OSINT methodology, forensic reference material, and practitioner briefings.
Built for investigative journalists, practitioners, and verification desks. Training and consultancy available on request.
Latest publication.
The most recent story from the desks.
Financial flows and sanctions evasion: investigator's guide.
Screen entities across sanctions regimes, map beneficial ownership through corporate registries, and document ownership chains to evidentiary standard.
Civil and criminal judgment research for investigators
OSINT Cards
Extract judicial findings, asset disclosures and named associates from
court dockets using an eight-step PACER-based workflow.
28 Jul
›
Phone number carrier mismatch: AI hypothesis analysis
AI in OSINT
Rank the explanations for a phone number subscriber name mismatch with a
structured AI prompt, then identify the discriminating next query.
29 Jul
›
Mobile location intelligence: advertising IDs and BSSID
Methods
How advertising identifiers and Wi-Fi probe records expose device
movement, and the legal constraints that govern their use in investigations.
03 Aug
›
Track disease outbreaks with open-source surveillance
OSINT Cards
Map an emerging outbreak using ProMED, HealthMap and Nextstrain before
health authorities issue a formal declaration.
04 Aug
›
Dark web legal and ethical boundaries for investigators
Methods
Apply CMA, CFAA and GDPR Article 6 to dark web access, build a Tails OS
environment, and capture evidence to evidentiary standard.
10 Aug
›
OSINT Guides.
One topic worked start to finish, from first source to finished file.
How to verify a source: OSINT identity checks for journalists.
A structured workflow for confirming a source's claimed identity using digital depth checks, reverse image search and cross-platform corroboration.
Telegram OSINT: investigate channels, groups and users.
A practitioner workflow for mapping public Telegram channels, identifying account metadata and building an evidence-grade investigation file.
Email OSINT: trace an address to accounts and infrastructure.
A structured workflow for tracing an email address through breach history, account enumeration, domain infrastructure and email header analysis.
Maritime OSINT: how to investigate vessels.
Track vessels, trace ownership and document incidents using public data. No proprietary access needed.
OSINT Reference Card Library.
Field-ready tradecraft. Live next to a keyboard, not in a slide deck.
SPC-002
Identifying satellite operators and owners.
Cross-reference ITU frequency filings, Space-Track TLE data and corporate registries to name the licensed operator and beneficial owner behind a satellite.
IDN-002
Cross-platform username tracing to identity attribution.
Enumerate handles across hundreds of platforms with Sherlock, cross-reference breach data and build a convergence dossier to evidentiary standard.
HUM-002
Secure source communications: Signal, SecureDrop, Tails.
Run MVT device checks, route documents through SecureDrop and document every source contact to chain-of-custody standard.
FIN-002
Property and land registry investigation: beneficial owner tracing.
Identify beneficial owners behind corporate property titles using HM Land Registry, Companies House and the Register of Overseas Entities.
AI in OSINT.
Integrating AI tools and language models into your OSINT workflow.
Writing style analysis across three anonymous forums.
A structured AI prompt scores stylometric convergence across forum handles and flags divergence, with indeterminate as the honest verdict when the signal will not support one.
The email address appears in four breach sets under different names.
A structured prompt that surfaces the consistency signals across a decade of breaches and ranks the attribution candidates by persistence score.
Two companies, one director name, three jurisdictions.
A prompt that normalises registry extracts onto one schema and surfaces the fields doing the discriminating work across OpenCorporates, ICIJ and OCCRP Aleph.
The source says they were at the scene. The prompt tells you what to look for.
Build the verification checklist before the interview, not after. A structured AI prompt for testing source presence claims at scene.
OSINT Methodology Tutorials.
Step-by-step tutorials drawn from working casework.
Financial flows and sanctions evasion: investigator's guide.
Screen entities across sanctions regimes, map beneficial ownership through corporate registries and document the ownership chain to evidentiary standard.
Satellite imagery change detection: Sentinel and Landsat.
Use ESA and USGS multispectral archives to document ground-truth change over time, with a reproducible evidence chain.
Telegram, Discord and niche forum investigation: mapping networks without joining them.
Map channels, trace propagation paths and extract membership data from closed platforms without triggering account exposure.
Wi-Fi positioning and geo-IP: locating by network data.
Resolve BSSID and IP identifiers to physical locations using Wigle.net and geo-IP databases, then cross-reference both before you publish.
The Signal.
A weekly practitioner briefing built around one open-source methodology. Each issue takes a live event as proof the technique matters, then builds the evidentiary file around it.
The Signal, Issue #005.
ICE would not name the agent who killed Johan Sebastian Duran Guerrero in Biddeford. Six public records, from employment history to a court filing, corroborated his identity in three days, and the same denial has now repeated across three shootings in two weeks.
The Signal, Issue #004.
A 2022 chat leak and two federal court judgments show how Patriot Front actually funds itself. The march was staged for cameras, the ledger was not.
The Signal, Issue #003.
Iran struck three tankers off Oman's coast on a route its own broadcaster had already warned ships to avoid. A free satellite pass and a UKMTO advisory trail build the record Iran never had to claim.
The Signal, Issue #002.
Twin earthquakes sealed Venezuela's worst-hit zone within hours. Copernicus EMS activated damage mapping the next day. The gap between official figures and the open record is documentable, without physical access.
The Signal, Issue #001.
A drone struck the Ever Lovely on an authorised corridor and Iran denied it. The heading field in AIS data caught four coerced vessels before a weapon was fired.
The Signal · Weekly Briefing
One open-source methodology. One live investigation. Every week.
A weekly practitioner briefing built around one open-source methodology. Each issue takes a live event as proof the technique matters, then builds the evidentiary file around it. Free. Read by investigative journalists, newsroom verification leads, and OSINT practitioners.
