip named a local man with a 1976 bronze Ford Elite, but no one was arrested. In 2008, a lab found that DNA under her fingernails matched an unknown man's DNA from the scene. The question for 40 years: whose DNA was it?
The Investigation: Spokane Police sent the evidence to Othram in Texas in August 2025. Othram's in-house genealogy team worked the profile, and detectives followed the leads.
How OSINT was used:
Othram built a DNA profile using Forensic-Grade Genome Sequencing and ran forensic genetic genealogy on it.
The genealogy pointed police toward three brothers. Two had died. The third was alive and still lived in the house he had in 1986.
That matched the old tip. Detectives now needed his DNA without tipping him off.
Police records showed his car had been stolen and recovered the year before. On Feb 4, 2026, police mailed him an official letter asking him to confirm the car was no longer stolen and return it signed.
He licked the envelope to seal it. Eight days later, detective Zac Storment sent it unopened to the Washington State Patrol Crime Lab.
What it led to: In March 2026, scientists found the fingernail DNA was 4.3 million times more likely to come from the person who licked the envelope than anyone else in the US. On Oct 21, police arrested David John Tibbett, 74, at his home. He faces a second-degree murder charge and is held on $1 million bond. He has been charged, not convicted.
Learning Note: Genealogy produces a lead, not a name. Ordinary records (here, a stolen-vehicle report) can open a lawful path to the confirming sample.
Techniques: investigative genetic genealogy, family tree narrowing, police records review, pretext letter for abandoned DNA, cold case tip reconciliation
Sources: DNASolves / Othram · The Spokesman-Review
Looters Filmed Themselves: How Paris Police Are Using TikTok, Instagram and Discord to Identify Suspects After the Oct 17 Riots
The Case: On Oct 17, about half a million people marched across France against the cost of living. On the edges of the marches, rioters looted and burned shops and town halls. The chamber of commerce says more than 2,000 shops were hit. Young looters then posted TikTok and X videos bragging about stolen clothing and taunting riot police. Interior Minister Laurent Nuñez admitted police had "lost control." How do you identify thousands of suspects after the fact?
The Investigation: On Oct 19, Prime Minister Sébastien Lecornu announced a "massive" law enforcement operation. About 200 Paris Police Prefecture investigators were assigned to analyse footage. A task force is reviewing CCTV, shop cameras and social media.
How OSINT was used:
Officers monitor TikTok, Instagram and Discord for posts about crimes. Some come from victims who posted about incidents they never reported.
They compare posted videos with police camera footage to confirm the crime matches. Police can access about 80,000 cameras, including the Paris region's transport network.
They geolocate the footage, then try to identify the victim and the crime before passing confirmed cases to criminal investigators.
A witness platform lets the public upload images they recorded during street crimes.
Lecornu noted many looters in circulating footage had not covered their faces.
What it led to: Around 2,400 people were arrested over the weekend, according to Euronews; Justice Minister Gérald Darmanin cited more than 2,330 taken into custody. Darmanin also announced facial recognition will compare a police mugshot database with images posted on social media. One officer called a suspect's own video "one of the very useful tools for investigators," since it can persuade a suspect who denies involvement.
Learning Note: The full SOCMINT loop in one story: find the post, verify it against independent footage, geolocate it, then hand off. It also shows the ethics question that comes when facial recognition meets social media.
Techniques: SOCMINT, geolocation, video verification against CCTV, crowdsourced witness uploads, facial recognition
Sources: Euronews · The Korea Times · Euronews: French looters brag online
Missing Persons and Cold Cases
Census Rolls and a 1954 City Directory: Genealogy and Records Name Iowa's 1988 Highway Culvert John Doe
The Case: On Aug 30, 1988, Iowa highway workers found skeletal remains on a drainage culvert along U.S. Highway 20, half a mile east of Correctionville. The man had likely died between 1971 and 1975. His personal effects gave no clue to his name. The case sat in NamUs as UP2619 for decades. No missing person report matched him.
The Investigation: The Iowa Division of Criminal Investigation worked the case with the Iowa Office of the State Medical Examiner. In 2025 they sent the remains to Othram in Texas. The FBI ran the genetic genealogy search.
How OSINT was used:
Othram extracted DNA and built a SNP profile using its Forensic-Grade Genome Sequencing, then handed it to law enforcement.
The FBI searched that profile against genealogy databases and built out the family tree.
The search pointed to a likely niece living in Houston, Texas.
Information from the niece, plus further genetic testing, confirmed the match.
Records then rebuilt his life: he appears with his parents in Dubuque through at least 1940, renting a room in 1950, and in a 1954 city directory. That 1954 listing is the last known record of him.
What it led to: The man is Clarence Ames, born in 1909 in Dubuque, Iowa. He never married, had no children, and was never reported missing. That explains why no missing person file ever matched. On Oct 12, 2026, his niece took his remains home for burial beside his parents. Why he was in Woodbury County is still unknown. NamUs funded the lab work.
Learning Note: A good example of why unreported people stay unidentified. With no missing person report to match, genealogy finds the family, and old directories and census records fill in the timeline.
Techniques: investigative genetic genealogy, SNP profiling, census records, city directories, NamUs
Sources: DNASolves / Othram · 1430 KASI
Financial Investigations
Same Directors on Dozens of Companies: How a Panama-Greece Law Firm Hid Iran's Shadow Fleet Owners
The Case: Iran moves oil and petrochemicals on tankers and cargo ships whose real owners are hard to find. Each ship sits inside a company, and each company has paperwork naming directors and officers. If those names belong to hired stand-ins, the trail goes cold. Who was building these corporate shells, and for whom?
The Investigation: The US Treasury's Office of Foreign Assets Control (OFAC) targeted the service providers behind the fleet, under a campaign it calls Operation Economic Outcast. FinCEN ran a parallel track aimed at banks.
How OSINT was used:
Treasury linked the law firm Karnakis and Karnakis to companies that own shadow fleet vessels, including Skyros Maritime and Trading S.A., Corfu Maritime and Trading S.A., and Elias Shipping and Trading Group S.A.
The key pattern: firm employees, including Roberto Ortega Jones, served as directors and officers of many of these registered companies. Treasury says this hid the true beneficial owners.
Treasury tied a specific ship to a specific buyer. Elias Shipping owns the RAMONA 1 (IMO 9233222), which Treasury calls a front for Syria's Al-Qatirji Company, which sold Iranian oil for the IRGC-Qods Force and the Houthis.
It listed seven Panama-flagged ships managed by Roxette Maritime, where Karnakis is corporate agent, each by IMO number: ANEMOS, GLORIS, PRIDE, DESTINY, FLAMINGO 1, HARMONY and PRINCE.
It named port and shipping agents in Singapore and Dubai, including a bunkering link to the tanker ZIXUAN (IMO 9317298).
What it led to: OFAC designated the firm, its founders Sofianos and Konstantinos Karnakis Kosmas, several employees, Roxette Maritime and two shipping agents. FinCEN issued its first administrative subpoena under 31 U.S.C. 5318(k) to probe a Greek bank's possible Iran ties.
Learning Note: Nominee directors are a pivot, not a dead end. One name repeated across many company filings can map an entire network. IMO numbers stay fixed even when ships change names and flags.
Techniques: corporate registries, nominee director pivoting, vessel identification by IMO number, beneficial ownership analysis
Sources: US Treasury · Al-Monitor
Cybersecurity and Threat Intel
Phone Forensics and Apple Threat Alerts: Citizen Lab Confirms Pegasus on Belgrade University Rector's iPhone
The Case: Vladan Đokić, rector of the University of Belgrade, backed Serbia's student pro-democracy movement. Until September he was often named as a possible head of the Student List. In March 2026, authorities raided his offices and reportedly seized computers and servers. Serbia faced snap parliamentary elections on October 25. Was the rector's phone being watched, and by what?
The Investigation: The Citizen Lab (John Scott-Railton, Bill Marczak and Ron Deibert) examined the case with Serbian digital rights group SHARE Foundation. They also looked at a second target: Rade Bajić, a former senior associate at the Organized Crime Prosecutor's Office who worked on the "Generalštab" corruption case.
How OSINT was used:
Đokić requested the analysis and consented to it. SHARE helped collect forensic artifacts from his iPhone for Citizen Lab to examine.
Citizen Lab analyzed those artifacts for traces of mercenary spyware. The report does not publish the specific indicators, process names or infection timestamps.
For Bajić, analysts used a different signal: Apple Threat Notifications he received on Aug 13 and Aug 27, 2026. Citizen Lab treats these alerts as a "high-confidence indicator" of mercenary spyware targeting.
Researchers placed both cases against SHARE's earlier findings, which documented at least 14 people targeted in 2026.
What it led to: Citizen Lab found "with high confidence" that Đokić's iPhone was infected with NSO Group's Pegasus in 2026 through a zero-click exploit. Bajić was judged a high-confidence target; his device analysis is ongoing. The report does not name the operator, but notes Pegasus is sold only to governments. The findings raise the public count to at least 16 Serbian civil society members targeted or infected with mercenary spyware.
Learning Note: Not every spyware finding starts with malware. A platform notification, plus consented device forensics, can be enough for a high-confidence public attribution of targeting.
Techniques: mobile device forensics, Apple Threat Notifications as indicators, victim-consented artifact collection, pattern analysis across prior cases
Sources: Citizen Lab · Security Affairs · European Western Balkans
The Case: In mid-October, reports surfaced that ConnectWise Cloud Backup had been compromised. ConnectWise published an advisory with suspicious IP addresses on Oct 16. The attacker controlled ConnectWise cloud app identities and tried to sign in to more than 2,250 customer tenants. Who was behind it, and how were they moving so fast?
The Investigation: Microsoft Threat Intelligence compared the public indicators with its own records. It had already been tracking a password-spray campaign against its customers that week.
How OSINT was used:
Microsoft logged a cross-tenant password spray from 144.172.64[.]99 between Oct 10 and Oct 14. It hit 327 accounts at eight organizations, with over 151,000 failed logons and a peak of about 2,900 failures per minute.
When ConnectWise updated its public advisory, one listed IP matched that same spray address. That overlap is Microsoft's main stated basis for attribution.
Microsoft linked the activity to ARTEX, an open-source multi-agent AI penetration testing framework posted on GitHub under the account "Autumn-27."
The Record reports the ARTEX developer, Chinese engineer Li Puhua, said on Oct 8 the tool was being misused and would go closed source.
Microsoft published the IP indicators, generic user agents such as python-requests and curl, and hunting queries for defenders.
What it led to: Microsoft assesses that Storm-0940, a China-state-aligned group active since 2021, carried out the ConnectWise compromise. Some intrusions reached privileged cloud access in under three hours. Most targeting failed, and the spray itself produced no successful sign-ins. Defenders now have IPs and queries to check their own tenants back to Oct 1.
Learning Note: Infrastructure overlap is the workhorse of attribution. One IP that appears in two independent datasets can link incidents. It is also a single thread, so treat it as an assessment, not proof.
Techniques: infrastructure pivoting (IP overlap), indicator matching against vendor advisories, GitHub account research, log and telemetry analysis
Sources: Microsoft Security Blog · The Record
Police Closed the Case; Reporters Found a Crypto Wallet and Deleted Posts: Grok Deepfake Investigation Reopened in Wales
The Case: Around Christmas 2025, sexualised deepfakes made with X's chatbot Grok were posted on X at up to 6,000 per hour. Broadcaster and campaigner Jess Davies was one of many women targeted. She reported one post to police. In May 2026, the case was closed without the user being identified. Police had handled it under malicious communications law, not the sexual offences law written for deepfakes. Could the anonymous account be traced at all?
The Investigation: The Bureau of Investigative Journalism (TBIJ) examined how police handled Grok deepfake cases and published its findings on Sept 29. Reporter Lydia Morrish and Big Tech editor James Clayton then dug into the account that targeted Davies.
How OSINT was used:
TBIJ tested whether X's limits worked. Users could still request bikini images and other sexualised deepfakes of women without consent, and edit them in the standalone Grok app.
Reporters found one such image of Davies still live and flagged it to her. It was later removed from X.
TBIJ gathered new information on the user who targeted Davies, including a crypto wallet and dozens of deleted posts, and passed it to South Wales Police.
What it led to: South Wales Police reopened the case and is now investigating under sexual offences legislation, including enquiries with X. Davies is also starting civil action against X's parent company. Separately, Ofcom said on Oct 14 that X now blocks UK users from generating pornographic content with Grok's standalone image tool.
Learning Note: Journalists can rebuild an evidence trail that police treated as closed. Deleted posts and wallet addresses are classic pivots from an anonymous account toward a real person.
Techniques: SOCMINT, deleted content recovery, crypto wallet attribution, platform safeguard testing
Research and Methods
Bellingcat Benchmarks AI Geolocation on 52 Unpublished Photos: Close, but a Human Must Finish the Job
The Case: In September, Anthropic said its models were nearing "superhuman capabilities for geolocating outdoor photos." The comparison was to GeoGuessr players. For working investigators, the real question is different. Can a model pin a random, landmark-free photo to an exact camera position, and can you trust it when it does?
The Investigation: Bellingcat investigator Foeke Postma and investigative technologist Miguel Ramalho ran their third round of geolocation benchmarks, a series that began in June 2025. They tested closed and open models, a commercial tool and a non-generative baseline on the same photo set.
How OSINT was used:
Built a test set of 52 photos never published online, sourced from Bellingcat staff and its volunteer community. This avoids photos already sitting in training data.
Stripped all metadata, gave no context, and left out major landmarks. Some photos were snowy, foggy or taken at night.
Asked each model for one set of coordinates only, so no model could hedge with several guesses.
Allowed built-in search, code execution and page fetch, with a 15-minute limit per photo and a 64,000-token cap.
Scored two ways: a GeoGuessr-style score for the general area, and a custom Mean Log Score (0 to 100) that rewards closing the last few kilometres.
Built a "supercharged" agent on Claude Opus 5.5 with ESRI satellite tiles and Bellingcat's OpenStreetMap search tool, and compared it with the published GeoSleuth agent.
What it led to: The top models put more than half the photos within 25 km, and several placed at least 10 of 52 within 1 km. Gemini 4 Argon led on Mean Log Score; Claude Opus and Fable ranked at the top on both metrics. In a Venice test, 11 of 17 models landed within 5 km, but only Bellingcat's agent and GeoSleuth found the exact camera position. Models also refused photos, timed out, and "confidently" claimed wrong positions. Bellingcat's verdict: AI narrows the search area, but a human must verify and do the final feature matching.
Learning Note: The benchmark design is itself the lesson. Unpublished photos, one-guess answers and a score that punishes "close enough" mirror how geolocation is judged in real casework.
Techniques: geolocation, satellite imagery (IMINT), OpenStreetMap feature search, metadata removal (test hygiene), AI-assisted geolocation evaluation
Sources: Bellingcat
World Affairs and Political
Counting Towers From Space: Radio Liberty and an OSINT Analyst Map More Than 50 Air Defense Positions Around Putin's Valdai Residence
The Case: Vladimir Putin's residence at Valdai sits between Moscow and St Petersburg. In January, Russia claimed Ukraine had tried to attack it with drones. Kyiv disputes that, and independent experts and the CIA doubt it happened. Since then, Russia has kept adding air defense around the site. How large has that ring become, and which direction does it face?
The Investigation: Mark Krutov of Radio Svoboda (RFE/RL's Russian service) worked with an independent OSINT analyst who posts on X as @jembobineuse. This builds on earlier Svoboda investigations into the nearby Khotilovo airfield (June) and a lab complex on Lisiy Island (Sept 3).
How OSINT was used:
The team reviewed satellite imagery within a 50 km radius of the residence and built an interactive map of positions as of October 2026.
They logged each new air defense tower and position they could see.
They dated individual sites: one tower at Khotilovo air base existed by March 2026; construction of two towers near Lisiy Island began around early September.
They noted where the new towers cluster: the southern side, facing Ukraine. They also noted what is missing, with no new positions yet found on the northern side.
They compared the total with the much larger ring around Moscow.
What it led to: The analysis found 16 new towers built in October, taking the total to more than 50 air defense positions around Valdai. Sites include Khotilovo air base, described as Putin's backup airfield, and the shore of the Vyshny Volochyok Reservoir. The team assesses the towers are likely for Pantsir or Tor systems, but this is not confirmed. They expect northern positions may follow in coming months.
Learning Note: A good model for change detection: fix a radius, date each new structure, map it, and say clearly what you could not confirm.
Techniques: satellite imagery (IMINT), change detection, geolocation, structure identification, mapping
Sources: Radio Svoboda (in Russian) · Militarnyi
That’s all for now, talk to you soon!
David
Social Engineering and Scams