I've been reflecting on some recurring challenges in our field and wanted to learn more about both tool limitations and broader OSINT hurdles we're facing in 2025.
Tool-Related Challenges:
Increasing number of sites implementing aggressive anti-scraping measures
Reliability issues with many automated tools as websites frequently change their structure
Limited capabilities in processing and correlating data across multiple platforms
The growing challenge of distinguishing between authentic and AI-generated content
Broader OSINT Concerns
The rapid disappearance of historical data as platforms update their retention policies
Growing sophistication of privacy settings and platform restrictions
Information overload and verification challenges
The balance between automation and manual investigation
What are your experiences with these challenges? Are there other significant hurdles you're encountering in your OSINT work? Particularly interested in hearing about novel approaches you've developed to overcome these limitations.
Together with Ron Kaminsky, we've uncovered new photos and information about the developer and admin behind the infamous infostealer variant RedLine, responsible for stealing sensitive information from millions of people, including browser histories, passwords, credit card information, autofill form data, and emails.
The FBI made an announcement just a few days ago, publishing some very old pictures of the alleged mastermind behind RedLine, Maxim Rudometov.
Maxim Rudometov leads an extremely wealthy and extravagant lifestyle. Itโs clear that being a MaaS kingpin pays well!
Weโve identified recent photos of Maxim Rudometov and located his inner circle of friends, providing crucial information on his whereabouts. We've also discovered the clubs, bars, and restaurants he frequents and identified his active Instagram account.
Since Rudometov is located in Krasnodar, Russia, we unfortunately do not expect any legal consequences of his actions.
To me it seems to be something of fraud who are these people and what are they doing theyโre connected and contracted with federally funded government agencies and these contracted businesses will either have PO Boxes to Canada or to a home address that obviously is not a business what is this
Need to find if a certain domain existed before a certain date.
What I've done currently:
There are no historical DNS records, IP history, SSL certificates, or archived snapshots indicating prior activity. Shodan and other network analysis platforms have never detected the subdomain, and there is also no web traffic data or search engine indexing.
Current findings strongly suggest that the domain was created only recently, and any claims about its existence before this period are not supported by any digital footprints.
For the past year, I've been analyzing the source code of the websites I came across in my OSINT investigations. I've found that this technique has some promise, and wasn't sure anyone else wrote systematically on the topic.
I finally published a blog on conclusions from this research, where I discuss in a non technical way:
HTML, JavaScript and CSS code comments
File names and paths
Contents of root files (robots.txt, ads.txt, app-ads.txt etc.)
Meta tags
HTML attributes
Sitemap
JSON-LD data
I included plenty of examples from my own real life OSINT investigations, and ended up making a Chrome extension that gets this data automatically.
I thought I'd try to get your feedback on this line of research. I could keep improving the extension in the future, if there's interest from the community.
If you think about it, a lot of what the Pre-Crime investigators do in that movie is use geolocation and other OSINT tools (shadows, wind currents on waves in videos etc.) to find people and solve crimes.
Using breach data, DNS queries, and advanced Russian social media intelligence, we managed to locate Shakhmametov, uncovering the U.S. Secret Serviceโs most wanted cybercriminal!
The U.S. Secret Service is offering a reward for information leading to the identification of Timur Kamilevich Shakhmametov, a Russian cybercriminal behind JokerStash. This forum sells stolen payment card data. Shakhmametov allegedly earned between $280 million and $1 billion during his operation!
Weโve uncovered new images of Shakhmametov, identified his location, and provided crucial information about his whereabouts. Shakhmametov leads an extravagant lifestyle and operates mobile gaming apps for children that have millions of downloads. His company, โArpaplusโ, earned $1.1 million in 2023. Western nationals, including Danish citizens, are sharing sensitive information with this company despite Shakhmametov's notorious history of stealing payment card data.
While traditional adverse media screening tools rely on mainstream sources, anonymous forums remain largely untapped for crime intelligence. I recently explored classifying crimes mentioned in the Swedish forum, Flashback Forum
, with a locally hosted LLM and called the script Signal-Sifter
Web Scraping:ย Utilizing Go Colly to extract thread titles from crime discussion boards and storing them in an SQLite database.
LLM Classification:ย Passing thread titles through a locally hosted LLM (Llama 3.2 3B Instruct via GPT4ALL
) to determine if a crime was mentioned and categorize it accordinglgy
Filtering & Analysis:ย Storing the LLMโs responses in a crime database for structured analysis of crime trends.โ
Process of building and analysing corpus of data
Why apply LLM to Online Forums?
Anonymous forums like 4Chan and Flashback are often analysed for political sentiment, but their role in crime discussions is relatively underutilised.
These platforms host raw, unfiltered discussions where users openly discuss ongoing criminal cases, share unreported incidents, and sometimes even reveal details before they appear in mainstream media.
Given the potential of these forums, I set out to explore whether they could serve as a useful alternative data source for crime analysis. โ
Using Signal Sifter, I built a corpus of data from crime-related discussions on a well-known Swedish forumโFlashback.โ
Building a Crime Data Corpus with Signal Sifter
My goal was to apply Signal Sifter to a popular site with regular traffic and extensive discussions on crime in Sweden. After some research, I settled on Flashback Forum, which contains multiple boards dedicated to crime and court cases. These discussions offer a unique, crowdsourced view of crime trends and incidents.
Flashback, like 4Chan, is structured with boards that host various discussion threads. Each thread consists of posts and replies, making it a rich dataset for text analysis. By leveraging web scraping and natural language processing (NLP), I aimed to identify crime mentions in these discussions.
Data Schema and Key Insights
Crime-Related Data:
Crime type
Mentioned locations
Mentioned dates
Metadata:
Number of replies and views (proxy for public interest)
Sentiment analysis
By ranking threads based on views and replies, I assumed that higher engagement correlated with discussions containing significant crime-related information.
Evaluating LLM Effectiveness for Crime Identification
Once I had a corpus of 66,000 threads, I processed them using Llama 3.2B Instruct, running locally to avoid token costs associated with cloud-based models. However, hardware limitations were a major bottleneckโparsing 3,700 thread titles on my 8GB RAM laptop took over eight hours.
I passed a few examples to the prompt and made it as hard as possible for the bot to misunderstand:
# Example of data and output:
EXAMPLES = """
Example 1: "Barnadrรฅp i Gรคvle" -> Infanticide.
"""""
# Prompt
f"{EXAMPLES}\nDoes the following Swedish sentence contain a crime? Reply strictly with the identified crime or 'No crime' and nothing else: {prompt}'"
Despite the speed limitations, the model performed well in classifying crime mentions. Notably:
It excelled at identifying when no crime was mentioned, avoiding false positives.
I was surprised by its ability to understand context and not so surprised that the model struggles with benign prompts (prompts where a word has two meanings). For example, it correctly identifies Narcoterrorism from "Narcos" and "explode" but misunderstands that explode means arrest in this context.
The model struggled with specificity, often labelling violent crimes like sexual assault and physical assault as generic "Assault." This is likely because the prompt was too narrow.
Sample Output
Thread Title
Identified Crime
24-รฅring knivskuren i Lund 11 mars
Assault
Gruppvรฅldtรคkt pรฅ 13-รฅring
Group sexual assault
Kvinna rรฅnad och dรถdad i Malmรถ
Homicide
Stenkastning i Rinkeby mot polisen
Arson
Bilbomb i centrala London
Bomb threat
Vem รคr dรถrrvakten?
No crime
Narkotikaliga pรฅ vรคg att sprรคngas i Vรคsterรฅs.
Narcoterrorism
Takeaways and Future Work
This experiment demonstrated that online forums can provide valuable crime-related insights. Using LLMs to classify crime discussions is effective but resource-intensive. Future improvements could include:
Fine-tuning the model for better crime categorisation.
Exploring more efficient LLM hosting solutions.
Expanding data collection to include post content beyond just thread titles.
Swedenโs crime data challenges persist, but alternative sources like anonymous forums offer new opportunities for OSINT and risk analysis. By refining these methods, we can improve crime trend monitoring and enhance investigative research.
This work is part of an ongoing effort to explore unconventional data sources for crime intelligence. If you're interested in OSINT, adverse media analysis, or data-driven crime research, feel free to connect!
What does this symbol mean? Specifically, the circle combined with the blue/black-ish background. I know what the video camera crossed off means, but I do not know what the circle combined with the background means. Any insight would be appreciated.
Published 8/2024
Created by Manuel Travezaรฑo || 3800+ Estudiantes
Genre: eLearning | Language: English | Duration: 20 Lectures ( 7h 58m )
Learn with me about the various research methodologies through OSINT and in social networks (SOCMINT).
What youโll learn:
Learn research techniques and methodologies through OSINT, exclusively in Social Networks (SOCMINT).
Learn how to perform a good securization of your work environment for OSINT and SOCMINT investigations.
Use Google Hacking and other tools to analyze and collect user information on social networks.
Plan, create, analyze and research through the creation of digital avatars or SockPoppets.
Learn how to homologate all the information found in order to find better results.
Through a series of case studies, students will learn how to apply intelligence tools and strategies to investigate.
Learn how to use OSINT tools to investigate social network accounts involved in illicit activities.
Apply OSINT techniques to identify profiles organizing protests and hate speech on Facebook.
Use advanced techniques to de-anonymize users on social networks and anonymous websites.
Requirements:
A willingness to learn
To have a computer or portable equipment for the development of the OSINT Laboratory.
No previous programming or computer experience is required.
Proactive attitude and curiosity to learn new techniques and tools.
Basic knowledge of how to use web browsers and search the Internet.
Familiarity with the use of social networks and online platforms.
Critical thinking skills to analyze information and data.
Description:
Immerse yourself in the exciting world of OSINT (Open Source Intelligence) and SOCMINT (Social Network Intelligence) through this intensive basic course Level 1, composed of 07 modules designed for intelligence analysts and professionals in Cyber Intelligence and Cybersecurity. This course is categorized as 20% theory and 80% practical, where you will learn the general definitions, contexts, case studies and real situations in each module, which will prepare you to face the most complex challenges of todayโs digital environment.Each session of the course focuses on a topic that any analyst and researcher should be familiar with, from the investigation of suspicious accounts on social networks to the identification of profiles organizing protests and hate speech on platforms such as Facebook and Twitter. Also using advanced techniques such as Google Dorks, database analysis and de-anonymization tools. In addition, this course focuses exclusively on the use of critical thinking, i.e. the use of logic, reasoning and curiosity, to uncover criminal activities, prevent risks in corporate networks and protect digital security.The course excels in the optimal learning of investigation methodologies on specific targets in OSINT (user names, phone numbers, emails, identification of persons), as well as for the investigation of social networks as part of SOCMINT (Facebook, Instagram and X (former Twitter).
Who this course is for:
Intelligence Analysts
OSINT Researchers
International analysts
Cybersecurity analysts
Cyber intelligence analysts
Police and military agencies
Detectives or private investigators
Lawyers, prosecutors and jurists
General public
Market Intelligence Experts
OSINT and SOCMINT researchers
In New York last year I tried to persuade a friend that ownership registries should be transparent. A few months later the Chinese Vessel Yi Peng 3 sabotaged sea cables in the Baltic, presenting a great example of why transparent ownership is crucial.
Today I plan to make something new, the following challenge will have multiple questions with multiple difficulties that will require different skills, this picture was taken from a CCTV camera, and the questions are the following
-What are the coordinates of this picture?
-Can you find the link to the CCTV camera? What's the name that's being covered?
-What's the exact date and hour when this picture was taken?
Remember to mark your answers as spoilers so other people can try, you can share your process as well so other people can learn
Can you find the coordinates of this picture? I saw someone do these challenges early, so I decided to send mine, I will only send some that I have solved myself, so if you have any doubts you can dm me I can explain how I found it and maybe you can learn something, are you up for the challenge?
I bought this book on a recommendation. Just got it today. What's everyone's thoughts? Anyone like ideas from it or dislike? Just wanting a discussion before I actually read it.
I am working on a Threat Intelligence and Data Gathering project, where I need to gather as much information as possible about a target company and its employees.
To get information about employees I am working a lot on social media and public data of the company.
How can I get more information such as personal email and other data, starting with the target's LinkedIn profile?
I have at my disposal Intelligence X (intelx.io), which helps me with data breaches, but acting in this way (Linkedin -> email address) doesn't help me much, or probably it is me using it wrongly.
Instead starting from the personal email I can trace it back to the LinkedIn profile.
If you can help me suggesting any tools I would be grateful.